City of Boston Generative Artificial Intelligence (Gen AI) Policy

POLICY

Part 1: Employees are Responsible for the Impacts of Gen AI Tools

City employees that choose to use Gen AI tools in their work maintain ultimate responsibility for their work product and its downstream impact on constituents and City operations. They are expected to exercise human judgment and critical thinking in deciding if, when, and how to incorporate Gen AI tools into their individual work. The use of GenAI does not absolve an employee of accountability for the accuracy, ethics, or outcomes of their assignments. The rest of this policy, the FAQ, and the Use Case Guidelines are meant to make it easier to understand the risks of using these tools in different situations, so that employees can make thoughtful and informed decisions. 

Decisions about how Gen AI should fit into departmental operations are left to the discretion of departmental leadership, so long as such decisions are consistent with this policy. Individual departments may create additional policies or requirements related to Gen AI use that are more restrictive than this policy. Employees are encouraged to engage with their supervisor and department leadership to navigate expectations around work involving Gen AI. 

Part 2: Understand and Manage Gen AI Risks Before Using Gen AI Tools

Unlike other technologies, Gen AI tools are probabilistic. They do not produce a predictable, determined answer based on clear inputs (like a calculator). Instead, they combine inputs with the data they were trained on to generate new content that often cannot be predicted in advance, which can lead to errors and hallucinations. 

Depending on the context in which these errors are made, this can create significant risks for constituents and/or employees. This section clarifies what employees should do to identify and manage risks appropriately For more detail, please see the “Known Risks & Harms of Gen AI” Section in the Gen AI FAQ. 

2a) Avoid Unacceptable Uses of Gen AI

There are some use cases of Gen AI that create unacceptable levels of risk. These use cases significantly interfere with or delegate decision-making about a constituent’s ability to access City services or exercise their human rights or civil liberties. 

City employees shall not use Gen AI in any of the following ways: 

• To determine constituent eligibility for or access to services or benefits
• To evaluate candidates for open roles or promotions, including resume review
• To generate false, misleading, or deceptive content
• To impersonate an individual in any format without their explicit consent, including but not limited to written material, audio content, images, or video
• To translate Vital Documents (defined in City Code) without explicit consent from the Language and Communications Access Team (lca.staff@boston.gov)
• To take and/or summarize meeting notes using External Tools (tools that are not City-developed or City-approved) 
• To take and/or summarize meeting notes using City-Developed or City-Provided tools without first obtaining informed consent from all parties. 

As the field of Gen AI evolves over time, uses may be added or removed from the list above at DoIT’s discretion (with clear notice to employees). City employees can read more about why these use cases are unacceptable in the FAQ. 

2b) Follow Best Practices for Established Use Cases

The Use Case Guidelines provide best practices for use cases that are common to City workers. These guidelines are meant to help employees use Gen AI effectively and safely in their work. Employees interested in or actively using Gen AI are strongly encouraged to review these guidelines regularly as they are updated on an ongoing basis. 

2c) Work with DoIT to Explore New Use Cases

Gen AI is a rapidly evolving field, with new tools and use cases emerging on a regular basis. Employees are expected to engage DoIT to explore new, useful applications of Gen AI in their work. 

Employees are strongly recommended to notify DoIT if they want to use Gen AI for something that is not explicitly covered in the Use Case Guidelines. Email techgovernance@boston.gov with information about what you are trying to do with Gen AI and any tool(s) you are considering using. DoIT staff will work with you to clarify what type of risk(s) your use case poses and identify appropriate risk mitigation strategies. 

Part 3: Choose the Right Tool Based on The Data You Use

After assessing the risks of using Gen AI for a given use case, City workers can choose from different tools to use. This section is meant to clarify what tools are available to City workers and guide tool selection. The full list of available City tools can be found in the City’s AI Inventory.

Part 3a) Complete City Training to Access City Tools

• To access City-Developed and City-Approved tools, City workers must complete DoIT’s approved Gen AI in Government Training, which is reviewed on an annual basis. The current version is located online. 
• City workers interested in using Gen AI tools are strongly encouraged to complete the Responsible AI Certification through Innovate(US). More details can be found on the Gen AI Tools & Training Page in Beacon. 

Part 3b) Use City-Developed Tools for Any Kind of Data

• City workers may use City-Developed tools to work with any kind of data. City-Developed tools have been developed for City workers, are actively supported by DoIT staff, and have strong security and privacy controls. They are marked as ‘City-Developed’ in the AI Inventory. 
• City workers are strongly encouraged to follow best practices in the Use Case Guidelines while using these tools. 

Part 3c) Use City-Approved Tools for Medium- or Low- Sensitivity Data

• City workers may use City-Approved tools for medium- and low-sensitivity data only. City-Approved tools will have a contract in place that ensures baseline privacy and security features. They may only be available to certain employees. They are marked as ‘City-Approved’ in the AI Inventory.
• Employees can review the Data Security Policy for more information on what is considered medium- and low-sensitivity data.
• City workers are strongly encouraged to follow best practices in the Use Case Guidelines while using these tools. 

Part 3d) Do not use External Tools for City Work

● City workers may not use External Tools for City work. External tools include any tool that is not explicitly listed in the AI Inventory. 

ADDITIONAL RESOURCES

• Gen AI Tools and Training for Employees (Beacon Page) 
• Gen AI FAQ (Beacon Page) 
• Gen AI Use Case Guidelines for Employees (Beacon Page) 
• City of Boston Tech Policy Glossary (Google Doc) 
• Data Security Policy for Employees (Beacon Page) 

Department-Specific Resources 

Some departments have opted to create additional guidance related to Generative AI that is specific to their work. DoIT does not manage these documents directly. Departments may set stricter standards than this policy, but they must meet its minimum requirements at all times. 

The development of these guidelines has benefited from the contributions of academic, community, and City of Boston team members. Special thanks to:

• Beth Noveck, Director, Burnes Center for Social Change; Professor, Northeastern University School of Public Policy and Urban Affairs
• Dan Jackson, Director, NuLawLab, Northeastern University Law School
• John Basl, Associate Professor of Philosophy, Northeastern University Department of Philosophy & Religion
• Kade Crockford, Director, Technology and Justice Programs, ACLU of Massachusetts 
• Kevin O'Reilly, Senior Manager of Innovation Programs, Howe Innovation Center at Perkins
• Kimberly D. Lucas, Professor of the Practice in Public Policy and Economic Justice, Northeastern University School of Public Policy and Urban Affairs
• Martha F. Davis, Professor, Center for Global Law & Justice, Northeastern University Law School
• Raquel Ronzone, Associate Director, Strategy & Partnerships, Howe Innovation Center at Perkins
• Sandy Lacey, Executive Director, Howe Innovation Center at Perkins
• Sarah Hubbard, Associate Director for Technology & Democracy, Allen Lab for Democracy Renovation