The Practical AI Implementation Guide for State and Local Government

Start with the resident or employee need, then decide whether AI is a suitable part of the answer.

Define the job

A first pilot could explain published permit instructions, summarize a public meeting packet, or find an approved procedure. Use maintained public sources and human review.

Write the current process in five steps. Identify the delay, repeated effort or quality problem. Compare AI with simpler options such as better search, a revised form or an updated knowledge article. Avoid adding a model where clearer information would solve the problem.

Complete a one-page charter

Keep consequential decisions with authorized people

For an initial pilot, exclude final benefits eligibility, enforcement, hiring, legal determinations and emergency decisions. These uses require a separate, more demanding assessment of authority, fairness, accuracy, accessibility and recourse. A human reviewer needs the time, expertise and source evidence to disagree.

For a permit FAQ, success could mean residents reach the correct published instruction more reliably. Test confusing questions and exceptions, not just the questions in a vendor demonstration. Treat an unsupported answer as a problem to resolve before wider use.

A policy is useful when staff can tell what is allowed, who approves it and what happens when something goes wrong.

Assign decisions to named roles

The department owner accepts service quality. IT owns integration and availability. Security and privacy review data flows. Procurement and legal review agreements and obligations. Records and accessibility specialists evaluate retention, disclosure and access. Small agencies can combine roles while keeping responsibilities explicit.

Use the NIST AI Risk Management Framework as an organizing reference for risks and decisions. It is voluntary guidance, not proof of legal compliance. Record the decisions that matter to this particular service rather than copying a large framework into a checklist.

Publish clear staff rules

• Use approved accounts and tools for approved purposes. Personal subscriptions do not create agency authorization.
• Classify information before uploading it. Keep protected, restricted and criminal justice information outside a general pilot.
• Require a named reviewer before publication, official correspondence or any change to a system of record.
• Treat retrieved documents and resident messages as information, not instructions that can change tool permissions.
• Report unsafe outputs, unexpected access and suspected disclosure through a known incident channel.

Maintain an AI inventory

For each use, record the owner, purpose, vendor, model or service configuration, data types, connected systems, review date and current status. Include features added to existing software. Route material changes through review, especially new connectors or broader permissions. Give staff a practical path to request a new use so that the policy supports useful work.

Private infrastructure can offer control, but the full data path and operating practices determine the actual boundary.

Map before buying

Map the application, model, document store and connections, including telemetry, support, backups, logs and subcontractors. Ask what leaves the agency, who can read it and how retention works. Retrieval indexes and conversation logs may expose information from restricted repositories.

Compare cloud, private and on-premises options against the same requirements. Include identity, encryption, patching, monitoring, capacity, recovery and staff coverage. Do not assume that local hardware solves governance, or that a provider’s authorization automatically covers the agency’s application.

Ask for demonstrable controls

• Does retrieval and export enforce user permissions? Test denied accounts.
• Do enforceable terms and settings restrict training and secondary use?
• Can the agency export usable documents, configuration and records?
• Can operators disable connectors and revoke credentials independently?
• What changes require notice, reapproval or charges? Include exit costs.

Keep requirements specific

Have the responsible officials determine applicable state rules, public-records duties, retention schedules and program-specific requirements. Restricted programs, including criminal justice work, need a separate review before any data connection. Use the agency’s established procurement process to translate these findings into acceptance criteria and contract obligations. Evaluate vendor answers through a small, realistic demonstration.

Give the assistant trusted material, limited access and an output format that makes errors easier to catch.

Start with a public-document assistant

Select a small set of current, approved permit or service pages. Record source owners and effective dates. Require answers to cite the relevant passage and provide a contact for exceptions. The assistant should say when the sources do not answer a question.

Use this drafting request: “Using only these approved permit instructions, explain the next step for this fictional question. Cite the source and section. Identify missing information and exceptions. Do not determine eligibility, invent fees or promise approval. Return a draft for staff review.”

Test before residents depend on it

• Ask ordinary questions, ambiguous questions and questions outside the source collection.
• Include superseded documents and conflicting dates to check whether the assistant flags uncertainty.
• Test instructions hidden in an uploaded document that ask the system to reveal data or ignore policy.
• Check keyboard use, screen-reader output, plain language and a working human alternative.
• Confirm that a staff reviewer can inspect sources, reject the draft and record a correction.

Make publishing a separate action

During the pilot, keep answers in an internal review queue. Staff verify facts, fees, dates, links and tone before release. Do not give a drafting assistant authority to change records or send official notices. If a later service needs those actions, approve each tool and permission separately. Practice withdrawing an incorrect answer and returning the service to its prior process.

A successful pilot produces a defensible decision, including a decision to stop.

Collect evidence that reflects the whole task

Before launch, sample the existing workflow and record time, quality problems and escalation patterns. During the pilot, measure total effort including review, correction and administration. Compare similar tasks and disclose the limits of a small sample. Avoid turning a faster first draft into a claim about staff savings.

Keep an approved evaluation set with expected source references and unacceptable outcomes. Recheck it after changes to source material, prompts, configuration or integrations. Protect evaluation records according to agency rules and minimize personal information in logs.

Review the decision together

Expand one boundary at a time

At the planned review, record continue, change or stop with supporting evidence and unresolved concerns. If expanding, add one department, source collection or capability at a time. Reassess data access and train the new users. Publish a concise internal account of what worked and what did not.

Bring the pilot charter, representative outputs, correction log and operating costs to the next budget conversation. Funding should support a service the agency can maintain and explain. A measured outcome is more useful than a broad promise about transformation.

• NIST AI Risk Management Framework
• NIST AI RMF Playbook
• OWASP Top 10 for LLM Applications
• W3C WAI Easy Checks