Leander staff propose generative AI acceptable-use policy; council asks for changes, takes no action

Leander Assistant Director of IT Stuart Smith presented a draft city policy on using generative artificial intelligence at the March 6 Leander City Council meeting, proposing a framework that delegates routine, low-risk AI uses to departments while routing higher-risk uses that involve confidential data to the city manager for review.

The proposed policy aims to balance “accountability, transparency, awareness, and innovation,” Smith told the council, explaining that it would allow departments latitude to use generative tools for nonconfidential tasks without going through the city’s standard, often slower, technology procurement review. Uses that would involve confidential or legally protected data would require an elevated review and approval by the city manager and input from relevant stakeholders such as human resources, the records office, and legal.

Council members pressed staff on several operational points. Council member Michael Herrera asked how the city would prevent employees from pasting confidential material into free online AI tools; Smith said the policy expressly prohibits inputting confidential or proprietary information into generative-AI systems and that he would recommend higher-risk services be housed on U.S.-based cloud infrastructure when feasible. Herrera also raised concerns about staff substituting AI output for expert judgment and about acquiring enterprise AI products to centralize control.

Other council members urged a more inviting, tiered policy and asked for a whitelist or a clearer distinction between types of AI (for example, large language models versus other analytic tools). Council members also recommended building procedures that can change without returning to council each time and suggested outreach to staff to inventory tools already in use across departments.

Smith said the city already follows the proposed approach in at least one instance: the police department is piloting an AI product and staff followed the review path described in the draft policy. He also said the city has a contracted security operations center and backup personnel who monitor network logs, but declined to discuss technical monitoring details in a public meeting.

The council discussed restricting the use of specific products when state or federal guidance requires it; Smith confirmed the city would implement bans tied to gubernatorial or state directives. Several council members encouraged staff to pursue an enterprise procurement if the council decides that a single, centrally managed product (for example, a paid Copilot-style service) would better control data use and monitoring.

After questions and suggestions, the council did not adopt the policy at the meeting. Item 10, the ordinance and policy establishing generative-AI acceptable use for city employees, was pulled from the consent agenda for discussion and the council ultimately took no action on it at this meeting.

Council members asked staff to return with revisions that clarify the policy’s scope (what counts as generative AI versus other predictive or autocomplete tools), to outline a tiered approval process, and to propose procedures and a staff outreach plan so departments can report existing usage and suggest approved products.

Pro Tem and other council members praised the staff for starting the work but asked for a version that encourages safe innovation while making compliance practical for supervisors and line staff.