CHA Artificial Intelligence Acceptable Use Policy

The CHA Artificial Intelligence Acceptable Use Policy is available for download by clicking here.

1. Purpose

This policy outlines the acceptable use of artificial intelligence (A.I.) technologies within the
Cambridge Housing Authority. It aims to ensure ethical, responsible, and lawful use of A.I. tools.
This policy is intended to balance the potential uses of A.I. against Cambridge Housing Authority’s interests in protecting the private and personal data of our applications, residents, voucher participants, and employees, as well as the preservation of jobs, and the safeguarding of our natural environment (as A.I. poses considerable demands on electric infrastructure and freshwater usage).

This policy provides employees with guidelines for appropriate, responsible use of A.I. tools while protecting the business and mitigating the risk of misuse, unethical outcomes, potential biases, inaccuracy, and information security breaches.

This policy is not intended to restrict communications or actions protected or required by state or federal law. Nothing in this policy shall prevent employees from saying or doing things that the law says they are allowed to do or must do.

Nothing in this policy shall be construed to conflict with, supersede, or otherwise alter any rights, obligations, or provisions established under the applicable collective bargaining agreements. In the event of any inconsistency between this Policy and the collective bargaining agreement, the terms of the applicable collective bargaining agreement shall govern.

2. Scope

This policy applies to:

  • All components of Cambridge Housing Authority, herein referred to as “CHA” , including all
    subsidiaries and affiliated non-profits.
  • All customers (including other housing programs using CHA systems), clients, employees,
    advisors, agents of the CHA, and all authorized third parties that require use of and are
    granted access to CHA computer and information resources.

3. Definitions

“Artificial Intelligence,” or “A.I. ” as used in this policy, is a machine-based system that can, for a
given set of human objectives, make predictions, recommendations, or decisions.

“Generative Artificial Intelligence” (“Generative A.I. ”) is a type of artificial intelligence technology
that can generate many forms of content including but not limited to texts, images, and multimedia.

“A.I. Tools” means any data system, software, hardware, application, tool, or utility that operates in
whole or in part using A.I., including Generative A.I.

4. Principles

Compliance with Related Policies and Agreements: Any use of A.I. Tools under this Policy must comply with the relevant policies, internal controls, and guidelines of CHA, including, but not limited to:

  • IT Handbook
  • IT Acceptable Use Policy
  • A.I. Acceptable Use Policy
  • Conflict of Interest Law
  • Privacy Act Notice
  • Anti-Harassment/Anti-Discrimination Policy
  • Written Information and Security Plan

Accountability: Users of A.I. tools are responsible for ensuring compliance with this policy
and are accountable for the performance, accuracy, and impact of any A.I.-assisted work.
All content created or informed by A.I. must be reviewed and validated by the user for
accuracy and reliability. A.I. tools may be used to enhance productivity, decision-making,
and innovation; however, they must not replace the user’s professional judgment, oversight,
or accountability. A.I. may assist by generating information or suggestions, but users must
interpret results within context and remain responsible for all outcomes.

Transparency: Use of A.I. Tools should be transparent, with clear documentation on their
purpose, capabilities, and limitations. Transparent is defined as open and clear in
communication about when, how, and why A.I. tools are being used, as per CHA’s A.I.
policy. Compliance with this policy accomplishes this principle of transparency. A copy of
this policy will be posted on the CHA website to serve as CHA’s method of transparency.

Fairness: A.I. Tools should be used fairly and should not discriminate against anyone.
Because A.I. systems can sometimes reflect bias from the data or the way they are built,
users should be aware of these risks and take steps to reduce unfair or unequal outcomes,
as described in the Acceptable Use Guidelines below.

5. Request and Approval Process

Only trained, authorized employees may use approved A.I. tools. Employees wishing to use A.I. tools must submit a written request to their Department Head specifying:

  • The type of A.I. tool requested; and what the employee intends to use the A.I. tool for, including how it supports a specific business need or helps resolve an identified challenge or problem.
  • IT must review each request to ensure the proposed tool:
    • Can be securely managed and protected from unauthorized access or misuse.
    • Requires a login or other secure method of access.
    • Meets IT security standards, including that the subscription level allows for opt-out of model training and that it is a private instance of the A.I., not a public A.I.
  • Department Heads must approve or deny requests in writing. Approvals may be revoked at any time. Requests denied by IT may be elevated by the Department Head for further review and approval by the Executive Director. Requests denied by the Department Head are not subject to further review.

6. Acceptable Use Guidelines

  • Upon approval, employees may only use a work account (not a personal account) with a subscription-based license that is assigned by CHA’s IT department.
  • Use of A.I. Tools must comply with data protection laws and respect user privacy, including but not limited to:
    • The Privacy Act of 1974
    • 760 CMR 8
    • MGL c. 66A
    • 201 CMR 17.00
    • HUD Handbook 2400.25 Rev 4 (Privacy Protection Guidance)
  • Employees are expected to verify results generated by an A.I. tool before acting on them, and report any potential legal, ethical, or policy concerns to a supervisor.
  • Programming / Coding: A.I. tools are permitted to aid in programming and coding, providing a human code review is performed before deployment. Checks to ensure security, reliability, and integrity of the code need to be performed by a qualified human before A.I.- generated code is deployed or used in or with CHA systems.

7. Prohibited Use of A.I. Tools

The following uses are prohibited:

  • Entering any company, employee, resident, participant, applicant, or third-party confidential, trade secret, or other personal or proprietary information into a prompt for any A.I. tool, regardless of any incognito or privacy function that the A.I. tool promotes.

    Examples may include but are not limited to:
    • Name
    • Date of Birth
    • Social Security Number
    • Phone Number
    • Addresses – including building and unit numbers
    • Driver License Numbers
    • Any unique identifiers tied to a resident/participant/applicant’s file or household
    • Health or disability-related information
    • Financial information
  • Using A.I. tools to make decisions about resident/participant/applicant eligibility, compliance, or enforcement.
  • Copying and pasting A.I.-generated reports or correspondence without verifying facts or causing misinformation or errors in official communications.
  • Using A.I. to fabricate progress reports, meeting notes, or time-tracking data to mislead supervisors about completed work.
  • Using A.I. tools to automate work tasks, such as communication with residents. Automation is defined as: A task or action which occurs without any human intervention, participation, oversight, or review.
  • Engaging in unlawful activities or violating human or civil rights.
  • Deploying A.I. tools that result in biased or discriminatory outcomes.
  • Deploying unapproved chatbots, scripts, or automation that send unnecessary messages, alter shared documents, or flood communication channels.
  • Collecting data without consent.
  • Connecting a third-party A.I. tool to internal systems without IT approval or otherwise create security or data privacy risks that impact team operations.

The following scenarios are offered as some examples of acceptable and prohibited uses of A.I.
tools at CHA:

8. Implementation and Monitoring

  • Regular audits and assessments of CHA’s approved A.I. tools and their use to ensure compliance with this policy.
  • Access to approved A.I. tools must be administered by the CHA IT department. Access will only be granted to approved CHA A.I. tools, as listed in appendix A of this document. Access will only be granted after users have received approval from their department manager and completed A.I. Use Training.
  • Training programs for users to understand ethical A.I. use and potential risks.

CHA recognizes that an informed workforce is the safest and most capable workforce. Therefore, training resources will be provided to help employees understand their obligations under this Policy and avoid creating undue risks.

Employees must complete A.I. Use Training within 3 months of initial hire. All employees must complete the training on an annual basis. Department Heads must ensure their staff complete the required training.

CHA may deem failure to participate in required A.I. Use Training as a violation of this Policy. CHA will retain attendance records and copies of A.I. training materials provided to employees.

Department Heads will monitor for the following potential indicators of A.I. misuse:

  • Sudden, repeated use of external A.I. tools from non-approved accounts
  • Unexplained changes in output quality or sudden mistakes in work products
  • Large or unusual file uploads to third-party sites
  • An employee repeatedly asking for access to privileged data with unclear
    justification
  • Spike in communications with unusual tone/language or rapid-fire messaging
    across platforms

9. Reporting and Enforcement

Employees must report any misuse or unethical use of A.I. technologies to their supervisor and the IT department.

Violations of this policy may result in disciplinary action, up to and including termination.

10. Review and Updates
This policy will be reviewed annually and updated as necessary to reflect changes in technology and regulations.

Appendix A
CHA Approved A.I. Platforms

Departments have two flavors of Microsoft Copilot to choose from. Regardless of flavor, users must sign in to Copilot to be in compliance with this policy. This is because there is also a free, public version of Copilot that should not be used by CHA staff. If users do not sign in, they are effectively using the public version of Copilot. CHA IT has worked to automate this process as much as possible, but users still need to ensure they’re signed in when using this tool.

Flavor 1: Bundled
This version comes with CHA’s Microsoft E3 license. It performs general chat, search, and analysis
functions with basic image generation abilities and is grounded in web-trained data. For most
users, this will meet their needs.

Flavor 2: M365
This version is an add-on to CHA’s Microsoft E3 license. It performs the same functions as flavor 1,
but it uses advanced models to do so. It also integrates across Microsoft products, like Word, Excel, PowerPoint, etc. and can search across your CHA data.