Peoria County committee postpones enterprise AI policy to get costs, governance and access details

Chairman Steven Rieker opened debate June 23 on a proposed enterprise artificial intelligence usage policy and governance framework, then turned the floor to Mark Little, the county's chief information officer, who described risks from staff use of unmanaged consumer AI tools and recommended a tiered access model to protect county data.

Little told the committee that network analytics showed staff using consumer-grade AI tools that could expose sensitive county records because many public models permit vendors to extract user inputs and train their systems. "By default, public consumer models operate on terms that allow vendors to extract whatever you put into them and to train their public algorithms," Little said, and he recommended a three-tier approach that would prohibit unmanaged public platforms, allow vetted enterprise platforms under contract and reserve isolated sandbox environments for high-risk tasks.

The proposal would require staff to submit operational justifications for AI access, prohibit personal subscriptions for county business and add monitoring and blocking software to stop unauthorized data transfers. Little said access would be an earned privilege tied to annual training and that accidental "data spills" reported within 24 hours would receive a safe-harbor; intentional concealment would draw disciplinary action. He also said additional security modules and procurement costs will likely be required and that specific pricing will be returned for committee approval as a budget modification from the IT fund balance.

Several committee members pressed for more detail before adoption. Member Danny Phelan said he would not support the measure as written because it lacked cost estimates and left a gap between banning personal accounts and providing county-managed alternatives. "If you ban the use of them and you haven't approved a way for them to get on a closed loop account that's provided by the county, you have a window of time where somebody that was previously protecting data a little bit better" may be exposed, Phelan said. CIO Little and staff acknowledged the timing issue and said procurement and governance steps would follow the policy's adoption but that those steps would be brought back to the committee for approval.

Member Rob Reneau urged the committee to require disclosure on forward-facing documents when content was generated or assisted by AI; counsel Jennie Cordis Boswell said an amendment could be proposed but noted that the committee must define what constitutes "generated by AI" before imposing a disclosure requirement. Members and staff also discussed accessibility concerns and whether restrictions would interfere with assistive technologies; Little said IT has identified and begun vetting about 98 tools with AI components and does not intend to restrict necessary assistive functions.

Given outstanding questions about governance composition, appeals processes for denied access, cost estimates for enterprise licenses and a clear definition of disclosure obligations, Member Sharon Williams moved to postpone consideration to the July committee meeting to allow staff to return with more detail. The motion passed (ayes: Williams, Reneau, Allison, Duncan, Coates, Phelan, Rieker; nays: Blair, Bryant) and the item was postponed to the committee's July meeting.

Next steps: staff will return with procurement pricing, recommended governance-board composition and clarified language on appeals and disclosure so the committee can consider specific amendments and a budget modification for necessary security tools.