The Lake County Technology Committee on Aug. 1 approved three joint resolutions to update the county's cybersecurity training policy and to adopt AI governance and AI usage policies intended to guide procurement and use of artificial intelligence across county departments.

Chris Blanding, the county chief information officer, presented the three policies and introduced staff involved in developing them, including applications manager Mike Maslana. "We have reviewed and revised [the cybersecurity policy], and the AI governance policy and the AI usage policy are new," Blanding said. He said the policies were developed with a consultant and with cross-department stakeholder review.

On the cybersecurity awareness training policy (CSAT), staff said they added a state statute requirement to require annual cybersecurity training for all county-required employees and that monthly NINJIO micro-lessons will continue but the policy will emphasize the annual training and targeted follow-up for repeated failures on phishing tests. "What we did change then was regarding the monthly NINJIO video...we're going to require the annual as the state statute says," Blanding said.

On the AI policies, officials described a two-part approach: a governance policy to evaluate and approve vendor AI products and a usage policy to educate staff on safe practices. The governance policy establishes an advisory review team to evaluate AI tools for security, privacy, accuracy, bias and data-use concerns and to place products on an approved list or a "do not use" list. "That team would look at these pieces of software, and give a recommendation," Blanding said. Mike Maslana added that the usage policy focuses on "human-in-the-loop" practices and on accepted versus prohibited uses, noting the policies require staff to report issues with AI outputs.

Staff told the committee the Sheriff's Office and the Health Department had indicated they would not adopt the AI policies immediately. A staff member said the Sheriff's Office cited ongoing contractual matters and wants to continue working with the county advisory group; the Health Department said it must route policies through its board and adapt the framework to regulated health-care requirements including HIPAA. "The Sheriff's office contacted me yesterday and state that, due to some current contract matters that they're dealing with, they were unable to adopt the AI policies at this time," a staff member said. A Health Department representative said the department will align its technology framework and update its cybersecurity policy to incorporate state requirements and said it will work with county staff toward future adoption.

Committee members discussed concerns that governance reviews could slow procurement; staff said vendors have been responsive and that the review process includes a fast-track path for low-risk, well-documented products. Staff also said the policy process allows pilots and proofs-of-concept after team review and that departments with special regulatory requirements (for example, CJIS or HIPAA) would be considered during reviews. "If there is significant risk, we would put it on the not used tool. But then also it goes through a longer process where we could work with the vendor and mitigate those risks to our satisfaction," Blanding said.

Member Roberts moved approval of the three resolutions; the motion was seconded by Vice Chair Kasdan and passed on a voice vote. Staff indicated they will publish directives and training materials, make a countywide approved-tools list available, and continue stakeholder engagement as the policies are implemented.