Larimer County outlines generative AI policy, staff guidelines and training plan

Larimer County commissioners on April 14 reviewed a draft generative artificial intelligence policy and related staff guidelines after county information-technology staff described rapid growth in internal use of AI tools and next steps for training, vendor engagement and monitoring.

The policy discussion, presented by Greg Turnbull, director of innovations and insights and information technology, and Mark Pfaffinger, chief information officer and internal services director, follows a year of pilot work and an employee survey that IT officials said shows substantially increased use of generative AI on county devices and networks.

Turnbull said the county tracked about 1.5 million AI-related transactions in a prior year and about 6.8 million calls to AI services on the county network in the most recent period. He told commissioners that roughly 400 staff responded to a follow-up survey showing self-reported daily or regular use rising from about 22% to about 44% of respondents, and sentiment toward AI moving more positive: “This year we've seen the positives jump up to 28% and the negatives recede to 15%,” Turnbull said. He and other staff stressed that those numbers reflect activity on county-managed devices or routed through the county network and do not include personal devices not connected to county systems.

Why it matters: County staff said adopting a written policy and staff guidance is necessary to protect privacy, public records obligations and data security while letting employees use AI tools for routine tasks such as drafting or refining content, accessibility work, summarizing large documents and preliminary data analysis.

Use cases and safeguards

IT described common uses already in county work: rewriting or clarifying text, adjusting tone for public-facing content, generating alternative text for images to improve website accessibility, and analyzing survey results using NotebookLM or Gemini tools. Turnbull said one example was using a generative model to surface insights from a community resilience assessment showing many respondents felt less prepared for power outages.

Staff emphasized human oversight: "Human in the loop is a component that when we generate content using these tools, we don't just release it to the world," Turnbull said, adding that any chatbot or automated assistant should include a clear path to reach a human reviewer. Pfaffinger said the policy will align with existing county privacy and cybersecurity policies and county records rules, and that prompts and, when feasible, prompt histories should be available to meet open-records and records-management requirements.

Monitoring, devices and vendor tools

Commissioners asked how IT counts AI activity. Pfaffinger explained the county measures both data volume and individual web transactions — “every time I hit the submit button then I'm prompting ChatGPT a call is made out to those servers,” he said — and noted that many commercial software packages now include AI features that generate background transactions. Laura Walker, director of human and economic health, clarified that county-issued laptops taken home continue to route through county protections and therefore are monitored; personal devices and home networks are not included in the county’s internal transaction counts.

Commissioners also raised transparency and consent around meeting assistants such as Zoom’s AI features and third-party note-taking services. IT said county-configured accounts prompt participants when recording or AI features are active and that outside platforms may run agents the county cannot control.

Policy content and next steps

Turnbull summarized the draft policy’s scope: definitions and principles; acquisition and vendor engagement; required transparency and attribution for AI-assisted content; bias- and harm-reduction measures; data-privacy prohibitions against inputting personally identifying information or protected health information into external models; records-management expectations; and narrow, defined exceptions.

Staff guidelines are being prepared as a living document in the county knowledge base to provide concrete instructions and a vetted-tool list, IT said. Pfaffinger said the county plans staff training before departments commit to purchasing AI-enabled features and will explore dashboards to monitor prompts and detect potential data leaks (for example, if a Social Security number is entered into an external model). He said the policy will be reviewed annually.

Concerns and committee work

Commissioners commended the work and raised several cautions: the need for a vetted-tools list and links to policy and guidance; stronger staff training on prompt-writing to reduce bias in output; and awareness that many vendor packages will ship AI features that cannot be removed and that may increase costs. Turnbull said the county is participating in intergovernmental groups and has consulted the Equity, Diversity and Inclusion Advisory Board on policy drafts. He also noted that the county has blocked certain externally hosted tools (the firewall currently blocks a tool identified in IT briefings as DeepSeek) and will continue to refine restrictions as needed.

No formal action or vote was recorded on April 14. Commissioners directed staff to continue refining the policy and guidelines, expand staff training, publish the policy to county staff, and work with procurement and strategic planning to coordinate vendor engagement and protected-tool lists.

Ending

County officials said the draft policy and staff guidelines are intended to allow controlled, beneficial uses of generative AI while preserving data security, privacy and records integrity. Commissioners indicated support for the approach and asked staff to return with ongoing implementation details and training plans.