Guiding Safe and Responsible AI Use

When using AI systems such as ChatGPT, Gemini or Claude to assist with various work tasks, it is important to be mindful of the information being provided to the software solution. Be mindful of your use by using the following guidelines. 

• Verify all AI-generated content before using it, ensuring the information is accurate, relevant and appropriate.
• Do maintain responsibility of your final work product. AI tools should replace productivity efforts, not replace your work.
• Do be aware of content and agency standards for communication. Ensure that tone, style and language align with agency standards or other professional requirements. 
• Do use general or fictional examples, when possible. Public generative AI applications store the information you provide and may resurface it to other users. 

• Do not use AI-generated answers without fully verifying the content and context is correct. AI tools can present users with inaccuracies (“hallucinations”) or omit key information. 
• Do not use sensitive topics or sensitive state data within the tool such as personal identifiable information (“PII”), financial information, health data, authentication data or any other sensitive information. 
• Do not use when drafting solicitation information or for any procurement processes as the information could be used to gain an advantage by a vendor. 
• Do not rely on AI-generated language translations without confirming accuracy, dialect or potential biases with a qualified interpreter or translator. 

• Example prompt #1: Write a memo to Oklahoma state employees about the return to office executive order. Please include the benefits of returning back to the office, maintain a professional tone and limit the text to be less than 300 words. 
• Example prompt #2: Write a job description for a State of Oklahoma Executive Administrative Assistant. 
• Example prompt #3: Draft an email to all state employees announcing the upcoming benefits enrollment period. Include key deadlines, highlight coverage changes and limit the text to 200 words. Use the documents provided as context for the email. 
• Example prompt #4: Create a one-page FAQ document that addresses common questions about the State of Oklahoma’s benefit package. To ensure responsible AI use, state employees with any questions regarding what should or should not be allowed in AI system should submit a ServiceNow Ticket to the OMES Help Desk for guidance and review. 

If you’re unsure whether something is appropriate to enter an AI tool, submit a ServiceNow ticket to the OMES Help Desk for review and support.

Disinformation and misinformation, while differing in intent, both contribute to the spread of false and inaccurate information in the context of government use of AI. Disinformation is intentionally created to deceive users with misinformation is spread unintentionally due to error. In AI systems, these issues emerge when false content is generated or amplified, whether through automated data output, AI-driven content creation or the propagation of uncorrected or flawed data. Both can undermine trust and accuracy, making it critical to implement safeguards against their occurrence. 

AI systems should be guided by the following principles and values.

• Responsible and ethical AI requires AI systems to respect and enhance human rights, ensuring privacy and equality. By aligning AI with human rights and ethical principles, the goal of the state AI systems is to protect individuals and data.
• AI systems must be transparent with clear lines of accountability. Users of AI systems must be able to explain decisions and processes undertaken by AI systems. Therefore, decisions made by AI must be unbiased, transparent and understandable to users.
• It is crucial to prevent bias in AI decision making to ensure that AI systems provide fair, accurate and non-discriminatory outcomes. It is imperative that AI systems are designed and implemented in a way that prevents discrimination against protected classes, ensuring equitable treatment and compliance with applicable laws regarding protected classes. 

All state employees shall complete “State AI Awareness & Usage Foundational Training & Acknowledgement” training through Workday prior to accessing or using any AI on a stateissued device, or using inputting, or interacting with state data in any AI system. All state employees shall complete biannually refresher training on AI. Additional training may be required in the future.  

Any violation of this policy, whether actual or suspected, shall be immediately reported by the employee and/or their supervisor upon discovery. The state agency shall be responsible for promptly reporting the incident to the CIO and CISO immediately.  

Any violation of this policy identified or reasonably suspected by OMES shall require the affected agency to fully cooperate with and participate in all investigation, response and remediation efforts as directed by OMES. The agency shall provide timely access to relevant systems, records, personnel, and documentation as requested; participate in incident response and corrective action activities; and implement all required remediation measures. Failure to comply may result in escalation and additional administrative, legal, or financial consequences.  

Pursuant to the Oklahoma Information Technology Consolidation and Coordination Act (“ITCCA”) the Chief Information Officer has authority over strategic planning, development, acquisition, deployment and implementation of information technology, including AI systems across executive state agencies. The CIO ensures that AI initiatives are implemented efficiently, securely and in alignment with state priorities, including improving government efficiency, service delivery and data-driven decision making.

The CIO is responsible for establishing standards, policies and procedures for AI systems to ensure their ethical use, security and integration with existing state infrastructure. The CIO will govern AI systems through the following review and approval process:

AI systems requested by agencies, whether procured directly or through a state contract managed by OMES, are subject to the CIO’s authority and must undergo CIO review at all stages prior to deployment. The CIO shall approve, conditionally approve or deny such systems based on industry best practices and a standardized evaluation framework evaluation will consider:

• Alignment with state strategic priorities.
• Compliance with applicable laws, regulations and rules. 
• Ethical consideration, fairness, accountability and transparency. 
  • Ethical governance framework:
    • Data quality and transparency.
    • Privacy and security.
    • Accountability and fairness.
    • Robustness, reliability and compliance.
    • Electoral integrity and non-bias.
    • Collaboration and beneficence.
• Data privacy, security and protection protocols.
• Risk classification and intended use. 
• Whether the AI system is a net new system or an AI enhancement to an existing approved solution.

All AI systems must undergo a third-party security review, which includes assessment of the supplier’s Authority to Operate (“ATO”) and software product security review. Both reviews are to be conducted by the Chief Information Security Officer (CISO) of OMES before any use of the product, ensuring that all security and compliance requirements are met.

Sensitive Data shall not be transmitted when using public AI systems. Such data may be transmitted through a separate secure instance, not a public unsecure instance, but only after having been approved for such use by the CIO. Once CIO approval has been granted for use of sensitive data in any AI tool, continued compliance regarding certain types of sensitive data use must be monitored and will be held accountable by the agency for compliance with any applicable federal regulations.

Any state employee who inputs, uploads, transmits or otherwise discloses any federally protected data into a public AI system or any AI system that has not been reviewed and approved for the handling of such data in accordance with this policy and applicable security requirements shall be terminated by the employing agency.