Centennial lays out AI governance, security and pilot plan; staff to draft policy and begin controlled Copilot pilot

Sharpe Howard, the city’s IT director, presented an overview of Centennial’s plans and strategy for artificial intelligence at the March 4 meeting, emphasizing governance, pilot projects and cybersecurity.

Howard framed the city’s objective as using AI to help departments deliver services “better, cheaper, faster.” He described two near-term goals for 2025: establish an AI governance framework (policies, steering committee oversight and staff training) and increase productivity through pilot deployments, beginning with a government-targeted implementation of Microsoft Copilot.

Key points from the presentation and Q&A:

- Governance and oversight: IT will propose administrative directives and a policy governing the responsible use of AI, with the existing IT steering committee (staffed by senior leaders) providing oversight and prioritization of pilots and investments. All IT procurements will be reviewed for architecture, cybersecurity and accessibility impacts.

- Platform choice and data protection: Howard said the city intends to start with Microsoft’s government/cloud version of Copilot (GCC/FedRAMP-authorized), which the city expects to fence Centennial data inside its tenant and keep sensitive city information from being used to train public models. Howard described the Copilot GCC offering as FedRAMP-authorized and designed to keep tenant data in a government cloud environment.

- Costs and estimated benefits: Howard cited a Copilot license price of about $30 per user per month ($360 annually per seat). He provided a high-level estimate that provisioning Copilot seats for roughly 75% of staff would total about $2,021,000 and that Gartner-style productivity gains could yield a roughly $700,000 labor-cost-equivalent return at a 9% productivity improvement—staff framed these as planning estimates rather than final budget requests.

- Cybersecurity risks: Howard and council discussed elevated risks associated with AI (phishing and social-engineering attacks generated by bad actors, automated vulnerability discovery, and identity fraud/deepfakes). Howard said Centennial’s cybersecurity tooling already leverages AI for log analysis and threat detection, and that the city will need additional measures to detect advanced AI-enabled threats.

- Contractor/subcontractor obligations and public-model usage: Council members asked whether contractors or elected officials would be subject to the city’s AI policy. Howard said subcontractors should be in scope and that the draft policy will address third-party use, but staff still need to work through contractual language. Council members also urged a clear prohibition against uploading sensitive city data into open public models (for example, public ChatGPT or Google Gemini) and requested specific guidance for elected officials; Howard agreed that policy should specify permitted and prohibited uses.

- Public data and open access: Howard clarified that public-facing data (web maps, public records posted to the city website) would remain accessible, and using public content would not change existing public access. However, any training or use of city-sensitive data will be tightly controlled within the city’s secure tenant.

Next steps: Staff will draft an AI administrative policy, begin small pilot projects (starting with Copilot in a government cloud configuration), scale proven pilots, and present any large investments to council for approval. Staff emphasized a preference to purchase mature AI products rather than build custom models to limit technical debt and manage risk.