Governance, Ethics, and Safe AI Adoption

CAIPM · 20 questions

• A city adopts an AI use policy covering approved tools, allowed data classes, and when human review is required. What governance action is this?
• An AI review board must screen high-risk civic uses before procurement or build work begins. What governance routing practice is this?
• The city keeps a controlled register of AI systems with named owners and risk tiers. What governance inventory practice is this?
• Change control requires re-review when a city chatbot expands from FAQ answers to eligibility advice. What governance trigger is this?
• The city defines how incorrect AI answers are reported, logged, and remediated for resident-facing services. What governance process is this?
• Purchasing adds AI policy questions to every software solicitation checklist before award. What governance practice is this?
• The AI program office sends quarterly metrics on exceptions and overdue AI reviews to the council IT committee. What governance action is this?
• A benefits chatbot is evaluated for different error rates across language groups and ZIP codes before wider release. What ethical practice is this?
• Parks security pauses a facial-analytics pilot after demographic performance gaps appear in vendor tests. What ethical response is this?
• Housing eligibility recommendations from AI must be reviewed by a caseworker before any decision letter is sent. What ethical control is this?
• The 311 web form states clearly that residents are chatting with a city AI assistant, not a human clerk. What ethical practice is this?
• Before deploying inspection-priority AI, the city audits training data for historic under-enforcement in certain districts. What ethical practice is this?
• The city maps fairness, accountability, and transparency principles to named control owners in each department. What governance practice is this?
• Residents can contest an AI-influenced parking citation review through a published appeal path. What ethical safeguard is this?
• Digital services maps each AI use case to applicable privacy, records-retention, and sector rules before go-live. What compliance practice is this?
• A public-health GenAI pilot documents HIPAA-adjacent handling controls even when notes are de-identified. What compliance approach is this?
• Language-access and accessibility laws are written into requirements for a resident-facing permitting chatbot. What compliance practice is this?
• Before selecting a hosted model, the city reviews whether inference and logs stay inside committed data-residency regions. What compliance check is this?
• The AI register package lists purpose, data sources, human oversight, and monitoring for each system before an external audit. What compliance practice is this?
• When AI rules are ambiguous, the city assigns a conservative risk tier and tighter controls until guidance clarifies. What compliance posture is this?