Corporate Use of Artificial Intelligence Policy

Policy number: 2025-04

Effective date: May 26, 2025

Last revision date: May 26, 2025

On this page

1. Definitions
2. Policy Statement
3. Purpose
4. Scope
5. Principles
6. Roles and Responsibilities
7. Appendix A: Artificial Intelligence Systems - Unacceptable Uses

1. Definitions

“Artificial Intelligence Systems” (AI systems) means machine-based systems that, for explicit or implicit objectives, infer from the input they receive in order to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

“Bill 194” means the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024:  an Act to enact the Enhancing Digital Security and Trust Act, 2024 and to make amendments to the Freedom of Information and Protection of Privacy Act respecting privacy protection measures.

“Data” means Information collected, processed, or stored by AI systems, which can include structured data (e.g., databases), semi-structured data (e.g., XML files), and unstructured data (e.g., text, images, audio).

“Haldimand” means the Corporation of Haldimand County.

“Information Practices” means the practices and procedures of Haldimand for actions in relation to personal information, including

1. when, how and the purposes for which Haldimand collects, uses, modifies, discloses, retains or disposes of personal information, and
2. the administrative, technical and physical safeguards and practices that Haldimand maintains with respect to protecting the information.

“MFIPPA” means the Municipal Freedom of Information and Protection of Privacy Act.

“Personal Information” means recorded information about an identifiable individual, including:

1. information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual;
2. information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved;
3. any identifying number, symbol or other particular assigned to the individual;
4. the address, telephone number, fingerprints or blood type of the individual;
5. the personal opinions or views of the individual except if they relate to another individual;
6. correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence;
7. the views or opinions of another individual about the individual; and
8. the individual's name if it appears with other personal information relating to the individual or where disclosure of the name would reveal other personal information about the individual.

“PHIPA” means the Personal Health Information Protection Act.

2. Policy Statement

As the use of Artificial Intelligence Systems (AI systems) within our suite of Municipal technology solutions has increased exponentially, it has been recognized that policy and practices which define how, when, and when not to use AI are required within the Corporation of Haldimand County (Haldimand). Additionally, which kinds of data can and/or should be shared and which need to be safeguarded.

3. Purpose

The purpose of this policy is to establish clear guidelines for the responsible and ethical use of Artificial Intelligence (AI) systems within Haldimand’s municipal technology solutions. This policy aims to define appropriate use cases, limitations, and governance frameworks for AI deployment while ensuring compliance with relevant laws and regulations. Additionally, it provides direction on data management, specifying which types of data can be shared and which must be safeguarded to protect privacy, security, and public trust. 

4. Scope

This policy applies to all Members of Council, Members of all Boards and Committees, Volunteers, and all Employees of Haldimand County including full-time, part-time, casual, unionized, non-unionized, and Library staff.

Section 5.1 lays out the Foundational Principles for the Usage of AI systems at Haldimand County.

Appendix A – Artificial Intelligence Unacceptable Uses lays out areas of County business which, due to the inherent risk, political sensitivity, or regulatory restrictions, that Haldimand explicitly restricts the use of AI systems.

This policy is in alignment with Bill 194.

This policy is in alignment with the recommendations put forth by the Canadian Centre for Cyber Security (the Cyber Centre) and the Government of Canada’s “Government in a digital age” initiatives.

This policy is in alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 1.1.

5. Principles

Haldimand County acknowledges that AI systems have been used for many years in the greater Public Sector and that these systems can be used to great positive effect when leveraged appropriately under the direct supervision of knowledgeable and qualified members of staff. This policy aims to provide fundamental principles for the use of AI systems at Haldimand. These principles apply to the actions of those individuals defined in the policy scope during the course of their work, whether or not the systems utilized are officially sanctioned by Haldimand.

Foundational Principles for the Usage of AI Systems at Haldimand County

Artificial Intelligence Systems shall never be an exclusive decision maker without prior human approval.

Haldimand sees value in using AI systems to gather, quantify, and summarize data to support human decision makers across a variety of context areas (See Appendix A - Artificial Intelligence Unacceptable Uses). AI systems may be used to present options or paths that lead to decision making.  AI systems may also be granted a narrow band of allowable decision making by humans accountable for the respective solution. However, under no circumstances shall AI systems be the exclusive decision maker in any context areas at Haldimand without prior human approval.

A human must always maintain accountability and responsibility for any decision.

Haldimand recognizes that the use of AI systems poses the risk of diffusing direct responsibility. An AI system cannot be held accountable, thus it cannot be responsible for any decisions it makes. As in Principle 5.1, AI systems can inform decision making but the accountability and responsibility for the decision-making process remains with the humans making the decisions.

Critical facts used for decision making must be validated for accuracy using multiple sources.

AI systems have been known to “hallucinate” and state perceived patterns as fact when they are not. To make critical decisions effectively, the sources and validity of data used to make those decisions must be confirmed. Haldimand expects that, any time AI systems are used to inform decision making, the accuracy of the data used is validated by humans during the decision-making process. 

Municipal legislation and practices surrounding data handling and data ownership still apply to the use of AI systems.

Data entered into any AI systems, either internal or external to Haldimand, requires care to ensure proper data-handling legislation and practices are followed. In particular, extra care must be paid to ensure that personal information is not entered into AI systems unless Haldimand County authorized pre-existing data handling agreements allow for it. If in doubt regarding what is allowable, data must not be entered into AI systems and guidance should be sought from the Municipal Clerk.

6. Roles and Responsibilities

This policy will initially be communicated to all staff, via email, from their relevant manager. Future communications to new employees will be done via the established Human Resources on-boarding processes.

This policy will be posted to the intranet. Further, in compliance with Bill 194, this policy and its related Appendices will be posted to Haldimand’s public website.

Upon adoption of this Policy all users, as defined in the policy Scope, will be required to comply based on the tenets set out in this Policy.

Innovation & Technology Services will audit user compliance with this Policy and report breaches to the Information Technology Governance Committee and to the Information & Privacy Coordinator.

Violations of this policy will be referred to senior management and may result in disciplinary action. Employees must adhere to all relevant legislation, including MFIPPA and PHIPA.

This policy should be read alongside the Information Technology Acceptable Usage Policy, applicable collective agreements or policies governing non-union employees, various health and safety policies and guidelines, relevant and applicable legislation, and any other policy that may become applicable and/or relevant.