Appendix 1 - Artificial Intelligence Policy
Argyll and Bute Council · 8 May 2025
Back to Policy and Resources Committee — 8 May 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Artificial Intelligence Policy March 2025
Page 2
Contents 1. Background ......................................................................................................... 4 2. Purpose ............................................................................................................... 4 3. Scope .................................................................................................................. 4 4. Governance ......................................................................................................... 5 Vendors ............................................................................................................... 5 Copyright and Licensing ...................................................................................... 5 Ethical Use .......................................................................................................... 6 Disclosure ........................................................................................................... 7 Integration with other tools .................................................................................. 7 5. Development, Deployment and Use of AI ............................................................ 7 Risk Assessment ................................................................................................. 7 Legal compliance ................................................................................................ 8 Bias and discrimination ....................................................................................... 8 Security ............................................................................................................... 8 Data sovereignty and protection .......................................................................... 8 6. Compliance .......................................................................................................... 9 7. Review ................................................................................................................. 9 8. Acknowledgement ............................................................................................... 9
Page 3
Version Control Version Creator Changes Date 0.1 Stuart McGeachy Initial Draft 31/07/2024 0.2 Stuart McGeachy Revisions based on ITMT comments. 21/02/2025 0.3 Stuart McGeachy Revisions to Scope and Disclosure sections. 24/03/2025 0.4 Stuart McGeachy Revisions to Governance and Disclosure sections based on Governance and ITMT comments. 31/03/2025 0.5 Stuart McGeachy Updated document font to Arial and left aligned. 02/04/2025 0.6 Gerry Wilson Expanded purpose following SMT comments 17/04/2025
Page 4
1. Background 1.1. Artificial Intelligence (AI) refers to the development of computer systems capable of performing tasks that typically require human intelligence, such as learning, problem solving and decision making. 1.2. AI technologies are rapidly advancing and have the potential to support the Council by enhancing efficiency, improving operations and assisting with decision-making for some of its key services. Although the adoption of AI presents significant opportunities to enhance efficiencies in the Council, there are significant risks that must be carefully considered prior to adopting AI within Council operations, which will be outlined in this policy. 2. Purpose 2.1 The purpose of this policy document is to establish guidelines for Argyll and Bute Council in the use of Artificial Intelligence (AI) technologies, including, but not limited to machine learning models, natural language processing systems and Generative Artificial Intelligence Large Language Models (GenAI) such as ChatGPT, Google Gemini, Microsoft Copilot. 2.2 GenAI is one of the most prevalent AI technologies utilised across industries and applications, allowing users to input prompts to produce various types of content such as text, images, audio, video, software code and other media. The GenAI models can learn and evolve as it trains on data structure and patterns to produce new data, which is based on the input from the user. 2.3 We need this policy now because AI is much more available than it has been before. It is now freely available in our search engines and these versions operate in such a way that anything we submit for analysis becomes freely available to other users around the world. Safer versions of AI tools will be deployed on the Council’s network in the near future. 2.4 This policy is designed to ensure that the use of AI is ethical, complies with all applicable laws, regulations and Council policies, and complements the Council’s existing information and security policies including the Councils Acceptable Use Policy (AUP). 2.5 The pace of development and application of AI in this fast-changing environment is such that this policy will be subject to regular review. Any material changes to the policy will be brought back to committee for approval. 3. Scope 3.1 This policy applies to all users of the Council’s data and systems with access to AI, including elected members, as well as any other policies and procedures in support of this policy.
Page 5
3.2 Use of AI must be in a manner that promotes fairness and avoids bias to prevent discrimination and promote equal treatment and be in such a way as to contribute positively to the Council’s goals and values, aligning with the Council’s equality and diversity policies. 3.3 Users may use AI for work-related purposes subject to adherence to this policy. This includes tasks such as generating text or content for reports, emails, presentations, images and customer service communications. 3.4 The policy encourages initiatives to enhance AI literacy and skills among all stakeholders, particularly those involved in developing AI solutions, as well as those using AI technologies in their work. 3.5 Particular attention should be given to Governance, Vendor practices, Copyright, Accuracy, Confidentiality, Disclosure and Integration with other tools, as described in the following sections. 4. Governance 4.1 If there is a business requirement to input personal or confidential information to GenAI technology, users must complete a Data Protection Impact Assessment (DPIA) and facilitate the completion of an ICT Security Assessment for the Councils Security team to assess. 4.2 Personal information may not have been requested in surveys/consultations but may have been provided in free text boxes. All such responses must be reviewed and personal information removed prior to using AI technology. 4.3 An internal register of Council-approved AI solutions will be kept to ensure their usage is transparent within the organisation. All AI solutions must be published on the The Scottish AI Register to comply with the recommendations of the Scottish Government. 4.4 Deployment of AI technologies across the Council must adhere to the following guidance and guidelines NCSC AI and cyber security: what you need to know NCSC Secure AI system development ICO Artificial intelligence Vendors 4.5 Any use of AI technology in pursuit of Council activities should be done with full acknowledgement of the policies, practices, terms and conditions of developers/vendors. All AI purchases must be managed through the Council’s procurement team. Copyright and Licensing
Page 6
4.6 Users must adhere to copyright laws when utilising AI. It is prohibited to use AI to generate content that infringes upon the intellectual property rights of others, including but not limited to copyrighted material. 4.7 In addition, users must ensure they comply with licensing terms of any AI system or tools they utilise. This includes verifying whether the generated content can be used commercially, modified, or distributed, depending on the licensing restrictions of the AI service provider. 4.8 If a user is unsure whether a particular use of AI constitutes copyright or licensing infringement, they should contact the Legal and Regulatory Support before using AI. Accuracy 4.9 All information generated by AI must be reviewed and edited for accuracy prior to use. Users of AI are responsible for reviewing output and are accountable for ensuring the accuracy of AI generated output before use/release. 4.10 If a user has any doubt about the accuracy of information generated by a given AI tool or solution, they should not use that AI tool or solution without applying appropriate correction. Confidentiality 4.11 AI systems must comply with data protection regulations, including GDPR and other applicable laws. 4.12 Confidential and personal information must not be entered into public GenAI tools, applications or web sites (like ChatGPT), as information may enter the public domain. Users must follow all applicable data privacy laws and organisational policies when using AI. 4.13 If a user has any doubt about the confidentiality of information, they must not use that AI tool. Ethical Use 4.14 AI must be used ethically and in compliance with all applicable legislation, regulations and Council policies. 4.15 Users must not use AI to generate content that is discriminatory, offensive, or inappropriate. If there are any doubts about the appropriateness of using AI in a particular situation, users should consult with their supervisor or Information Governance Team. 4.16 Human oversight is essential for the ethical use of AI ensuring that AI systems operate in alignment with societal values and ethical standards.
Page 7
Human review must be conducted on AI outputs for biases, discrimination and accuracy. Disclosure 4.17 Transparency in AI is crucial for ensuring accountability, which includes providing information on how the AI-generated decisions are made. 4.18 The presence and role of any AI systems may be disclosed in our operations to all relevant stakeholders, including employees, customers and partners. This includes information on how AI systems are used, details of the data they process and decision making processes they support. 4.19 Any user content produced via AI must be identified and disclosed as containing AI-generated information. Integration with other tools 4.20 Application Programme Interface (API) and plugin tools enable access to AI and extended functionality for other services to improve automation and productivity outputs. Users should follow OpenAI’s Safety Best Practices: • Adversarial testing • Human in the loop (HITL) • Prompt engineering • “Know your customer” (KYC) • Constrain user input and limit output tokens • Allow users to report issues • Understand and communicate limitations • End-user IDs API and plugin tools must be rigorously tested for: • Moderation – to ensure the model properly handles hate, discriminatory, threatening, etc. inputs appropriately. • Factual responses – provide a ground of truth for the API and review responses accordingly. 5. Development, Deployment and Use of AI Risk Assessment 5.1 Use of AI carry inherent risks. A comprehensive Data Protection Impact Assessment (DPIA) and Security Assessment should be conducted for any project or process where use of AI developed or deployed. The risk assessment should consider potential impacts including legal compliance; bias and discrimination; security (including technical protections and security certifications); and data sovereignty and protection.
Page 8
Legal compliance 5.2 AI systems developed or deployed within the Council must comply with applicable laws and regulations and with Council policies. 5.3 Data entered into an AI system may enter the public domain. This can release non-public information and breach regulatory requirements, customer or vendor contracts, or compromise intellectual property. Any release of private/personal information without the authorisation of the information’s owner could result in a breach of relevant data protection laws. Use of AI to compile content may also infringe on regulations for the protection of intellectual property rights. Users should ensure that their use of any AI complies with all applicable laws and regulations and with Council policies. Bias and discrimination 5.4 AI may make use of and generate biased, discriminatory or offensive content. AI systems developed or deployed by the Council must be regularly tested for bias by the service users who must take corrective actions to ensure fairness. 5.5 Users should use AI responsibly and ethically, in compliance with Council policies and applicable laws and regulations. Security 5.6 AI systems must be secure by design to protect against data breaches, cyber-attacks and any other misuse. Regular security assessments and updates should be conducted to address potential vulnerabilities to ensure security standards align with frameworks such as Public Sector Network (PSN) and Payment Card Industry Data Security Standards (PCI DSS). 5.7 AI may store sensitive data and information, which could be at risk of being breached or hacked. The Council must assess technical protections and security certification of AI before use. 5.8 If a user has any doubt about the security of information input into a specific AI tool/solution, they should not use that specific AI tool/solution. Data sovereignty and protection 5.9 While an AI platform may be hosted internationally, under data sovereignty rules information created or collected in the originating country will remain under jurisdiction of that country’s laws. The reverse also applies. If information is sourced from AI hosted overseas, the laws of the source country regarding its use and access may apply.
Page 9
5.10 AI service providers should be assessed for data sovereignty practice by any organisation wishing to use their AI. 6. Compliance 6.1 Any violations of this policy should be reported to the Council’s Information Governance Team or senior management. Failure to comply with this policy may result in disciplinary action, in accordance with Council’s Human Resources policies and procedures. 7. Review 7.1 This policy will be reviewed annually and updated as necessary to ensure continued compliance with all applicable legislation, regulations and organisational policies. 8. Acknowledgement 8.1 By using AI, users acknowledge that they have read and understood these guidelines, including the risks associated with the use of AI. This policy has been largely based on the guidance prepared by ALGIM (Aotearoa - New Zealand) and Socitm (UK). www.algim.org.nz www.socitm.net