A city information-security office must guide staff using generative tools on permit files. What is the most appropriate first policy action?

Establishing an AI-specific acceptable-use policy that sets standards and guidelines for municipal staff is the correct control when permit staff might paste packages into public chatbots. Written AI AUP defines approved tools, prohibited data classes (e.g., applicant PII, sealed plans), logging expectations, and consequences—integrating generative AI into the city’s enforceable policy set rather than leaving practice to rumor. Clear standards reduce inconsistent desk-level decisions that create breach and public-records exposure.

Allowing unrestricted pasting of permit packages into any public chatbot fails because those packages often contain personal and sensitive business information that leaves municipal custody under consumer terms. Relying solely on verbal hallway guidance with no written AI policy fails conceptually: verbal advice is uneven, untestable in audits, and evaporates with staff turnover. Deleting all existing security policies and replacing them with vendor terms of service fails because vendor ToS protect the vendor, not the city’s regulatory duties, and discarding baseline security policy creates wider control gaps beyond AI.

Exam caveat: an AI AUP should extend—not conflict with—existing acceptable use, records, and privacy policies; fragmentation into contradictory documents is itself a governance failure.

Operational check: publish AI acceptable-use rules naming prohibited permit-data uses, list approved enterprise AI services, train permitting staff, and sample for shadow use of public LLMs on applicant packages.