Staff proposes county AI policy; Board asks for tighter package and additional privacy and IT updates

Napa County staff presented a draft artificial intelligence policy to the Board of Supervisors on July 29 and described an approval and oversight framework designed to manage data risk while enabling departments to use AI tools.

Digital Innovation Officer Meg Regan and Chief Security Information Officer Greg Bowne briefed supervisors on the proposed county policy, which would: require department-head approval and an ITS technical/security review before adopting AI tools for county work; prohibit sharing protected or otherwise sensitive data with unapproved AI services; require mandatory human review of AI-generated content before publication or decision-making; and create department-level procedures and training tied to specific uses. Regan said the policy would also establish an advisory digital governance committee and called for biannual policy review to keep pace with rapid change.

Regan illustrated the guardrails with examples: an AI draft of a public FAQ must be fact-checked and edited before release; an AI-enabled wildfire-smoke camera would need department approval, ITS security review and a defined operations guideline before deployment. Bowne stressed protections against data leakage, biased outputs and copyright exposure and said ITS is holding a small number of pending procurement requests for tools that include generative-capability until a policy is in place.

Supervisors generally supported the approach but asked staff to pare and clarify the document and to present a short, plain-language user guide or handbook. Several supervisors asked that the AI policy be bundled with an updated information-technology use and security policy and a distinct digital-privacy policy rather than carry all details in a single long document. Supervisor Manfrie flagged future issues such as embedded AI (where users may not realize AI is in the tool) and urged strong human-review controls. Supervisor Ramos requested an inventory or "health meter" of existing county systems to identify any deployed tools that might be out of step with future policy.

County counsel and IT staff said a draft revised IT security policy is nearly complete and that staff can return with a coordinated package. Staff recommended establishing the proposed digital governance committee and using the AI policy as a foundation while the committee and department-level procedures are developed. No final board vote took place; supervisors directed staff to revise the materials and return with a more concise policy and companion documents.