Black Hawk supervisors review proposed tiered AI policy, ask for implementation details

Black Hawk County’s IT director presented a draft artificial intelligence policy to the Board of Supervisors on Sept. 9, proposing a tiered framework to govern how county employees use AI tools and recommending an oversight committee to review higher‑risk uses. The board discussed reporting, committee membership and an update schedule and signaled interest in returning the policy for adoption after the policy‑review committee and a short follow‑up period.

County Information Technology Director Al U told the board that the draft uses a three‑tier risk approach to help staff judge whether a given AI use is low‑risk (Tier 1), moderate (Tier 2) or high‑risk (Tier 3), based primarily on the sensitivity of data put into AI systems. He said the policy would make AI use voluntary, allow department heads to deny AI use in their areas, and require committee review and a formal risk assessment for high‑risk proposals.

The policy aims to protect personally identifiable information and other regulated data while allowing departments to leverage AI for routine efficiencies. “We were trying to bridge the gap between approval and practical adoption,” Al said, describing the committee’s work and the need to use standardized risk‑management frameworks (for example, NIST‑style assessments) for Tier 3 requests.

Supervisors asked how oversight would work and what reporting they would receive. Supervisor Leland asked whether the county should require periodic reports; Al said the draft calls for reviews every six months and that the AI committee would recommend updates as needed. Several board members urged that any final policy include a requirement to report back to the board on usage and outcomes so supervisors can evaluate implementation.

Board members also discussed committee membership. Al said the initial drafting group included Amanda Dussemeyer, Clint Hardman, Aaron Reinke and Matt Strong and recommended expanding membership beyond IT to include people with legal, programmatic and data‑privacy expertise. He said the committee would use established risk frameworks to evaluate Tier 2 and Tier 3 uses and provide departments with a standardized process for requesting approval.

No formal vote was taken. Supervisors directed staff to brief the policy‑review committee and return to the board in the coming weeks with any recommended changes and with a plan for committee membership and reporting metrics. Al and staff also offered training sessions for individual departments and supervisors to demonstrate the proposed safeguards and practical use cases.

The board and staff noted the policy should be updated frequently given rapid changes in AI technology; the draft specifically recommends a six‑month formal review schedule and ad‑hoc updates as needed. Supervisors indicated they favor returning the draft for a decision after the policy‑review committee meets and staff supply draft membership and reporting details.