HomeMy WebLinkAboutCC Resolution No. 26-098 adopting the Artificial Intelligence (AI) Council Policy RESOLUTION NO. 26-098
A RESOLUTION OF THE CUPERTINO CITY COUNCIL ESTABLISHING A
POLICY FOR ARTIFICIAL INTELLIGENCE
WHEREAS, the City of Cupertino (“City”) recognizes that artificial intelligence (“AI”)
technologies are rapidly evolving and have the potential to improve City operations,
enhance public services, support employees, and promote innovation; and
WHEREAS, the use of AI technologies also presents potential risks, including risks
related to accuracy, transparency, accountability, and the protection of confidential and
sensitive information; and
WHEREAS, the City has established an Artificial Intelligence (AI) Policy that provides
governance and user guidelines for the responsible use of AI systems across City
operations; and
WHEREAS, the City's AI Policy has been updated and reformatted from an
administrative policy into the City's standard Council Policy format to establish a
formal Council-level governance framework for the responsible use of AI; and
WHEREAS, the City desires to establish Council-level policy direction governing the
City's use of AI while retaining administrative responsibility for implementation,
oversight, and enforcement; and
WHEREAS, adoption of the AI Council Policy will provide clear Council direction and a
durable governance framework to guide the City's responsible use of AI and other
emerging technologies while allowing for appropriate administrative implementation
and ongoing oversight.
NOW, THEREFORE, BE IT RESOLVED, that the City Council of the City of Cupertino
does hereby adopt and approve the Artificial Intelligence (AI) Policy attached as Exhibit
A.
CC Resolution No. 26-098
Page 2
2
PASSED AND ADOPTED at a regular meeting of the City Council of the City of
Cupertino this 15th day of September 2026, by the following vote:
Vote Members of the City Council
AYES:
NOES:
ABSENT:
ABSTAIN:
Moore, Chao, Fruen, Mohan, Wang
None
None
None
SIGNED:
___________
Kitty Moore, Mayor
City of Cupertino
________________________
Date
ATTEST:
_____________
Lauren Sapudar, City Clerk
________________________
Date
10/12/2026
10/12/2026
Page 1 of 11
Artificial Intelligence (AI)
Council Policy #
Effective Date:
September 15, 2026
Responsible Department:
Innovation & Technology
Related Policies & Notes:
Records Retention Policy and Schedule
Technology Use Policy
Internet Privacy Policy
Section 1. Policy Statement
Purpose
The purpose of this policy is to establish a comprehensive governance structure and
user guidelines that allow the City of Cupertino to use Artificial Intelligence (AI)
systems for the benefit of the community while safeguarding against harms.
The key objectives of the AI Policy are to:
•Provide guidance that is clear, easy to follow, and supports decision-
making for the AI user who may be purchasing, configuring, developing,
operating, leveraging, or maintaining the City’s AI systems to provide
services to the City of Cupertino.
•Ensure that when using AI systems, the City or those operating on its
behalf, adhere to the Guiding Principles outlined in Section 2 with regards
to how AI Systems are purchased, configured, developed, operated, or
maintained.
•Define roles, responsibilities, and risk assessment and management
processes related to the City use of AI systems.
•Establish and maintain processes to assess and manage risks presented by
AI systems used by the City.
•Align AI systems governance with existing data governance, security, and
privacy measures.
•Define prohibited uses of AI systems.
Page 2 of 11
•Establish “sunset” procedures to safely retire AI systems that no longer
meet the needs of the City.
•Define how AI systems may be used for legitimate City purposes in
accordance with applicable local, state, and federal laws, and existing City
policies.
The City’s AI systems and the data contained therein will be purchased, configured,
developed, operated, and maintained as defined in this policy.
Scope
As directed by the City Manager, the I&T Department provides management and
oversight for all activities directly related to information technology and information
security for the City. Under this authority, the CTO and his/her designee(s) are
responsible for enforcing information technology related policies and standards. As
such, this policy is applicable to all users.
Policy
The City supports and promotes the use of all Artificial Intelligence (AI) systems
deployed or used by the City of Cupertino. The AI systems may be freeware,
automatically installed, included in software used by the City, or directly purchased
and deployed for City use. The Innovation & Technology (I&T) Department will be the
lead in conducting the procurement and technical review of AI systems. The I&T
Department will consult with any impacted customer departments, risk management,
purchasing, City Attorney's Office and the City Manager's Office to determine if an AI
system should be cautioned against or blocked from use due to risks to the public, staff
or City. This policy applies to all AI users (elected officials, appointed officials, City
employees, interns, volunteers, contractors, consultants, and any individual acting on
behalf of the City), who may be purchasing, configuring, developing, operating,
supporting, or maintaining the City of Cupertino's AI systems or who may be
leveraging AI systems in their work or to provide services to the City of Cupertino.
Definitions
Algorithm: A series of logical steps through which an agent (typically a computer or
software program) turns particular inputs into particular outputs. AI algorithms learn
from training data to generate models.
Page 3 of 11
Artificial Intelligence (AI): “Artificial intelligence” or “AI” is a machine-based system
that can, for a given set of human-defined objectives, make predictions,
recommendations, or decisions influencing real or virtual environments 1. AI systems
use machine- and human-based inputs to perceive real and virtual environments;
abstract such perceptions into models through analysis in an automated manner; and
use model inference to formulate options for information or action.
Artificial Intelligence (AI) Database: A structured collection of data, essential for
machine learning and intelligent decision-making. It enables efficient handling and
processing of large data volumes, crucial for AI applications. AI uses databases for
predictive analytics, natural language processing, and real-time decision-making.
Artificial Intelligence (AI) Hallucination: An AI hallucination is a response by an AI
that appears confident and accurate but does not seem to be justified by its training
data. It occurs when an AI model creates something that’s not real and not based on its
own data or facts. The model fills in details that are not accurate. It can result in
ridiculous or non-sensical outputs that are far from reality or do not make sense. AI
hallucinations can occur in large language models (LLMs) like OpenAI’s GPT or Google
Gemini, or in generative AI tools like ChatGPT.
Artificial Intelligence (AI) System: Any data system, software, hardware, application,
tool, sensor, or utility that operates in whole or in part using AI2 and generates outputs
including, but not limited to, predictions, recommendations, or decisions that augment
or replace human decision-making. This includes generative AI where a system creates
content such as text, audio, or images in response to human or computer inputs. This
extends to software, hardware, algorithms, and data generated by these systems, used
to automate large-scale processes or analyze large data sets.
Artificial Intelligence (AI) User: Elected officials, appointed officials, full-time staff,
part-time staff, casual/temporary staff, interns, consultants, contractors, partners,
volunteers, and any individual acting on behalf of the City who may be purchasing,
configuring, developing, operating, supporting, or maintaining the City of Cupertino’s
1 Definition from 15 U.S.C. 9401(3)
2 Definition from former United States Executive Order No. 14110 on Safe, Secure, and Trustworthy Development
and Use of Artificial Intelligence (rescinded January 20, 2025)
Page 4 of 11
AI systems or who may be leveraging AI systems in their work or to provide services to
the City of Cupertino.
Automated-Decision Systems 3: Automated-Decision Systems (ADS) are systems that
use algorithms, machine learning, or artificial intelligence to make decisions or assist in
decision-making processes without human intervention. These systems analyze data,
recognize patterns, and apply pre-defined rules or learned behaviors to make decisions
in various domains. However, caution should be exercised when using an ADS
especially in hiring decisions. The use of an ADS to evaluate an applicant’s tone of
voice, facial expressions or other physical characteristics or behavior may constitute
unlawful disparate treatment of or have an unlawful adverse impact on individuals
based on race, national origin, gender, or several other protected characteristics.
Chatbot: An AI-driven software application that simulates human conversation to
provide automated responses, answer questions, and perform tasks. Chatbots are used
for customer service, information retrieval, and interactive communication on websites
and messaging apps.
Generative AI: A system that creates content such as text, audio, or images in response
to human or computer inputs. Current examples of Generative AI include ChatGPT,
Google Gemini, and Microsoft Copilot. Please note: Grammarly is a digital writing
assistant that utilizes artificial intelligence to help users improve their writing. Unlike
Generative AI, which creates new content from scratch, Grammarly focuses on
analyzing and enhancing existing text.
IT Governance: refers to the City’s IT Governance structure that clarifies accountability,
supports strategic alignment, delivers value, manages resources, mitigates risks, and
measures performance. IT Governance involves leadership from the highest levels to
ensure compliance with regulations, internal controls, and the effective use of I&T
Department resources.
Section 2. Guiding Principles and Responsibilities for Responsible AI Systems
A.These principles describe the City’s values with regard to how AI systems are
purchased, configured, developed, operated, or maintained.
3 Definition from Civil Rights Council Employment Regulations Regarding Automated-Decision Systems
Page 5 of 11
(1)Effectiveness: AI systems are reliable, meet their objectives, and deliver
precise and dependable outcomes for the purpose and contexts in which
they are deployed.
(2)Transparency: Where possible, an AI system, its data sources, operational
model, decision-making process, and policies that govern its use are
understandable and documented.
(3)Equity: AI systems support equitable outcomes for everyone. Bias in AI
systems is effectively managed with the intention of reducing harm for
anyone impacted by its use.
(4)Accountability: Roles and responsibilities govern the deployment and
maintenance of AI systems, and human oversight ensures adherence to
relevant laws and regulations.
(5) Human-Centered Design: AI systems are developed and deployed with a
human-centered approach that evaluates AI powered services for their
impact on the public.
(6)Privacy: Privacy is preserved in all AI systems by safeguarding personally
identifiable information (PII) and sensitive data from unauthorized access,
disclosure, and manipulation.
(7)Security & Safety: AI systems maintain confidentiality, integrity, and
availability through safeguards that prevent unauthorized access and use.
Implementation of AI systems is reliable and safe, minimizing risks to
individuals, society, and the environment.
B. Several roles are responsible for enforcing this policy, outlined below.
(1)The City Council establishes the policy framework governing the City's
use of Artificial Intelligence. The City Manager and Innovation &
Technology Department are responsible for implementation,
administration, and enforcement.
(2)The Chief Technology Officer (CTO), or designee, is responsible for
directing City technology resources, policies, projects, services, and
coordinating the same with all departments. The CTO, or designee, shall
actively ensure AI systems are used in accordance with all applicable
policies.
Page 6 of 11
(3) The IT Infrastructure (Security) Manager, or designee, is responsible for
overseeing the enterprise security infrastructure and cybersecurity
operations, updating security policies, procedures, standards, and
guidelines, and monitoring policy compliance. They are also responsible
for using the City’s network and technology hardware in compliance with
City policies.
(4)The IT Managers, or designees, are equally responsible for overseeing the
enterprise's digital privacy practices, data processing practices, and
responsible usage of software and applications in compliance with City
policies. They are also responsible for overseeing the privacy practices of
AI systems used by or on behalf of all departments.
(5)Department Heads are responsible for ensuring AI systems within their
departments comply with City policies. They must coordinate with the
CTO and IT Managers, oversee AI integration, and report any risks or
issues to the City Manager or CTO.
(6)The CTO is responsible for maintaining this policy.
(7)The City Manager, or designee, is responsible for implementing and
enforcing this policy and may suspend, restrict, or terminate the use of AI
systems that present unacceptable legal, operational, security, privacy,
ethical, or financial risks to the City.
Section 3. General Guidelines
Subd. 1. General Guidelines for Purchasing or Installing AI
When purchasing, configuring, developing, operating, installing, or maintaining AI
systems, the City will:
A.Uphold the Guiding Principles for Responsible AI Systems (Section 2).
B.Understand that the procurement process may take longer than normal to
allow for the appropriate risk and technical assessments.
C.Understand that the Guiding Principles and Guidelines for AI systems also
apply to free-to-use, freemium, open source, software-as-a-service (SaaS), and
any other solution formats, whether or not a purchase needs to be made.
Page 7 of 11
D.Conduct an AI Review when purchasing or installing a new AI system to
assess the potential risk of the AI system. The CTO and IT Management Team
are responsible for coordinating review of AI systems used by the City as
detailed.
E.Obtain technical documentation about AI systems using the I&T internal AI
vendor Fact Sheet (Modified from the GovAI Coalition AI Fact Sheet) or
equivalent documentation if the AI system is internally developed. The I&T
Department will coordinate with the Department of Finance and Purchasing
Division to ensure vendors complete the AI Fact Sheet when needed.
F. Vendors and contractors that supply AI systems are required to comply with
the Standards and Requirements for AI Systems overseen by the I&T
Department, Department of Finance, and Purchasing Division. Exceptions will
be agreed upon between the I&T Department, Department of Finance, City
Attorney’s Office and Risk Management.
G.In the event of an incident involving the use of the AI system, the City will
follow an Incident Response Plan. The CTO and IT Infrastructure (Security)
Manager, or designees, along with department AI system owners, are
responsible for overseeing the security practices of AI systems used by or on
behalf of City departments.
Subd. 2. Requirements for Using AI
A.All AI tools used for work purposes that require an account will be used
explicitly for City use. Personal accounts are not permitted for work use.
B.Assume that all work products (e.g., transcription notes from a meeting)
related to AI tools and content are subject to relevant Public Records Act
requests. Such records shall be retained, managed, and disposed of in
accordance with the City's Records Retention Policy and Schedule, this policy,
and applicable California Public Records Act requirements.
C.Do not input confidential, privileged, sensitive, personal, security-related, or
other non-public City information, documents, or images into any AI system
unless that system has been approved for the type of information involved.
Approval falls into three tiers:
Page 8 of 11
•Public or consumer AI tools (free or personal-tier services): Never
input non-public City information. Anything entered may be retained by
the vendor, used to train models, or exposed publicly, and cannot be
recalled or deleted.
•Enterprise AI tools operating inside the City's Microsoft 365 tenant
(e.g., Microsoft 365 Copilot): These operate within the City's security
and compliance boundary, honor existing file and mailbox permissions,
and do not use City data to train foundation models. Non-public
information may be used with these tools only where the user is already
authorized to access that information and only for data types the City
has approved. Tenant protection secures the data — it does not
authorize sharing, republishing, or aggregating output beyond its
intended audience.
•Closed AI systems built for or by the City (internally developed or
vendor-hosted under City contract): Use only within the data
classifications, use cases, and security terms established in that system's
approval and contract. A City-branded or City-contracted system is not
automatically approved for all information types.
•Privileged, litigation, personnel, security/infrastructure, and CJIS- or
HIPAA-regulated information requires prior authorization from the City
Attorney's Office and the I&T Department before entry into any AI system,
regardless of tier.
D.AI Users are responsible for all work products produced or generated using AI
systems used for work purposes. The consequences of AI use are the
responsibility of humans and cannot be deferred to the software and/or system.
Staff assume all review of content produced by AI prior to using or publishing
the content or images. Staff must constantly verify content and maintain a
“zero-trust” approach to ensure content is accurate and used appropriately
(e.g. avoid creating or using deepfake content).
Users need to be aware that AI is not a search engine or a consistently reliable
source of information. It is essential for users to review and validate the content
generated by AI to identify and correct any inaccuracies or nonsensical details,
known as AI hallucinations.
Page 9 of 11
E.The City may restrict or block AI tools that have not been reviewed and
approved. Employees should use City-approved AI tools whenever available.
Public AI tools may be used only for authorized, low-risk purposes and must
never receive confidential, sensitive, privileged, personal, security-related, or
other nonpublic City information.
Subd. 3. Acceptable Uses of AI
The range of uses of AI are wide, and new capabilities are frequently introduced. This
list provides a set of examples to be used as guidance but is not intended to be a
complete list:
A.AI systems and tools that are natively installed as part of a City system
upgrade or release.
B.Creating an outline for written content. While AI can be used as a starting
point, the final product should be edited and modified by the City’s AI Users.
Examples include: emails, letters, documentation, project artifacts, agendas,
speaker notes, presentation outlines or slides, social media posts, procurement
documentation (RFPs, RFIs, etc.), website content, formal reports, informal
documents, policies, procedures, job descriptions, and press releases.
C.Copying a document into an AI system to summarize and/or query it.
D.Suggesting writing improvements (e.g., write your document and have AI
provide suggestions for simpler words or better context).
E.Analyzing different types of data, to include verifying data or content to be
valid (e.g., detection tools that identify inconsistencies typically associated with
deepfakes.)
F.Idea generation.
G.Creating images or graphics.
H.Language (foreign or plain English) translation.
I.Public Safety technology meta-data detection (e.g., Body-Worn Camera
footage, Drones, ALPRs).
J.Acting as a chatbot for public and staff consumption, such as on the City's
website.
Page 10 of 11
K. Creating code or algorithms to be used in system development or design,
provided that the AI-generated code has been reviewed and vetted by staff.
Subd. 4. Prohibited Uses of AI
The use of certain AI systems is prohibited because they process sensitive information
and there is a high risk that they can cause harm. This includes the following prohibited
uses:
A.Biometric identification – the live identification of an individual using
technologies including, but not limited to, facial recognition and iris scanning,
without that individual’s knowledge or meaningful consent.
B.Emotion analysis, or the use of computer vision techniques to classify human
facial and body movements into certain emotions or sentiment (e.g., positive,
negative, neutral, happy, angry, nervous).
C.Fully automated decisions that do not require any meaningful human
oversight but substantially impact individuals.
D.Fully automated decisions related to hiring, disciplinary action, or personnel
matters.
E.Social scoring, or the use of AI systems to track and classify individuals based
on their behaviors, socioeconomic status, or personal characteristics.
F.Cognitive behavioral manipulation of people or specific vulnerable groups –
such as AI-driven tools or algorithms designed to influence or alter an
individual’s decision-making process or belief system. These systems use
psychological, behavioral, or emotional data to create targeted strategies that
can manipulate thoughts, feelings, or actions, particularly focusing on
vulnerable groups or individuals.
If staff become aware of an instance where an AI system has caused harm, staff must
report the instance to their supervisor and the I&T Department as soon as possible.
Subd. 5. Sunset Procedures
If an AI system operated by the City or on its behalf ceases to provide a positive utility
to the City as determined by the CTO and IT Governance, the use of that AI system
must be halted unless express exception is provided by the City Manager or City
Council. If the abrupt cessation of the use of that AI system would significantly disrupt
Page 11 of 11
the delivery of City services, usage of the AI system shall be gradually phased out over
time.
Section 4. Enforcement
A.All AI users are required to follow this policy.
B.Any use of AI that is found to be harmful to AI users, the public, and/or the
City will be altered or stopped.
C.Violations will be investigated. Abuse of this policy by employees may result in
disciplinary action. Violations by elected or appointed officials will be
addressed in accordance with applicable law and City Council policies and
procedures. Violations by contractors, consultants, volunteers, and others
acting on behalf of the City will be addressed in accordance with the applicable
agreement and City policies.
Adopted by Resolution No. 26-098 on September 15, 2026.
______________________
Kitty Moore, Mayor
City of Cupertino
Attest: ______________________
Lauren Sapudar, City Clerk