Delaware County updates personnel policy to require approval for employee use of AI with sensitive data

The Delaware County Board of Commissioners approved an update July 14 to the county personnel policy manual adding rules governing use of artificial intelligence tools by employees.

Dawn Houston, Deputy Administrator, said the update was “a group effort” involving the auditor, the IT director and county counsel and that the policy “will update the, personnel policy manual to add artificial intelligence.” Houston told the board that the policy focuses on use of AI involving “county sensitive information” and requires written approval before employees upload or input sensitive data into AI systems. She said such use “would be subject to audit” and that records of the use must be maintained.

Eric Hostetler, deputy administrator, and Steve Lewis, IT director (mentioned in discussion), described the code as a provisional measure: Hostetler said the policy is “right now, I consider this to be a placeholder while we are continuing to evaluate a full robust AI policy that would cover all aspects.” Commissioners praised the move as timely; Commissioner Gary Merrill called it “great that we're out in front of this.” The board voted to adopt the update (resolution 25-514).

Board members and staff emphasized the policy targets uploads or inputs of sensitive information into AI systems rather than general web-based AI searches. Houston said that ordinary web searches using AI “would not be covered by this policy” but that “actually utilizing AI, uploading, or inputting sensitive information” is what the policy regulates. The update requires written approval for such uses and preserves county network protections by limiting unauthorized AI access.

Commissioners said they expect the policy to evolve as technology and best practices change and that staff will continue work on a more comprehensive AI policy.