ACCEPTABLE USE OF GenAI - 4986.12

Scope:

This Chapter of the GenAI Policy applies to all Executive Branch State Entities.

Policy:

1. An Executive Branch State Entity is responsible for educating and ensuring all users comply with its Acceptable Use Policy and data sharing agreements.
   
   
   1. GenAI must not be used for, or to create or generate:
      1. Illicit content.
      2. Content that is politically regulated, unlawful material, or information that lacks broad factual verification or consensus.
      3. Spoofs or fraud, including deepfake, impersonation, misinformation, phishing, or social engineering to harm individuals.
      4. Content that may interfere with the principles of Diversity, Equity, Inclusion, and Accessibility (DEIA) of individuals.
   2. All GenAI output used for decision making must be supplemented with human verification to ensure accuracy and factuality.
   3. All GenAI input and output data must be reviewed to ensure compliance with principles of DEIA and to prevent biases, misuse, and misinformation.
       
2. An Executive Branch State Entity’s Acceptable Use Policy must outline: (1) the risks associated with GenAI, (2) how to use GenAI safely and (3) additional GenAI requirements set forth below.
   
   
   1. Users only use state approved or provided accounts on state approved or provided equipment for state work.
   2. Users are prohibited from entering confidential, proprietary, and sensitive state data into commercially available GenAI.
   3. Users may employ GenAI to enhance the efficiency and effectiveness of public services.
   4. Users must review and verify GenAI output for relevance before use to ensure it aligns with its intended purpose and to mitigate risks such as hallucinations, misinformation and bias.
   5. Users must not infringe on any copyright or intellectual property laws and must comply with open-source licenses as applicable.
   6. Users must use the “opt-out” option on data collection and model training features that these GenAI might offer if available. (e.g. ChatGPT).
   7. Users waive all rights of ownership to GenAI outputs that are created on behalf of California and used for public related services to California.
   8. Users must not use state email or other state identifying information to register unsupported tools.
   9. Users must not label content created from GenAI as their own.
   10. Users must report the unauthorized use or disclosure of confidential, proprietary, and sensitive state data in GenAI to the Executive Branch State Entity’s Information Security Officer (ISO).

References:

EO N-12-23; GC 11546.7; GC 11549.63; GC 11549.64; GC 11549.65; GC 11549.66