City proposes AI disclosure rule and requires authenticator apps for certain staff

Chris Sorensen, the city’s chief information officer, told the council the work‑session presentation proposed two personnel policy updates: an AI-use disclosure requirement and a multi‑factor authentication (MFA) directive for certain employees.

Sorensen said the AI policy would make employees “responsible anytime they use AI to generate anything in the performance of their duties.” On multifactor authentication, he described the technological trend toward authenticator apps and told council the draft policy would require employees in positions that require authenticator‑app MFA to use a personal smartphone for the authenticator if no city-provided alternative is available. “If you're in a position that that requires you to use an IT tool, and it has multifactor authentication that requires an authenticator app, you're gonna have to use your personal phone if you have one,” he said.

Council members asked about records-request and public‑records implications. Jared Johnson, city attorney, advised that the Idaho Public Records Act's definition of public records does not appear to render an employee’s personal device automatically subject to public‑records production solely because the device stores an MFA authenticator. He said that, in his interpretation, the MFA credential itself would not be a public record under the statute and that courts have not yet addressed the specific question.

Council discussion noted employee concerns that using a personal device for MFA could raise records or privacy questions; Sorensen and the city attorney said the proposed policy would not, by itself, make an employee’s phone a public record. Council asked staff to bring the draft policy forward for formal consideration at a future regular meeting and asked HR/IT to prepare supporting language, alternatives for employees without smartphones and any necessary records‑handling guidance.