|
September 2026
Artificial Intelligence: Two Conditions Before Allowing Use
POOL/PACT encourages member entities to put artificial intelligence to work. Used well, it returns time to staff, improves the consistency of written work, and makes analysis possible that a rural entity may not otherwise afford. The exposure is rarely the technology itself. It is deploying the technology before the entity has built the conditions that make its use governable. Two conditions should be satisfied before any employee uses AI for official entity business: the entity should be operating on a closed platform, and the entity should have adopted an AI Acceptable Use Policy (AI AUP) with documented training completed by every user. This report explains what each condition means, and addresses Nevada requirements, including one effective October 1, 2025 that reaches every emergency operations plan adopted by a state or local governmental agency.
Why This Matters Now
Adoption is already underway across many Nevada public entities, and it is frequently occurring without the knowledge or approval of the governing body, the information technology function, or risk management. Employees who are not given an approved tool tend to use an unapproved one on a personal account, which places entity information on a platform the entity does not control and cannot later retrieve. Meanwhile, AB 325 (2025), Chapter 123, Statutes of Nevada 2025, added new provisions to NRS Chapter 414 effective October 1, 2025. As codified at NRS 414.099, any state emergency management plan prepared pursuant to NRS 414.060, and each plan for emergency operations described in subparagraph (2) of paragraph (b) of subsection 4 of NRS 414.040 that is adopted by a state or local governmental agency, must include provisions ensuring that final decisions regarding emergency response planning and the allocation of resources in response to an emergency are not made by artificial intelligence but rather by a natural person. The definition adopted for that chapter, codified at NRS 414.0305, is broad. It reaches any machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments. Most tools a member entity is likely to deploy, including general purpose assistants and decision support software, fall within it. Separately, prompts and outputs generated in the course of entity business may constitute public records or evidence of governmental activity and should be managed accordingly. (Nevada Public Records Act, NRS Chapter 239). More is coming. On August 27, 2026, the Legislature’s Joint Interim Standing Committee on Government Affairs approved a bill draft request for 2027 legislation that would require state and local agencies to disclose their use of artificial intelligence and guard against bias in automated decision-making. An entity that already knows where it uses AI and has a working AI AUP will be positioned to comply; one that does not will be building both under a deadline.
Utlities
AB 325 also reached utility operations. Section 5 of the bill, codified at NRS 704.1833, prohibits a public utility from making a final decision regarding whether to reduce or shut down utility service in response to a disaster or emergency based solely on the use of artificial intelligence. A member entity that owns or operates a utility should confirm with entity counsel whether that operation falls within the definition of public utility in NRS 704.020 and NRS 704.021, and, if it does, should confirm that no automated load management, outage management, or service interruption system is positioned to make that decision without a natural person approving it.
Schools and Behavioral Health
AB 325 is not the only Nevada restriction. AB 406 (2025), Chapter 283, Statutes of Nevada 2025, effective July 1, 2025, is codified at NRS 391.297 and NRS 629.610. NRS 391.297 prohibits a public school from using artificial intelligence to perform the functions of a school counselor, school psychologist, or school social worker that relate to the mental health of pupils, while permitting administrative uses such as scheduling, records, and data analysis. NRS 629.610 bars a licensed provider of mental or behavioral health care from using an artificial intelligence system in providing care directly to a patient, with the same administrative carve-out. School districts, and members that employ licensed clinicians in behavioral health, public health, or detention settings, should confirm that no tool is positioned to perform those functions.
Condition One: A Closed Platform
A closed platform is one the entity controls by contract and by administration. It operates under an enterprise, government, or otherwise negotiated agreement rather than consumer click-through terms with the following minimum terms:
- The vendor is contractually barred from using entity inputs or outputs to train the underlying model.
- The entity knows where its data resides, how long it is retained, and who at the vendor is able to reach it.
- ·The entity can centrally provision and remove user accounts and enforce settings, rather than relying on individual employees to configure their own.
- The entity is able to produce a record of use if it is asked to.
A platform that fails any one of these is not closed, regardless of how the product is marketed or how familiar the brand is. The determination is made at procurement, by reading the agreement, and not by the employee at the moment of first use.
Condition Two: An Adopted Policy and Documented Training
A conforming policy does more than authorize AI. It should identify who approves tools and for what purposes, state plainly what categories of information may never be entered into a public AI tool, require disclosure when AI substantially assisted in producing an official work product, preserve human oversight so that AI is never the sole basis for a decision affecting individual rights or entity obligations, place the verification burden on the employee who uses the output, and address meeting assistants and transcription tools separately. It should also require a written inventory of approved uses. Each entry records the business need the use serves, the data it will touch, whether its output could be the principal basis for a decision affecting a person’s rights, benefits, safety, or employment, and the employee accountable for it. The inventory is what makes the human oversight requirement auditable, and it is what a governing body, an auditor, or the 2027 Legislature will ask to see. Training is critical. Documented training means each user completes it, the entity retains the completion record, and access follows training rather than preceding it. Training that is offered but not documented will not help the entity explain its program later. POOL/PACT has a model AI AUP available to member entities, with employee and supervisor acknowledgement forms.
What Member Entities Should Do
Prohibit Use of AI Until Conditions in Place
An entity should have a narrowly tailored policy prohibiting the use of AI for official business in the absence of an operational AI AUP. The prohibition should define the tools it covers, such as generative AI assistants, chatbots, and meeting or transcription tools that an employee accesses through an account or prompt, and should state how it treats AI features embedded in software the entity has already approved. A prohibition that borrows the broad NRS 414.0305 definition without that distinction will be violated on its first day and will not support discipline. Contact POOL/PACT for a copy of a model policy.
Confirm the platform before purchase. Have the agreement reviewed against the four minimum attributes above before a tool is acquired. Retrofitting a closed environment after deployment is considerably harder than specifying one at the outset, and entity legal counsel and POOL/PACT Risk Management can assist with that review.
Adopt a policy and document the training. Entities that have adopted a policy may wish to confirm that training records exist for every user with access, including elected officers, department heads, and temporary staff, and that the inventory of approved uses is current.
Review the emergency operations plan against AB 325. This is a discrete drafting task on a document the entity already maintains. Emergency management coordinators and entity counsel should confirm the plan contains required provisions, and entities may wish to take it up at the next scheduled plan review rather than waiting for a revision cycle.
Treat AI-assisted work product as a record. Prompts, outputs, and the resulting work product used or obtained in the course of conducting public business, should be retained and produced under the same retention schedule and public records practice that applies to any other entity work product.
Consider beginning with lower-sensitivity use cases. Entities new to AI may find that drafting, summarizing public documents, formatting, meeting preparation, and first-pass research deliver most of the available benefit while involving no protected information. Higher-sensitivity applications, including anything touching personnel records, law enforcement information, medical information, or investigative material, warrant a closed platform, legal counsel review, and a defined approval before they proceed. Appropriate policies still need to be in place, irrespective of the activity.
POOL/PACT Resources and Contact
POOL/PACT Risk Management can provide the model AI Acceptable Use Policy and acknowledgement forms, review vendor terms and platform agreements, and assist member entities with AI training and governance planning. For more information, please contact marshallsmith@poolpact.com or jarrodhickman@poolpact.com
| 
