North Carolina State Government Responsible Use of Artificial Intelligence Framework

• Authority: North Carolina
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2024-08-21

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Compromise of privacy
• AI system security vulnerabilities
• Loss of human agency and autonomy
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unequal performance across groups
• Overreliance and unsafe use

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on privacy and security (2.1, 2.2), discrimination and fairness (1.1, 1.3), transparency (7.4), system safety and robustness (7.3), governance (6.5), and human oversight (5.2). Coverage is concentrated in privacy, security, fairness, and AI system reliability domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Management, Administrative & Support Services
• Educational Services
• Health Care & Social Assistance

All other sectors had no coverage in this document.

Sectors Summary

This framework governs AI use across all North Carolina state government agencies and operations, which spans multiple sectors including public administration, healthcare and social services, educational services, and other government functions. The document does not regulate private sector entities but rather internal state government AI applications.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding regulatory framework with mandatory requirements for state agencies, using enforcement language ('must', 'shall', 'required') and establishing specific compliance obligations including AI inventories and risk assessments.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is issued under the authority of the State Chief Information Officer pursuant to N.C.G.S. § 143B-1376, which grants responsibility for security and privacy of all state information technology systems.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Summary: The framework explicitly applies to all State Agencies and covers AI designed, developed, acquired, or used by state agencies, including third parties working on behalf of agencies.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The State CIO has statutory authority for security and privacy oversight, with ESRMO and OPDP providing guidance on risk assessments and compliance monitoring through inventory reporting.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: Monitoring occurs at multiple levels: agencies must monitor and audit their own AI systems, report inventories to NCDIT, and undergo ongoing risk assessment with guidance from ESRMO and OPDP.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all AI lifecycle stages from planning through ongoing monitoring. It explicitly addresses design principles, data governance, model development and acquisition, pre-deployment testing and validation, deployment procedures, and continuous monitoring and auditing requirements.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document uses the broad term 'AI' and 'artificial intelligence' throughout without distinguishing between specific AI types such as foundation models, generative AI, or general purpose AI. It defines AI as 'an engineered system where machines learn from experience' and 'automated decision-making.' There is no mention of compute thresholds, frontier AI, or open-weight models. The framework applies to 'all AI' used by state agencies.