City of San Jose Artificial Intelligence Policy 1.7.12

• Authority: San Jose, CA
• Parent authority: Local governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2024-06-28

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• AI system security vulnerabilities
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• False or misleading information
• Disinformation, surveillance, and influence at scale
• Fraud, scams, and targeted manipulation
• Overreliance and unsafe use
• Loss of human agency and autonomy
• Environmental harm

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on privacy compromise (2.1), AI system security (2.2), unfair discrimination (1.1), governance structures (6.5), lack of robustness (7.3), and lack of transparency (7.4). Coverage is concentrated in privacy/security, discrimination prevention, and AI system safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Finance & Insurance

All other sectors had no coverage in this document.

Sectors Summary

This is an internal municipal government policy that governs AI use within the City of San José's public administration operations. The primary sector governed is Public Administration excluding National Security, as the policy applies to all city departments, employees, contractors, and vendors operating AI systems on behalf of the city government.

Legislative Status

Other

Legislative Status Summary

This is an internal municipal government policy document that establishes governance structures and requirements for AI use within the City of San José. While it contains mandatory language and enforcement mechanisms for city employees and contractors, it functions as an internal administrative policy rather than externally binding legislation.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The policy was established by the City of San José as indicated by the document title and purpose statement. The CIO is responsible for managing the AI Handbook that implements this policy, and the CISO and CDPO are responsible for recommending updates to the policy.

Target

• Entity Types: AI_Deployer, AI_User
• Summary: The policy explicitly applies to all city employees, contractors, consultants, and third parties who purchase, configure, develop, use, or maintain AI systems on behalf of the City. It also applies to all AI systems deployed by the City.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The CIO, CISO, and CDPO have designated enforcement responsibilities including oversight, security practices, policy compliance, and coordinating AI reviews. The Office of Employee Relations receives reports of harmful incidents. Violations may result in disciplinary action up to termination.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The CISO and CDPO are explicitly responsible for ensuring security, resilience, privacy, and policy compliance. The CDPO coordinates AI system reviews. The CIO oversees the AI Handbook and approves sunset procedures. These roles involve ongoing monitoring and assessment of AI systems.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple AI lifecycle stages with primary focus on Plan and Design, Verify and Validate, Deploy, and Operate and Monitor. It establishes governance structures for the entire lifecycle from procurement through sunset procedures, with particular emphasis on risk assessment, validation, deployment controls, and ongoing monitoring.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• Generative AI
• Predictive AI

Technical Scope Summary

The document explicitly defines and covers AI systems and algorithms. It does not specifically mention frontier AI, general purpose AI, task-specific AI, foundation models, generative AI, predictive AI, open-weight models, or compute thresholds. The focus is on AI systems broadly defined as machine-based systems that make predictions, recommendations, or decisions.