City of St. Louis Information Technology Policy #2023-001 Guidance on Generative AI

• Authority: St. Louis, MO
• Parent authority: Local governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2023-10-09

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unfair discrimination and misrepresentation
• Compromise of privacy
• AI system security vulnerabilities
• False or misleading information
• Cyberattacks, weapon development or use
• Overreliance and unsafe use
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of approximately 5-6 subdomains, with primary focus on privacy compromise (2.1), security vulnerabilities (2.2), false information (3.1), fraud/manipulation (4.3), and lack of robustness (7.3). Coverage is concentrated in privacy, security, and misinformation domains with basic guidance rather than comprehensive governance measures.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs AI use within Public Administration (excluding National Security), as it is an internal policy for City of St. Louis employees. The policy applies across all city government operations and departments where employees might use generative AI tools.

Legislative Status

Other

Legislative Status Summary

This is an internal municipal government policy document providing guidance to City employees on generative AI use. It establishes guidelines and requirements for City employees but lacks formal enforcement mechanisms, penalties, or legal sanctions typical of hard law.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: ITSA (Information Technology Services Agency); Mayor's Office
• Summary: The document is issued by the City of St. Louis government, with ITSA and the Mayor's Office identified as the entities developing and evaluating the policy.

Target

• Entity Types: AI_User
• Entities: City of St. Louis employees
• Summary: The policy explicitly targets City employees who may use generative AI tools as part of their job responsibilities.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: ITSA (Information Technology Services Agency)
• Summary: ITSA is designated as the authority responsible for vetting AI technology purchases and enforcing compliance with IT policies.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: ITSA (Information Technology Services Agency); Mayor's Office
• Summary: ITSA and the Mayor's Office are identified as the entities responsible for ongoing evaluation and policy development regarding AI use.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor stages of the AI lifecycle, focusing on employee use of existing generative AI tools and ongoing evaluation. It does not cover planning, data collection, model building, or formal verification stages.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• Generative AI

Technical Scope Summary

The document explicitly mentions generative AI tools and AI-related technology/software. It specifically names ChatGPT, BingAI, and Google Bard as examples. It does not define or distinguish between AI models, AI systems, or other technical categories, nor does it mention compute thresholds or open-weight models.