Policy Date: 10/2/2026

OVERVIEW

The adoption of Artificial Intelligence (AI) presents new challenges, requiring us to balance its potential benefits with the need to minimize potential harm. By addressing these challenges, the County of San Mateo is committed to ethically and responsibly utilizing AI to enhance operational efficiency, broaden service accessibility, and better support its community. 

For the purposes of this policy, AI refers to the ability of computer systems or machines to perform tasks that typically require human intelligence. AI can range from basic automation (performing simple tasks) to advanced systems capable of reasoning, judgment, and learning. 

The term "AI Systems" is intended to be inclusive, recognizing the diverse and evolving nature of AI technologies. AI Systems encompass any software, platforms, or technological tools that employ artificial intelligence techniques to process information, make decisions, or perform tasks that typically require human intelligence.

The term “Generative AI” refers to a specialized category within AI technologies, characterized by its ability to create new content, ideas, or data outputs that extend beyond simple analysis or processing. This includes the capability to create text, images, sounds, or other data in a way that mimics human creativity and intelligence. The scope of Generative AI is broad and continuously evolving, reflecting its growing role in various applications across different sectors which shall be outlined throughout this policy.

POLICY PURPOSE

The primary goal of this policy is to ensure the responsible and ethical utilization of AI at the County of San Mateo.

This policy establishes a comprehensive, yet flexible, governance structure for AI systems used by, or on behalf of, the County of San Mateo. This policy enables the County to use AI systems to benefit the community while emphasizing the responsibility of County Departments to verify data accuracy throughout the lifecycle of AI use, safeguarding against potential harms, and upholding data integrity. The policy further emphasizes the onus of County Departments to acknowledge that the quality and accuracy of the data flowing and generated within the County, ensures quality and accuracy of the services we provide members of our community.

SCOPE

The policy applies to all County Departments and all vendors, contractors, subcontractors, volunteers, temporary staff, consultants, collectively known as Workforce Members. This policy also applies to any other parties engaged in providing services or working on the County's computer and network systems, or handling information pertaining to the County. 

The policy applies to all computer equipment and related devices owned or operated by the County of San Mateo or any device logically or physically connected to the County computing environment. It includes all software, hardware, and any along with every integral part of a computing device that contributes to its functioning. These constituent components may consist of, but are not limited to, processors, memory units, storage devices, network interfaces, cloud applications, and any other internal or external parts that are essential for the operation of the computer systems within the entirety of the County’s computing environment. 

As AI usage continues to advance and evolve, policymakers globally are focused on their safe, ethical, and beneficial use. Department Heads or their designee will conduct an annual review of this policy, suggesting any necessary amendments to the Board of Directors. Department Heads or their designee shall also be tasked with documenting and annually reporting any exceptions to this policy to the Board of Directors.

POLICY

The principles listed below provide a framework of requirements for the procurement, configuration, deployment, and usage of any AI solution by County Departments. Runbooks developed within each Department should include the principles listed below and serve as a safeguard against misuse of AI in and by the County.

Guiding Principles and Ethical Considerations

The use of AI should be guided by ethical principles, including fairness, transparency, and accountability. AI must be used in a way that respects individual rights, avoids harm to society, and advances the common good.

Human-centric: AI should be used to enhance human capabilities and promote human well-being. It should respect human autonomy, dignity, and privacy, and be accessible to all.

Equity: AI should be used in a way that is fair and unbiased. It should avoid discrimination and promote diversity, and decisions including but not limited to personnel, permitting, etc., should be based on objective criteria and not influenced by personal biases or prejudices. 

Informed Consent: Members of the public should be informed when they are interacting with an AI and have an “opt out” alternative to using AI available.

Accuracy: AI can generate inaccurate and false information and it is the responsibility of all County Departments to work with their vendors during the Technology Security Assessment (TSA) B-1 review to ensure data accuracy. Departments should annually review their internally developed runbooks, verify and adjust AI-generated content to ensure ongoing quality, accuracy, and compliance with County guidelines and policies.

Education and awareness: There should be education and awareness-raising initiatives for Workforce Members to promote understanding and awareness of the use of AI, its potential benefits and risks, and the ethical principles and requirements that guide its development and use.

Data Privacy

Do not use Personally Identifiable Information (PII), Protected Health Information (PHI), or any sensitive data in Generative AI prompts on AI Systems not under the County’s control. Generative AI prompts, data inputs, and outputs may become subject to the Freedom of Information Act and Public Records Act.

Generative AI output not triggered by prompts but generated by private Large Language Model (LLM) solutions integrated into secure/HIPAA-compliant applications, trained with private/HIPAA data, may be subject to different privacy and security considerations. Users of Generative AI must adhere to all data privacy and security standards such as the Health Insurance Portability and Accountability Act (HIPAA), Criminal Justice Information Systems (CJIS), Internal Revenue Service (IRS), and the California Consumer Privacy Act (CCPA) to protect PII, PHI, or any sensitive data.

Data used in AI systems should be of high quality, relevant, and accurate, and should be processed securely and transparently. All personal data must be collected, processed, accessed, and stored in compliance with relevant policies, laws, and regulations. The privacy and security of personal data shall be prioritized by the Department as required by the TSA B-1 review process to maintain the trust of County stakeholders and the public.
 

Algorithmic Bias

AI can create biased outputs, including discrimination based on categories recognized by federal and state courts as warranting absolute protection from discrimination, as well as other biases that may arise from the algorithm’s design or data sources, which could impact the fairness, efficacy, and inclusivity of decision-making processes.

Asserted effort shall be utilized to prevent and mitigate bias in the use of AI, including ensuring diversity in data sets and conducting ongoing testing and evaluation of algorithms to identify and address any potential biases. Develop AI usage practices that minimize bias and regularly review outputs to ensure fairness and accuracy.
 

Decision Making

Be conscientious about how AI is used to inform decision making processes. Department staff should not solely use Generative AI to make decisions and must follow the developed safeguards and standards in the Department Runbook that also provides the opportunity for meaningful human intervention.
 

Transparency

AI data sources must be clearly specified and readily accessible for inspection by County officials. Additionally, algorithms and decision-making processes must be explainable without compromising vendor trade secrets. This foundational transparency safeguards that AI systems used by the County of San Mateo are not only subject to review but are also understandable and verifiable.

AI systems must be transparent, explainable, and verifiable, enabling stakeholders and the general public to understand their functionality and decision-making processes. Data, algorithms, and decision-making processes within these systems, including explanations on the use of any personal data, will be clearly documented to ensure clarity and understanding for all stakeholders. Where AI outputs cannot be easily verified, they should be monitored on a regular basis until deemed sufficiently reliable in the judgement of the Department Head or their designee.

The use of AI should be explainable to those who use and are affected by their use. Commonly understood explanations of how AI features work will be maintained and available to convey a concrete sense of how or why a particular result has been arrived at based on inputs.
 

Accountability

Clear lines of accountability shall be outlined for the use of AI, ensuring that individuals and teams responsible for purchasing, deploying, configuring and/or using AI are held accountable for their decisions and actions, including responsibility for any harm caused by their use of AI.

Robustness, Security, and Safety of AI Systems

AI Systems must be designed and operated in a way that allows for human oversight and intervention, especially in high-risk applications. Human oversight is required for all employment decisions.

AI Systems should be reliable, safe, and secure throughout the entire lifecycle. AI Systems should be resilient to errors and adversarial attacks, and able to operate in a wide range of situations and environments.

When acquiring and deploying AI Systems, County Departments will identify potential risks and negative impacts of using AI and take measures to mitigate them. AI can be used maliciously to distribute malware, spread phishing emails, launch distributed denial of service (DDoS) attacks, and other types of damaging attacks. As AI becomes more advanced, the potential for cyber-attacks using AI will increase.

County Departments will regularly monitor and evaluate approved AI products to ensure they are meeting security and risk management criteria.
 

Technical standards

AI should be operated in compliance with County, State, and Federal technical standards that ensure the principles of trustworthiness, transparency, and accountability.

When acquiring and deploying “off the shelf” applications with embedded AI capabilities, confirm the AI functions in compliance with our AI policy.

Governance

All relevant parties and stakeholders, including policymakers, researchers, and industry leaders, will work collaboratively to develop governance structures that ensure responsible use of AI. Transparency in decision-making processes and engagement in ongoing dialogue with stakeholders shall be continuous to ensure that this AI policy remains responsive to emerging challenges and opportunities.

ROLES AND RESPONSIBILITIES

Anyone who utilizes AI systems or Generative AI for County business, or supervises someone who does, is responsible for knowing the general intent of this policy, complying with this policy and other applicable County policies, and exercising reasonable and prudent judgment related to AI usage for County business.

County Departments

In alignment with Resolution 080119 adopted by the Board of Supervisors on January 23, 2024 and Resolution 081081 adopted by the Board of Supervisors on April 22, 2025, County Departments are directed to develop a thoughtful and inclusive approach to AI adoption, ensuring that employees can adapt to new roles created by these technologies and ultimately fostering a balanced integration that maximizes the benefits of AI while preserving job opportunities. County Departments shall consider options for investment in comprehensive on the job training and skill development to equip County employees with the necessary skills to effectively work alongside AI technologies. Additionally, Departments shall pursue mechanisms for job reassignment and redeployment, ensuring that employees affected by automation have opportunities to transition to other roles or departments within the County, consistent with applicable collective bargaining agreements, Civil Service Rules, and County policies.

It is the responsibility of all County Departments to ensure that all relevant parties, including stakeholders, vendors, and Workforce Members are familiar with this policy. Departments may provide additional rules on the usage of AI Systems and Generative AI for their stakeholders, vendors, and Workforce Members.

Prior to engaging with vendors, Departments must conduct an AI review to assess the potential risk of AI systems and ensure vendors ’AI technologies and practices comply with County AI policy and relevant legal and regulatory requirements. This includes evaluating vendors' ethical standards, data handling procedures, AI policy, and overall approach to AI. Departments must also submit a completed AI Systems, Generative AI solutions, and Systems Leveraging AI Questionnaire to the Board of Supervisors with any AI contracts or projects requiring Board of Supervisor approval.

Workforce Members

Workforce Members are expected to exercise common sense and good judgement. Each Workforce Member is responsible for using AI in a manner that ensures the security of sensitive information and aligns with County policies.

Use of any AI technologies within and for the County constitutes consent to this policy and it is the responsibility of Workforce Member to conduct their activities accordingly.

Workforce Members are responsible for exercising reasonable care when reviewing AI generated content used within the scope of employment. When using AI systems approved or provided by the County, Workforce Members are responsible for using those systems consistent with their intended use, applicable County policies, and County-provided guidance and training.

Workforce Members using AI are encouraged to complete training on effective and appropriate AI usage for their work. When County provided AI training becomes available, Workforce Members should participate to ensure appropriate use of AI, data handling, and adherence to County policies on a continuing basis. Workforce Members are encouraged to participate in AI workgroups and communities of practice. The County will provide transition support for workforce members who will be using AI for their work.

If Workforce Members come across any potential issues or concerns related to the use of Generative AI or AI Systems, these concerns should be reported to Department Heads and/or their designee. If Workforce Members want to opt out of using an AI system or program, their concerns should be reported to their Department Head and/or designee. The Department Head will consult with the Technology Services Department to determine what alternatives are available.

EXCEPTIONS

An 'exception' in this context refers to any approved deviation from the established AI policy guidelines. To request an exception, a detailed exception request must be submitted by the Department Head to the County Executive’s Office for approval. This written request should clearly outline:

• The Specific Aspect of the Policy from Which an Exception is Sought: Clearly describe which part of the AI policy the exception pertains to and why an exception is necessary or beneficial.
• Rationale for the Exception: Provide a compelling reason or justification for why adhering to the standard policy is impractical or detrimental in the specific case.
• Risk Mitigation Measures: Detail the strategies or measures that will be put in place to mitigate any risks associated with the exception. This should include how potential negative outcomes will be managed and minimized.

The Department Head requesting the exception will assume full responsibility for managing all risks and potential negative outcomes that arise from the approved exception. This includes ensuring that any deviations from the policy do not compromise the overall integrity, security, and ethical use of AI technologies within the County.

OTHER COUNTY POLICIES

The County has other policies, including, but not limited to, the IT Security Policy and Privacy Policy, that may address areas associated with the use of AI. Departments may also have internal policies relevant to the subject matter associated with the specific work of the department. These policies are cumulative and in the event of conflict, the policies providing the County with the greatest level of security apply. Additionally, County policies concerning employee conduct such as the Code of Ethical Conduct apply to the use of AI.

ENFORCEMENT

All employees and agents of the County of San Mateo, whether permanent or temporary, interns, volunteers, contractors, consultants, vendors, and other third parties operating AI systems on behalf of the County of San Mateo are required to abide by this Policy.

Report any potential issues, concerns, or violations related to the use of AI to Department Heads or their designee, Human Resources, or through other applicable County reporting processes. Employees who in good faith report concerns regarding the use of AI will not be subject to retaliation for making such a report. Policy violations will be investigated and may result in disciplinary action up to and including dismissal from County employment, or cancellation of contractual relationship. For violations of patient confidentiality, the procedures of the Patient Confidentiality Sanctions Policy as regulated by HIPAA apply.

Revision History