Topics: 

Issue Date 10/5/2023

Effective Date: 10/5/2023

Review Date: 08/21/2026

Purpose

As artificial intelligence (AI) technology continues to advance and become an integral part of everyday business operations, it is increasingly important for the State to establish requirements for the responsible use of AI. This policy is designed to promote the responsible use of AI systems, applications, tools, and services while also minimizing the potential for intentional or unintentional misuse, unethical outcomes, potential biases, inappropriate use or disclosure of sensitive data, and information security breaches. This policy addresses the use of artificial intelligence applications, tools and services in government operations, especially as it pertains to the processing, transmission, storage, or disclosure of sensitive data and State information through AI enabled technologies.

Scope and Authority

  • O.C.G.A 50-25-4(a)(8), State Government, Georgia Technology, General Powers
  • O.C.G.A 50-25-4(a)(20), State Government, Georgia Technology, General Powers
  • O.C.G.A 50-25-4(a)(28), State Government, Georgia Technology, General Powers
  • PM-04-001, Information Technology Policies, Standards and Guidelines
  • PS-08-005, Enterprise Information Security Policy

Terms and Definitions

Agency: every state department, agency, board, bureau, commission, and authority but shall not include any agency within the judicial or legislative branch of state government, the Georgia Department of Defense, departments headed by elected constitutional officers of the state, or the University System of Georgia and shall also not include any authority statutorily required to effectuate the provisions of Part 4 of Article 9 of Title 11.

Artificial Intelligence: machine-based system that, for explicit or implicit objectives, infers from the inputs it receives how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments. Artificial Intelligence includes, but is not limited to, generative AI technologies.

Generative Artificial Intelligence: class of Artificial Intelligence designed to generate synthetic content, including text, images, audio, video, software code, or other digital content, based on patterns learned from data.

Technology Resources: means hardware, software, and communications equipment, including, but not limited to, personal computers, mainframes, wide and local area networks, servers, mobile or portable computers, peripheral equipment, telephones, wireless communications, public safety radio services, facsimile machines, technology facilities including, but not limited to, data centers, dedicated training facilities, and switching facilities, and other relevant hardware and software items as well as personnel tasked with the planning, implementation, and support of technology.

Policy

Agencies shall submit all AI systems, applications, tools and services, including AI-enabled capabilities incorporated into other technology products or services, to GTA for review prior to procurement. All agencies shall follow established State policies and standards when implementing or using technology resources that incorporate or utilize AI.

Related Enterprise Policies, Standards, and Guidelines

  • Artificial Intelligence Responsible Use - SS-23-001
  • Artificial Intelligence Responsible Use Guidelines – GS-23-001
  • Generative AI Guidelines for Responsible Use — GS-25-001
  • Procurement of AI Tools Guidelines for Responsible Use — GS-25-002
  • Enterprise Information Security Policy — PS-08-005
  • Generative AI Responsible Use — SS-25-001

References

National Institute of Standards and Technology (NIST), Special Publication 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations

National Institute of Standards and Technology (NIST), Special Publication 800-53B, Control Baselines for Information Systems and Organizations

National Institute of Standards and Technology (NIST), Artificial Intelligence Risk Management Framework (AI RMF), current published version

National Institute of Standards and Technology (NIST), NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile

GovRAMP, Security Program, based on NIST SP 800-53 Revision 5, as applicable to cloud services supporting or incorporating artificial intelligence capabilities

GovRAMP, AI Self-Reporting Addendum, as applicable to AI-enabled cloud products and services.