Waukesha board reviews draft AI acceptable-use policy, asks staff to refine and return in December

City information-technology staff introduced a draft AI acceptable-use policy on Nov. 5 and solicited feedback from the Information Technology Board on controls, training, and vendor selection.

Chris (city IT staff) said the draft pulls from NIST and other guidance and would permit AI use where beneficial while establishing guardrails: required training before approved use, restrictions on submitting confidential personnel or health data to external AI services, and a push to use an enterprise version of Microsoft Copilot to keep city data inside the citys managed environment. Staff described a monitoring workflow that blocks unknown AI sites by default, then allows them after a security review in Defender for Cloud.

Board members asked for changes to wording they said could be difficult to operationalize. Several members said a clause requiring users to "report all AI use to their supervisors prior to use" may be too strict for routine tasks such as drafting short emails or checking grammar. Members also discussed whether the policy should cover only employees or extend to contractors and volunteers, and they suggested clarifying the definition of AI so analytical tools that are not "generative" are handled appropriately.

The board examined legal and records-retention angles: staff noted that chat and AI-generated content may be discoverable in open-records requests, and that using external AI platforms could create records the city cannot locate or produce if those services are outside the citys environment. Members asked staff to clarify retention, discoverability, and how AI use interacts with the citys existing records schedule and litigation-hold practices.

On tooling and cost, the board heard staff currently use basic Copilot tied to Microsoft but plan to move to an enterprise Copilot subscription that provides data-loss-protection and data isolation; staff cited a higher-education Copilot price example discussed in the meeting ($369 per user per year, dropping to $218 on Dec. 1 for certain plans) and noted enterprise pricing varies by license type and vendor. No formal action was taken; the board requested staff revise the draft using the feedback and return the policy for further discussion or approval at a future meeting, expected in December.

Board members emphasized balance: enable innovation to improve operational efficiency while avoiding accidental disclosure of confidential data or creating records the city cannot produce. Staff said the draft policy is intended to provide that balance and to establish approved tools and training before agency-wide roll-out.

Next steps: staff will revise the AI acceptable-use policy to address board feedback and present an updated draft in December for further discussion or action.