County HR asks security to cover generative AI on telework laptops. How should AI-specific policy content be maintained?

Adding AI-specific clauses to the existing acceptable-use standard so AI guidance integrates with (not duplicates) telework and security rules is the action that prevents policy fragmentation and contradictions. County HR and security need one authoritative standard that covers both traditional telework (VPN, device encryption, clean desk) and AI-specific risks (generative tool approval, prompt content limits, fine-tuning prohibitions). Integrating AI into the existing standard signals that AI is now part of baseline security, not a separate concern, and keeps the policy compact and memorable.

Issuing a separate AI acceptable-use policy under county HR so AI rules align with telework agreement reauthorization reviews creates the risk of conflicting guidance: employees may see the separate HR policy and the existing acceptable-use standard and be unsure which is authoritative, and tying security rules to the reauthorization cycle fragments maintenance outside the broader information-security policy set. Duplication also wastes reader attention and maintenance burden. A well-integrated policy is simpler and more enforceable. Maintaining AI-specific clauses in the telework endpoint hardening baseline so AI rules follow the laptop configuration update cadence is a governance failure: it separates AI acceptable-use rules from the broader information-security policy set, so employees lack one clear standard and technical baseline updates do not communicate permitted AI uses. Laptop configuration updates are foundational, yet they do not address generative-AI-specific risks like unauthorized training on corporate data or prompt leakage via AI vendor analytics. Publishing AI-specific requirements in the security awareness training catalog so AI rules remain with the broader user education materials is a governance failure: training materials support awareness but do not provide one authoritative, enforceable standard, so AI rules stay outside the broader information-security policy set, compliance audits lack a policy basis, and updates follow education schedules rather than policy governance.

Operational check: within 60 days, conduct awareness sampling of 20 remote workers: ask them to state the approved generative AI tools and the prohibition on uploading HR/financial data into public LLMs. If fewer than 80% can state both correctly, the policy integration and communication are not yet working.