State of North Dakota Artificial Intelligence Policy

• Authority: North Dakota
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2024-02-08

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• AI system security vulnerabilities
• False or misleading information
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Overreliance and unsafe use

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on privacy compromise (2.1), AI system security (2.2), false information (3.1), lack of robustness (7.3), and lack of transparency (7.4). Coverage is concentrated in privacy/security, misinformation risks, and AI system safety domains. The policy addresses operational risks and governance but does not extensively cover malicious actor scenarios, socioeconomic impacts, or advanced AI safety concerns.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Educational Services

All other sectors had no coverage in this document.

Sectors Summary

This is an internal government policy that primarily governs AI use within the Public Administration sector. It applies to North Dakota executive branch state agencies and the University Systems Office, covering government operations and public services. The policy does not regulate private sector activities or other economic sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding internal government policy with mandatory compliance requirements, enforcement mechanisms, and clear accountability structures for North Dakota executive branch agencies.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: North Dakota Chief Information Officer (CIO); North Dakota Chief Information Security Officer (CISO); North Dakota Information Technology (NDIT); Governance Review Team
• Summary: The document is proposed and created by North Dakota state government IT leadership. The CIO directs IT policy creation under North Dakota Century Code Chapter 54-59-09, and the CISO directs security and privacy policy creation. The Governance Review Team is responsible for policy review and updates.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer
• Entities: North Dakota executive branch state agencies; University Systems Office; Entity leadership; Business Owners; Data Owners; Data Stewards; Team members; Users
• Summary: The policy applies to all North Dakota executive branch state agencies including the University Systems Office. It targets various roles within these entities including business owners, data owners, data stewards, team members, and users who deploy or use AI technologies in government operations.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: North Dakota Information Technology (NDIT); NDIT Security Governance, Risk, and Compliance team; Entity leadership
• Summary: NDIT and specifically its Security Governance, Risk, and Compliance team are responsible for enforcement. They receive non-compliance reports and address them with Entity leadership. NDIT also manages the exception process and maintains oversight of AI technology approvals.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: North Dakota Information Technology (NDIT); NDIT Security Governance, Risk, and Compliance team; Governance Review Team; Business Owners; Data Owners
• Summary: NDIT monitors compliance through its Security Governance, Risk, and Compliance team and maintains an AI technology inventory. The Governance Review Team conducts routine reviews and updates. Business and data owners are responsible for monitoring their specific AI implementations and conducting regular assessments.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple AI lifecycle stages with primary focus on Deploy and Operate and Monitor stages. It addresses planning through risk assessment requirements, verification through validation and testing requirements, deployment through approval processes, and ongoing monitoring through regular assessments. The Build and Use Model stage receives minimal coverage, while data collection is not substantially addressed.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Generative AI

Technical Scope Summary

The document explicitly mentions AI, Machine Learning, Large Language Models, Deep Learning, and Generative AI with definitions provided. It does not mention frontier AI, general purpose AI, task-specific AI, foundation models, predictive AI, open-weight models, or compute thresholds. The focus is on generative AI tools and general AI/ML technologies used in government operations.