Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBefore your city buys or launches an AI tool, assess the specific task, people affected, data involved, possible harms, safeguards, and vendor terms—and record a decision to proceed, change the use, pilot it, restrict it, or stop. Start before procurement and revisit the assessment during operation. NIST’s AI Risk Management Framework (AI RMF) offers voluntary, use-case-agnostic guidance, but it does not replace legal review of the rules that apply in your jurisdiction.
Start with the use case, not the product
Assess the proposed use in its real service context. A tool that drafts internal summaries raises different questions from one that recommends eligibility, prioritizes inspections, or communicates directly with residents. The relevant risks depend on what the system does, who relies on it, and what happens when it is wrong or unavailable.
As an Amazon Associate I earn from qualifying purchases.
- Service problem and intended benefit: What public need is the city trying to address, and what measurable improvement would justify using AI?
- Task and decision: Is the system generating, summarizing, classifying, recommending, or making a decision? What role will its output play?
- People affected: Identify residents, staff, contractors, and other groups who may use, depend on, or be affected by the system.
- System boundaries: Map the model, third-party services, integrations, data flows, and human workflow—not just the vendor-facing product name.
- Failure and fallback: What happens if the system is unavailable, produces a plausible but incorrect answer, or is used outside its intended purpose?
NIST’s AI Risk Management Framework, released January 26, 2023 and currently under revision, treats risk management as a lifecycle activity. Its Playbook is guidance rather than a mandatory recipe: NIST says it is “neither a checklist nor set of steps to be followed in its entirety.” Use the framework to organize judgment, not to claim that completing a form guarantees safety or compliance.
Set ownership and review gates before procurement
Name one accountable business owner for the service and identify the officials who need to review the proposal. Depending on the use, that may include technology, procurement, privacy, security, legal, accessibility, records management, and equity staff. Give reviewers a clear point in the process to raise concerns before commitments are made.
#1 Best Overall
Portland provides a municipal example: its AI use and governance policy requires a requestor to submit a business case for an initial risk assessment before starting procurement. The city coordinates privacy, equity, and surveillance reviews as applicable. That is Portland’s approach, not a universal requirement for every city; check your own procurement policy and applicable law.
Because no single jurisdiction’s rules apply to every city, ask local legal, privacy, security, procurement, accessibility, and records officials which obligations attach to the proposed use. For example, Canadian federal guidance says institutions should consult privacy officials to determine whether a Privacy Impact Assessment is required; that guidance does not establish a universal rule for municipal governments elsewhere.
Map data, people, and plausible harms
Trace information from collection to deletion. Record what the city enters, what the system infers or generates, where data is processed, who can access it, how long the vendor retains it, and whether it may be reused for training, fine-tuning, evaluation, or product improvement. Include connected services and subcontractors in the map.
For generative AI and other third-party systems, the NIST Generative AI Profile, published July 26, 2024, calls attention to privacy, information security, third-party transparency, and impact assessment. Translate those concerns into concrete questions about the service and its contract rather than assuming that a vendor’s general assurances answer them.
Consider how the system could fail or be misused, and who would bear the consequences. Relevant concerns include inaccurate outputs, unequal performance or effects across groups, privacy loss, security incidents, opaque recommendations, overreliance by staff, and later repurposing for a different task. NIST identifies validity and reliability, safety, security and resilience, accountability and transparency, explainability and interpretability, privacy, and fairness with harmful bias managed as trustworthiness characteristics in its AI RMF FAQs.
Rate consequences and design safeguards
For each material harm, ask who could be affected, how severe it could be, how many people might be exposed, and whether the harm could be reversed. Heightened scrutiny is appropriate when AI influences rights, health, safety, access to public services, or financial outcomes. A human reviewer is not an effective safeguard if they lack the time, information, authority, or training to challenge the system.
Specify what residents and staff can do when an output appears wrong: reach a person, request review, contest an outcome, or report a problem. Portland’s policy flags consequential decisions made without an appropriate level of human review as a concern. The right level of review depends on the use and consequences; document who is responsible and what they are empowered to change.
Recommended Free Tools
Test the actual system before launch
Do not rely only on a vendor demonstration or generic accuracy claim. Build test scenarios that reflect the city’s task, data, users, and operating conditions. Include edge cases and foreseeable misuse, and examine results across relevant groups and circumstances.
- Check whether outputs are correct, useful, and appropriately qualified for the task.
- Probe likely failure modes, including missing, ambiguous, outdated, or unusual inputs.
- Evaluate privacy and security protections in the intended configuration and workflow.
- Look for meaningful differences in performance or downstream effects across relevant groups.
- Test whether staff can recognize errors, override outputs, and use the fallback process.
Document test methods, data and scenarios, limitations, results, and who reviewed them. NIST’s Generative AI Profile recommends iterative, documented testing, evaluation, validation, and verification early in the lifecycle. Testing is evidence about a defined system and use; it is not proof that all future outcomes will be safe.
Make procurement terms answer the risk questions
Ask suppliers for technical documentation that explains data handling, model behavior, limitations, and any adaptive or learning components. Portland’s policy requires a hosted-service questionnaire and AI-specific vendor disclosures, including whether city data is used for training or improvement. NIST also describes acquisition due diligence and service-level or assurance documentation as possible third-party controls.
Put the city’s requirements into contract language where appropriate. Address permitted uses, retention and deletion, incident notification, access for audits or evaluations, notice of material system changes, subcontractors, and the division of responsibilities. The city should understand how it can obtain records needed for oversight and how it can stop using the service or transition away from it.
Compare alternatives on more than model performance
If several tools or deployment designs could serve the same purpose, compare them against the same criteria. A less capable but more controllable design, or a non-AI process, may be preferable when the expected public benefit is small relative to the consequences or oversight burden.
| Comparison criterion | Questions for the city |
|---|---|
| Public benefit and task fit | Does this option address the service problem, and is AI needed for the task? |
| Potential harm | How severe, widespread, and reversible could adverse outcomes be? |
| Data and privacy | How sensitive is the information, how long is it retained, and can the vendor reuse it? |
| Reliability | Has performance been tested under relevant conditions and across affected groups? |
| Transparency and auditability | Can the city understand, inspect, and evaluate the system and its changes? |
| Human review and recourse | Can staff meaningfully intervene, and can residents challenge or report outcomes? |
| Operational sustainability | Can the city support the tool, manage vendor dependence, cover lifecycle costs, and exit if needed? |
These criteria are a practical decision aid, not a NIST scoring scheme. Record trade-offs rather than collapsing unlike risks into a single score that conceals who may be harmed.
Record the decision and conditions for use
An assessment should lead to an explicit decision, not just a completed worksheet. NIST’s Playbook describes impact assessments as a way to document impacts and support oversight, with assessments repeated as goals and outcomes evolve. A city’s decision record should capture:
- the intended use, expected public benefit, and alternatives considered;
- the people and data involved, material impacts, and evidence from testing;
- residual risks, safeguards, and limits on use;
- the accountable owner, reviewers, and approval conditions; and
- why the city chose to proceed, modify, restrict, pilot, redesign, or reject the proposal.
A limited pilot can help answer unresolved questions, but it still needs a defined scope, safeguards, monitoring, and a decision point before expansion. If essential protections or evidence are missing, defer procurement or do not deploy until the gap is addressed.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteMonitor in operation and reassess after change
Set measures and thresholds that reflect the use, such as errors, complaints, incidents, changed vendor behavior, drift, or disparate outcomes. Assign a named owner who can pause or roll back use when a threshold is crossed or a serious problem appears. Establish how concerns reach that owner and how affected residents are informed or assisted where appropriate.
Revisit the assessment when the model, data, purpose, integration, workflow, or affected population changes materially. This monitoring approach applies NIST’s lifecycle perspective and iterative testing recommendations; it is a practical city governance approach, not a verbatim mandatory NIST checklist.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
