CivicAI Readiness Assessment

What this is. A scored assessment of how prepared your organization is to use AI responsibly: data governance, staff policy, vendor controls, and automation capacity. You receive a written report with a score, risk flags, and a 90-day action plan.

How to answer. Choose the option that describes what is actually in place today, not what is planned. Candid answers produce a useful report; a low score is normal and is the starting point, not a judgment.

Confidentiality. Responses are held by DJ AI Business Consultant LLC, are not shared with any third party, and are used only to prepare your report.

Organization

Organization name

Type

County

Population (approx.)

Employees (approx.)

Departments in scope (optional)

Respondent

Your name

Title

Data Governance & Security

Whether the municipality knows what data it holds, how sensitive it is, how long it must be kept, who may share it, and how it is protected.

DG1

Does the municipality maintain an inventory of its information systems and the data each one holds?

Includes financial, tax, court, permitting, police, and records systems (Tyler, Williamson Law Book, Laserfiche, Axon, etc.), plus spreadsheets and shared drives that hold resident data. OSC IT audits routinely cite the absence of an inventory.

0No inventory exists; nobody could list every system holding resident data. 1A partial list lives in someone's head or a stale spreadsheet. 2A written inventory exists but is incomplete or has not been updated in over a year. 3A complete inventory of systems and data types is maintained and updated when systems change. 4The inventory is complete, reviewed at least annually, and used to drive security and retention decisions.

DG2Gating question

Is data classified by sensitivity (public, internal, confidential, restricted) so staff know what may be entered into an AI tool?

Sensitive categories include personal identifying information, health and social-services records, criminal justice information (CJIS), tax and assessment data, and attorney-client material. Without classification, staff cannot know what is safe to paste into a chatbot.

0No classification scheme; all data is treated the same. 1Staff use judgment case by case; no shared definitions of sensitive data. 2A classification policy is written but most records are not labeled and staff are unsure how it applies. 3Classification is defined, applied to major systems, and referenced in acceptable-use guidance. 4Classification is applied consistently, tied to handling rules for AI tools, and reviewed on a schedule.

DG3Gating question

Have FOIL obligations and LGS-1 retention requirements been applied to AI prompts, outputs, and chat logs?

Under Public Officers Law Article 6 (FOIL), records created or held by the municipality are presumptively public, and the LGS-1 retention schedule governs how long they must be kept. Prompts typed into an AI tool and the outputs it produces can be records. Vendor-hosted chat histories may be unreachable when a request arrives.

0Nobody has considered whether AI prompts or outputs are records. 1The Records Management Officer or Clerk has raised the question informally; no position taken. 2A written position exists but no retention or FOIL procedure covers AI-generated content. 3AI prompts and outputs are treated as records with a documented retention series and FOIL procedure. 4Retention, FOIL handling, and legal hold for AI content are documented, tested against a request, and reviewed with counsel.

DG4

How would you describe the quality and consistency of data in your core systems (addresses, parcels, accounts, case records)?

AI tools amplify whatever they are given. Duplicate parcels, inconsistent address formats, and free-text fields used in place of coded values all produce unreliable results.

0Data quality is unknown; errors surface only when a resident complains. 1Known problems are fixed by individual staff as they find them; no standards. 2Data-entry standards exist for some systems but are not enforced or audited. 3Standards are documented and enforced in core systems; periodic cleanup is performed. 4Data quality is measured, owned by a named steward per system, and reported on regularly.

DG5

Who is authorized to approve sharing municipal data with an outside system, vendor, or AI service?

Uploading a spreadsheet of residents to a cloud AI tool is a data-sharing decision. Many municipalities have no rule about who may make it.

0No one; any staff member can upload municipal data to an outside service. 1Department heads decide informally; no record of what has been shared. 2A written rule names an approver but is not consistently followed or documented. 3A named role approves data sharing, agreements are on file, and departments follow the process. 4Approvals are documented, agreements are reviewed on a cycle, and the inventory of shared data is kept current.

DG6Gating question

Does the municipality have a written cybersecurity policy and an incident response plan that has been tested?

OSC audits of local governments consistently cite the absence of adopted IT security policies and untested incident response plans. NYS DHSES and the State and Local Cybersecurity Grant Program (SLCGP) expect both.

0No written cybersecurity policy and no incident response plan. 1Informal practices; the IT contact would improvise in an incident. 2A policy has been drafted or adopted, but there is no IR plan or it has never been exercised. 3Adopted policy and written IR plan; staff know their roles; the plan has been walked through at least once. 4Policy and IR plan are adopted, exercised at least annually, updated after each exercise, and reported to the board.

Staff, Policy & Skills

Whether staff use of AI is governed by written policy, supported by training, and owned by an accountable person with the capacity to act.

ST1Gating question

To what extent are staff already using generative AI tools (ChatGPT, Copilot, Gemini, etc.) in their work?

Score this on visibility and control, not on whether use is happening. Unknown or unmanaged use is the highest-risk condition.

0Unknown; leadership has no picture of whether or how staff use AI tools. 1Some staff are known to use personal accounts; no guidance has been given. 2Use has been surveyed or acknowledged and some verbal guidance issued; nothing written or enforced. 3Approved tools and accounts are identified; use is documented and follows written guidance. 4Use is inventoried, logged where feasible, reviewed periodically, and aligned to policy and training.

ST2Gating question

Has the governing board adopted a written AI acceptable-use policy?

A policy should name approved tools, prohibit entering confidential or restricted data, require human review of AI-drafted public material, and state that AI prompts and outputs may be public records.

0No AI policy of any kind. 1Informal verbal guidance from a department head or IT contact. 2A draft or interim policy exists but has not been adopted by the board or communicated to staff. 3Board-adopted AI acceptable-use policy, communicated to all staff, with an acknowledgment on file. 4Adopted policy reviewed annually, compliance checked, and updated as tools and law change.

ST3

Have staff received training on appropriate AI use, its limits, and the risks of sharing data with AI tools?

0No training has been offered. 1A few staff have learned on their own; nothing organized. 2A one-time briefing or memo was issued; no tracking of who received it. 3Structured training is delivered to all staff who use AI tools, with attendance recorded. 4Role-based training is required, refreshed annually, and tied to the cybersecurity awareness program.

ST4

Is there a named person accountable for the municipality's AI strategy and policy?

In a town or village this is often the Supervisor or Mayor, the Clerk, or an IT coordinator. The point is a single accountable owner, not a committee.

0No one is responsible for AI questions. 1Someone answers AI questions by default, without a formal assignment. 2A person has been designated but has no written charge, time, or authority. 3A named owner with a written charge coordinates AI policy, training, and vendor review. 4The owner reports to the board on a schedule, with defined goals and decision authority.

ST5

What in-house technical capacity does the municipality have to evaluate, configure, and support technology?

Includes staff IT, a BOCES or county IT arrangement, or a managed service provider under contract. Rate what you can actually call on.

0No IT support beyond a vendor's help desk or a volunteer. 1A part-time contractor or staff member handles break-fix issues only. 2A managed service provider or shared county service handles infrastructure; no capacity to evaluate new tools. 3Dedicated IT staff or an MSP with a defined scope can evaluate and configure new systems. 4IT capacity is planned, budgeted, and includes security and data-integration skills.

ST6

How would you describe the posture of staff and any bargaining units toward AI and automation?

Where CSEA, Teamsters, PBA, or other units represent staff, changes in duties from automation may be a mandatory subject of bargaining under the Taylor Law. Early engagement avoids stalled projects.

0Unknown or openly hostile; AI has not been discussed with staff or unions. 1Mixed and unmanaged; some enthusiasm, some fear, no engagement plan. 2Leadership has raised AI with staff or union representatives informally; concerns are not documented. 3Staff and union representatives have been consulted; concerns and commitments are documented. 4A standing engagement process exists; labor-management agreement on AI use is in place or in negotiation.

Vendor & Contract Controls

Whether AI arriving through existing vendors and new procurements is seen, evaluated, contractually controlled, and kept under human review.

VC1

Is the municipality aware of AI features that existing vendors have added to systems already in use?

Tyler, Laserfiche, Axon, Microsoft 365, Zoom, and Google Workspace have all added AI features that may be enabled by default or through a routine update, sometimes processing municipal data outside prior terms.

0No awareness; AI features may already be on without anyone knowing. 1Some staff have noticed AI features appear; no one has checked settings or terms. 2A partial review of major vendors has been done; findings are not documented. 3Vendor AI features are inventoried, settings are deliberately configured, and terms have been reviewed. 4Vendor AI features are tracked per system, reviewed at each release or renewal, and reported to the AI owner.

VC2Gating question

Do vendor contracts address whether the vendor may use municipal data to train or improve its AI models?

Absent a clause, many standard terms permit the vendor to use customer data for model improvement. Municipal data about residents should not leave the municipality's control this way.

0Contracts have never been reviewed for AI or model-training terms. 1Someone has read a vendor's terms once; no standard position. 2A preferred clause exists but has not been added to existing contracts. 3Model-training and data-use restrictions are in new contracts and the largest existing ones. 4All vendor contracts carry the restriction, and compliance is checked at renewal.

VC3

Does procurement include written criteria for evaluating AI-enabled products (accuracy, bias, explainability, data handling)?

General Municipal Law §104-b procurement policies can incorporate AI evaluation criteria without a new local law. NIST AI RMF provides a usable checklist.

0No criteria; AI products are bought like any other software. 1Evaluators raise AI concerns ad hoc when they think of them. 2A checklist exists but is applied inconsistently or only by one department. 3Written AI evaluation criteria are part of the procurement policy and used in every relevant purchase. 4Criteria are applied, scored, documented per purchase, and updated as standards such as NIST AI RMF evolve.

VC4

Does the municipality collect security attestations (SOC 2, NIST-aligned assessments, CJIS compliance) from vendors that hold its data?

0Never requested. 1Requested from one or two vendors, on request only. 2Requested at purchase for major systems; not tracked or renewed. 3Collected for every vendor holding sensitive data and tracked in a register. 4Collected, reviewed for findings, renewed annually, and tied to contract remedies.

VC5Gating question

Is human review required before any AI-influenced decision affects a resident (benefits, permits, enforcement, assessments, complaints)?

Decisions that affect a resident's rights, benefits, or obligations must remain with an accountable public official. NIST AI RMF and emerging NY state guidance both treat human review as a baseline control.

0No requirement; an AI or vendor system could affect a resident with no review. 1Staff generally review outputs, but nothing requires it. 2A written requirement exists for some systems; coverage and enforcement are inconsistent. 3Human review is required in policy for all resident-facing AI-influenced decisions and built into workflows. 4Review is required, logged, audited, and residents are told when AI informed a decision.

VC6

Are software contracts reviewed before renewal for changed terms, new AI features, and data handling?

0Renewals are paid without review. 1Renewals are reviewed for price only. 2Terms are reviewed occasionally, when someone notices a change. 3Every renewal gets a documented review of terms, features, and data handling before payment. 4A renewal calendar drives reviews; findings are recorded and escalated to the AI owner and attorney.

Automation Readiness & Capacity

Whether service delivery, records, and back-office work are digital and connected enough for AI to help, and whether the organization can fund and measure an initiative.

AU1

How are resident service requests (complaints, work orders, code issues) received and tracked?

0Phone calls and walk-ins with no log; requests are handled from memory or sticky notes. 1Requests are written down in a notebook or email inbox; no status tracking. 2A spreadsheet or basic system tracks requests in some departments; others use paper. 3A shared request system tracks intake, assignment, and closure across most departments. 4One system covers all departments, residents can check status, and response times are reported.

AU2

How much of the municipality's active recordkeeping is digital rather than paper?

Consider minutes, resolutions, permits, timesheets, purchase orders, and correspondence. Laserfiche and similar systems count only where they are actually the system of record.

0Almost entirely paper; digital copies are rare or scanned after the fact. 1Mostly paper with some departments keeping digital files on their own. 2Mixed; a document system is in place for some record series but paper remains the official copy. 3Mostly digital; a records system is the system of record for major series with defined naming and retention. 4Digital by default, with retention automated per LGS-1 and paper limited to legally required originals.

AU3

Do your core systems share data with each other, or do staff re-key the same information into multiple systems?

Common examples: payroll re-entered from timesheets, permit data re-keyed into assessment, receipts entered twice for the bank and the general ledger.

0Everything is re-keyed; systems do not connect. 1A few exports and imports are done by hand on a schedule. 2Some systems are connected; re-keying remains common in at least two workflows. 3Core financial, payroll, and records systems are integrated; re-keying is the exception. 4Integrations are documented, monitored, and reviewed when systems change.

AU4

How much back-office work (payroll, accounts payable, meeting packets, notices) is automated?

0None; all steps are manual. 1Individual staff have built personal shortcuts; nothing shared or documented. 2Some steps are automated in one or two processes; most remain manual. 3Routine back-office processes are automated end to end with documented procedures. 4Automation is measured, maintained, and extended based on time saved and error rates.

AU5

Has the municipality piloted or deployed any AI tool for a defined municipal use case?

Examples: meeting transcription and minute drafting, resident-facing chatbots, FOIL request triage, code-enforcement image review, or document classification.

0No pilots or deployments and none planned. 1Individuals have experimented informally; nothing sanctioned. 2A pilot has been discussed or scoped but not run, or was run without defined success criteria. 3At least one sanctioned pilot has run with defined success criteria and a documented result. 4AI tools are in production for one or more use cases, with review, monitoring, and a pipeline of evaluated next steps.

AU6

Does the municipality measure service outcomes (response times, backlog, error rates, resident satisfaction)?

0No measurement; performance is judged by complaints received. 1Counts are kept informally by some staff; not reported. 2Some metrics are compiled for the annual report or budget; not used to manage. 3Key metrics are defined, reported to the board regularly, and used to set priorities. 4Metrics are published, tracked against targets, and drive continuous improvement and technology decisions.

AU7

Could the municipality fund and staff a 12-month AI or automation initiative, including grant applications?

Relevant programs include NYS DHSES/SLCGP for cybersecurity, the NYS Local Government Efficiency program, and LGRMIF records-management grants. Capacity to write and administer a grant is part of readiness.

0No budget line, no grant experience, and no staff time available. 1Could absorb a small cost from contingency; no grant capacity. 2Has applied for grants before; a modest budget could be found with board approval. 3A budget line or grant match is identified, and a staff member or consultant can manage the application. 4Funding strategy is in the capital or operating plan, with grant administration experience and matching funds committed.

Notes (optional) Anything that would help us interpret your answers: recent audits, systems in use, upcoming contracts, staffing changes.

Please answer all 25 questions before submitting. Unanswered questions are highlighted.