BTS-4.04 - Artificial Intelligence Use and Governance

Purpose

This administrative rule establishes requirements for the acquisition, development, and deployment of artificial intelligence (AI) systems and services by City bureaus and service areas. These requirements ensure the responsible, ethical, consistent, and secure use of AI technologies in alignment with:

• The City of Portland's Core Values; and
• The City's existing administrative rules regarding information security and acceptable use of technology.

The key objectives of this Rule are to:

• Provide clear, practical guidance which supports decision-making for City-authorized users who may be purchasing, configuring, developing, operating, using, or maintaining the City's AI systems or who use AI systems to provide services to the City.
• Define roles and responsibilities related to the oversight and responsible use of City AI systems.
• Inform all City-authorized users that, when using AI-enabled systems, they must adhere to City's AI Usage Guidelines for appropriate use of AI systems.
• Align the oversight of AI system security with existing Information Security and privacy requirements in the related BTS Information Security Administrative Rule.
• Align the acceptable use of AI systems with existing related HR administrative rules as referenced in Guidance for this rule.
• Establish and maintain processes to assess and manage risks and benefits presented by the implementations of AI systems in the City.
• Promote transparency by communicating the purpose and use of AI systems to staff and the public, including through inventories or summaries of approved uses, consistent with City privacy and security requirements.
• Outline prohibited uses of AI systems.
• Ensure compliance with public records inspection and retention laws

The City Code authorizes the Bureau of Technology Services (BTS) Director position held by the Chief Information Officer to manage and establish this citywide policy and standards. BTS is responsible for ensuring compliance with this Administrative Rule and for making decisions regarding risk assessments, appropriate use, vendor requirements, and operational oversight of AI products and services within the City.

Key Definitions and Terminology

Artificial Intelligence (AI): Machine-based systems that, based on human-defined objectives or parameters, can make predictions, generate recommendations or decisions, retrieve, synthesize, and analyze data, and perform other tasks that influence real or virtual environments. AI systems use human and machine generated inputs to interpret environments, transform those interpretations into models, and produce outputs (such as options for information or action) through automated inference.

Algorithm: A defined set of instructions or logical steps used by a computer program (including AI agents) to transform inputs into outputs.

AI systems: Any software, hardware, service, or process that uses algorithms and data to automatically generate outputs, including predictions, recommendations, or decisions, that augment or replace human judgment. This includes systems used to automate processes, analyze large data sets, or otherwise perform tasks traditionally requiring human intelligence.

City-authorized users: People including full-time and part-time employees, contractors, vendors, volunteers, interns, consultants, partners, and other authorized parties. 

Generative AI (GenAI): A sub-class of AI systems that use machine learning models (including large language models, deep learning, and related algorithms) to generate new content. This includes, but is not limited to, text, images, video, audio, code, and other media produced in response to input data or "prompts." Generative AI may also transform inputs into different formats, such as converting text into computer code or creating graphics, images, or video from text prompts.

Eligibility or Applicability

This Rule applies to:

All AI systems and services deployed by the City or operated on the City's behalf that process City data, directly support City operations, or interact with City staff or the public. It does not extend to incidental or internal vendor or contractor uses of AI unrelated to City work (e.g., a vendor's internal HR system, spam filtering, or productivity tools). This exclusion for incidental or internal vendor or contractor use does not apply when a vendor's AI system processes, stores, or analyzes City data for any purpose beyond routine IT operations such as system maintenance, security monitoring, or spam filtering.

All City-authorized users (including full-time and part-time employees, contractors, vendors, volunteers, interns, consultants, partners, and other authorized parties) who may be purchasing, configuring, developing, operating, using, or maintaining the City's AI systems, or who use AI systems as part of the services they deliver to the City.

Vendors who access or process City information while providing goods or services. Vendor use of City data with AI technologies is limited to the purposes expressly authorized in their contract with the City and must comply with all applicable contractual, cybersecurity, and data protection requirements. City information may not be used for training, testing, or improving vendor AI models unless explicitly permitted in writing by the City.

Roles, Responsibility, Process and Procedures

Roles and Responsibilities

The Chief Information Officer (CIO) is responsible for managing City technology resources, policies, projects, and services. These responsibilities include AI systems and services. The CIO coordinates these across City bureaus and service areas. The CIO and BTS will own and maintain this policy and notify City bureaus and service areas when updates are released.

The Chief Information Security Officer (CISO) ensures AI systems are used in accordance with BTS Administrative Rule and all applicable compliance regulations. The CISO oversees enterprise cybersecurity infrastructure and cybersecurity operations, and updates security policies, procedures, standards, guidelines, and incident response measures as needed.

The Chief Procurement Officer (CPO) oversees the procurement of AI systems in alignment with existing IT procurement and governance processes, administrative rules, and public procurement laws. The CPO, in collaboration with the City Attorney, is responsible for requiring vendors to comply with applicable City policies and standards through contractual agreements.

The City Administrator, or designee, may, at their discretion, inspect the usage of AI systems and require a bureau or service area to alter or cease its usage of AI systems, or the usage of AI systems by a partner on behalf of the City.

The Bureau of Technology Services (BTS) will evaluate AI products and their alignment with City IT strategy, risk assessments, and procurement procedures. BTS will provide ongoing oversight of AI services and products in the City. 

Identifying Artificial Intelligence

City employees and other authorized users are required to consider whether a proposed product or service includes AI functionality when making or evaluating technology use or purchase proposals. To assist in this evaluation, the following questions serve as an initial screening:

• Does the technology use data to provide predictions, recommendations, insights, or decisions?
• Does the technology generate language, graphics, data, or computer code based on human inputs or "prompts"?
• Does the technology augment or replace human decision-making?
• Does the vendor offering the technology use words such as "personalized," "tailored," or "adaptive" in its marketing?

A "yes" to any of these questions may indicate that the technology is an AI system and may therefore fall within the scope of this rule. 

When uncertain, staff should consult BTS, which will make the final determination. If there are questions or disagreements about whether a product or service qualifies as an AI system, BTS will make the final determination.

Procurement, Configuration, Operation and Use  

Procurement of AI Products and Services

The requestor, typically a bureau or service area IT Manager or equivalent role, must submit a business case to BTS for an initial risk assessment prior to initiating procurement of an AI system. The risk assessment will evaluate the potential impacts and risks of the proposed implementation.

1. The CPO and CISO are responsible for developing and maintaining the City's AI System Procurement Requirements and for ensuring that contractors comply with these requirements.
2. The CPO will require vendors to complete the City's hosted service questionnaire before finalizing an AI-related procurement. The questionnaire will be updated to include AI-specific requirements and disclosures, including whether City data will be used for model training, fine-tuning, evaluation or improvement. Vendors must provide technical documentation describing data handling, model behavior, and any adaptive or learning components of the system. The CPO will collect and maintain this documentation as part of the procurement and contracting record. For AI systems developed by a bureau or project team, equivalent disclosures and documentation must be provided.
3. Vendor use of City data for training, testing, or improving AI models is prohibited unless explicitly authorized in writing by the City and governed by applicable contractual, cybersecurity, and data protection requirements. Contracts must include audit or verification rights, proportional to risk, that allow the City to confirm vendor compliance with agreed-upon data use, security, and AI-specific requirements.
4. When bureaus become aware of AI being added to an existing City system, the responsible bureau must notify BTS. BTS, in consultation with CPO and the CISO as needed, will review the new features and may require updated questionnaires, disclosures, documentation or other actions. BTS will apply the same risk model used for new AI systems and may require mitigations, impose conditions, or prohibit use if risks cannot be reduced to acceptable levels.

Configuration, Operation, and Use

City-authorized users must abide by this Administrative Rule in the implementation and use of AI systems.

1. City-authorized users must comply with the City's Human Resources Administrative Rule for Information Technologies.
2. City-authorized users must follow the City's AI Usage Guidelines when using AI systems to generate content for City or public use, including requirements for review, validation and disclosure of AI involvement.
3. All implementations and use of AI systems must comply with City Information Security rules as specified in BTS Information Security Administrative Rule.
4. All content and services that use AI systems to generate their outputs must provide language access consistent with the City's Language Access Policy referenced in Guidance for this Rule and compliance with Title VI of the Civil Rights Act of 1964.
5. AI systems that interact with the public or influence public-facing services must clearly communicate when AI is used, consistent with the transparency expectations outlined in the City's AI Usage Guidelines and applicable risk-based review requirements.
6. Use, configuration, and operational safeguards must reflect the system's risk level under the City's AI Risk Model, including any additional oversight, controls, or disclosures required for higher-risk uses.

Prohibited Uses

AI systems, tools, and services provided or authorized by the City of Portland must not be used for any criminal, malicious, discriminatory, or otherwise unauthorized purpose. Exceptions must be specifically approved by the City Administrator, or designee,  and no exception may authorize conduct that is unlawful, unethical, or contrary to City policy.

Examples of prohibited uses include, but are not limited to:

• Illegal or malicious activities, including fraud, cyberattacks, or other unlawful conduct.
• Circumventing security, privacy, or intellectual property protections.
• Harassment, surveillance, or profiling outside of lawful and approved purposes (e.g., real-time or covert biometric identification in public spaces, such as facial or gait recognition).
• Automated decision-making without an appropriate level of human review, proportionate to the risk, when outcomes could significantly affect an individual's health, safety, rights, or financial well-being (e.g., decisions about an individual's employment, or specific law enforcement actions). Automated tools may assist with efficiency, but final determinations in these areas require human review.
• Manipulating or exploiting individuals or groups, including through subliminal, coercive, or deceptive techniques (e.g., emotion recognition or behavior-shaping systems).
• Assigning social scores or rankings to individuals based on personal characteristics, socioeconomic status, or behaviors. This prohibition does not apply to the City's use of aggregated or de-identified data (such as census or household-level data) for legitimate statistical analysis, planning, or service delivery.
• Producing or distributing harmful, misleading, or deceptive content in the name of the City or while using City resources.

Principles and Risk

Principles of AI Use

These principles describe the City's values regarding how AI systems are purchased, configured, developed, operated, used and maintained and are further defined under the Guidance for this Rule.

• Human-Centered Design and Use,
• Security and Safety,
• Privacy,
• Transparency,
• Equity,
• Accountability,
• Effectiveness, and
• Workforce Empowerment,

Risk Management

AI implementations pose unique risks in addition to those inherent in all information technology. Therefore, it is important to have a risk assessment and management model that evaluates risks based on the specific use case.

BTS will use a risk-based approach to conduct an initial AI risk assessment. This AI Risk Model assessment is referenced in the Guidance for this Rule and is further detailed in the City's AI Usage Guidelines. It will determine the extent of controls, compliance criteria, and oversight required for a particular AI product, service, or use case. BTS will support this assessment by coordinating privacy, equity, and surveillance reviews as applicable and by applying the governance processes established under the City's AI governance program.

The initial AI risk assessment does not replace or take precedence over other required risk assessments for new technologies. These include, but are not limited to, information security, privacy, financial, and legal risk assessments. Such assessments will be performed by their respective responsible parties in partnership with BTS and will be integrated into the City's broader AI governance workflow.

Resources        

Refer to BTS 4.04 Guidance for additional details, references to related Administrative Rules, contact information and other resources including the City's AI Usage Guidelines.