CITY OF REDONDO BEACH
ADMINISTRATIVE POLICY AND PROCEDURES (APP)
Number: 04.05
Subject: ARTIFICIAL INTELLIGENCE POLICY
Original Issue:
N/A
Effective:
3-16-26
Category: Information Technology
Supersedes: N/A
PURPOSE
This policy establishes governance and operational standards for the use of Artificial Intelligence (AI) systems by the City of Redondo Beach (“City”). Its purpose is to ensure that AI technologies are used responsibly, securely, and transparently in support of City operations while protecting resident privacy and maintaining compliance with applicable laws and cybersecurity standards.
The goals of this policy are to:
Provide clear guidance for City employees, contractors, and vendors who may purchase, configure, or use AI tools on behalf of the City.
Define the approval process for new AI technologies, including mandatory review by the Information Technology (IT) Department.
Ensure that AI systems are deployed in alignment with City cybersecurity, data protection, and privacy requirements.
Maintain accountability, transparency, and human oversight in the use of AI.
Prevent unauthorized or inappropriate use of AI technologies, particularly those involving sensitive data such as personally identifiable information (PII) or criminal justice information (CJI).
SCOPE
This policy applies to all City employees, departments, volunteers, consultants, and contractors who purchase, configure, develop, use, or manage AI tools or systems on behalf of the City.
This includes but is not limited to:
General-Purpose AI tools, such as ChatGPT, Copilot, Gemini, Claude, and similar generative or conversational AI systems.
Department-Specific AI systems, such as machine learning models used for data analysis, workflow automation, or decision support within a particular business process.
Embedded AI features within other applications that perform predictive, analytical, or automated decision functions.
Employees must also remain aware that many traditional or legacy software products now include AI features behind the scenes, such as predictive typing, automated data analysis, or “smart” recommendations. Even if a tool appears conventional or familiar, if it includes any automated prediction, recommendation, or decision-making functionality, it is subject to this policy.
DEFINITIONS
Artificial Intelligence (AI):
A machine-based system that, for a given set of human-defined objectives, can make predictions, recommendations, or decisions influencing real or virtual environments. AI systems use human- or machine-provided data inputs to perceive their environment, analyze information, and generate outputs that augment or replace human decision-making.
General-Purpose AI Tool:
Any broad or consumer-facing AI platform that is not developed or configured specifically for a City business function but can generate or analyze content for a wide range of uses (for example ChatGPT, Gemini, Copilot, Claude, or similar services). These tools are especially high-risk because data entered into them may be transmitted to third-party servers, used for model training, or disclosed outside the City’s control.
Department-Specific AI System:
An AI capability built or purchased for a specific operational purpose within a City department (for example predictive maintenance analysis, call routing, or permit review).
If a software product performs automated tasks using models trained on data or that learn from user input, it qualifies as AI under this policy.
POLICY STATEMENT
Authorization Requirement
City staff are prohibited from using any AI system, service, or tool that has not been explicitly authorized in writing by the Information Technology Director.
This includes free, public, or consumer versions of AI tools such as ChatGPT, Gemini, or Copilot, even when accessed with a personal account. These platforms are not secure for government use and often collect, analyze, and sell user data to third parties.
The City will maintain a secure, enterprise-grade AI environment—TBD—as the sole approved general-purpose AI tool for City business. No other general-purpose AI platform may be used to generate, review, or analyze City data.
This requirement applies equally to free or publicly available AI tools that:
Do not require authentication or allow anonymous use;
Allow login using personal accounts; or
Are accessed through external websites or mobile applications not reviewed by the IT Department.
Staff should also remain aware that some approved or legacy applications may contain hidden or newly integrated AI components. Any new functionality labeled “intelligent,” “smart,” or “predictive” must be treated as AI and reported to IT for review before activation or use.
AI Tool Review Checklist and Product Selection
The IT Department will use a standardized AI Evaluation Checklist when reviewing any proposed AI system or product. This review process encompasses both tool authorization and product selection to ensure that the technology aligns with City standards and business needs.
The requesting department must provide to the IT Department:
A clear written statement describing the business objective the department seeks to accomplish using AI; An explanation of why AI is necessary or beneficial for achieving that goal; and A list of alternative products or processes considered prior to requesting approval.
The IT Department’s evaluation will consider, at minimum:
The type of data to be stored, transmitted, or processed.
Whether data includes CJI, PII, HIPAA-protected, or confidential information.
The vendor’s cybersecurity and privacy controls, including encryption, authentication, and access management.
The product’s data retention, export, and deletion capabilities.
Transparency and explainability of AI decision processes.
Availability of audit trails, logging, and human oversight.
Alignment with the City’s existing Information Security, Privacy, and Responsible Use policies.
Compliance with CJIS and applicable federal, state, and local laws.
Identification of any embedded or third-party AI services within the product that may process City data.
Procurement and Documentation
All procurement or contract renewals involving AI systems must be coordinated with the IT Department and must include appropriate documentation (for example a vendor AI Fact Sheet or technical summary). Vendors must disclose any AI functionality within their products.
Incident Response and Reporting
Any incident involving an AI system that results in the exposure, corruption, or misuse of City data must be immediately reported to the IT Department and handled under the City’s cybersecurity incident response plan.
Police Department Considerations
The Police Department shall maintain a separate, department-specific AI policy that aligns with this Citywide standard. That policy will include additional provisions for Criminal Justice Information Services (CJIS) compliance, investigative use restrictions, and law enforcement ethics.
Prohibited Uses
AI tools shall not be used for:
Real-time biometric identification or surveillance without prior legal authorization.
Emotion recognition or sentiment scoring of individuals.
Fully automated decisions affecting employment, benefits, or public services without human review.
Social scoring or profiling of residents or employees.
Cognitive or behavioral manipulation of individuals.
Experimental Use and Proof of Concepts
The City encourages departments to explore and experiment with AI technology in a responsible manner that promotes innovation while safeguarding City data.
Departments wishing to conduct AI-related experiments, pilots, or proofs of concept (POCs) must obtain prior written approval from the Information Technology Director.
Experiments and POCs must only use information that is publicly available or that the City would otherwise release under the California Public Records Act (CPRA).
If a department proposes to test AI technology using non-public, sensitive, or confidential data, a formal written contract or agreement must be established to ensure data protection, security, and compliance with applicable laws.
IT reserves the right to halt any experimental AI use that poses a security or compliance risk.
GOVERNANCE AND RESPONSIBILITIES
Information Technology Director
Serves as the City’s AI Policy Authority.
Approves or denies AI tool usage requests.
Maintains the AI Evaluation Checklist and authorized tool inventory.
Coordinates reviews with the City Manager, Legal, and Department Heads as appropriate.
Department Heads
Must ensure all departmental uses of AI are pre-approved by the IT Director.
Must maintain records of staff authorized to use AI tools.
Employees and Contractors
Must comply with this policy and all related IT and security standards.
Must report suspected misuse or unauthorized AI activities to the IT Department immediately.
Must remain conscious of potential AI features in software tools they use daily and seek IT guidance before enabling or relying on them for City business.
Must only use the City-approved enterprise AI platform (TBD) for any general-purpose AI needs.
PUBLIC RECORDS AND DATA PRIVACY
AI-generated content or outputs created in the course of City business are considered public records and must be retained or disclosed in accordance with the California Public Records Act (CPRA) and the City’s record retention schedule.
All AI systems must comply with the City’s Information Security Policy, Privacy Policy, and data classification standards to protect sensitive information.
ENFORCEMENT
Violations of this policy may result in disciplinary action up to and including termination of employment or contract, as well as potential legal or contractual consequences. Departments or vendors found to be in violation may have their AI privileges suspended pending review.
EXCEPTIONS
There will be no exceptions to this policy unless approved by the City Manager.
AUTHORITY
By Authority of the City Manager
Mike Witzanksy
ATTACHMENTS
N/A
2 2
Administrative Policy and Procedures Effective Date
04.05 ARTIFICIAL INTELLIGENCE POLICY12-01-25