Somebody in your organization is already using ChatGPT. Maybe it's a planner summarizing a long report, maybe it's someone in communications drafting a newsletter, maybe it's a clerk tidying up meeting minutes. This isn't a criticism. It's just what happens when a genuinely useful tool is free and sitting in every browser.
The problem is that in most municipalities we talk to, nobody has written down whether that's okay. So each staff member makes their own call, quietly, with no guidance on what's safe to paste into a chat window and what absolutely isn't. That's the actual risk. Not the tool, the silence around it.
Why this is different for local government
A private company that gets this wrong has an embarrassing incident. A municipality that gets it wrong has a privacy breach involving residents' personal information, and in most Canadian provinces that lands under legislation like Alberta's Freedom of Information and Protection of Privacy Act, usually shortened to FOIP. Resident data, bylaw complaints, permit applications, HR matters. When that kind of information goes into a public AI tool, you've potentially disclosed it to a third party outside your custody and control, and you may never get it back.
There's also the records question. Municipal work is public work, and drafts, decisions and correspondence can be subject to access requests. If AI is helping produce documents and nobody has thought about how that fits your records management practices, you're building a gap you'll discover at the worst time.
And then there's trust. Residents extend a lot of it to their local government. One sloppy AI-generated response that gets a bylaw wrong, or a council report with an invented citation, spends that trust fast.
A ban isn't a policy
Some organizations respond by blocking the tools entirely. In practice this just moves the usage to personal phones, where you have even less visibility. The productivity pull is real, and pretending otherwise doesn't help anyone.
What works better is a short, plain-language answer to three questions. What are staff allowed to use AI for? Drafting, summarizing public documents and brainstorming are usually safe territory. What must never go into a public AI tool? Personal information about residents or staff, anything confidential, anything covered by privacy legislation. And who checks the output before it goes anywhere? A human, always, with their name on it.
That's genuinely most of it. A page or two that staff can actually read, a bit of training so they understand the why, and a named person to ask when something feels unclear. From there you can grow into approved tools, procurement language and regular reviews as your use matures.
The municipalities handling this well aren't the ones with the biggest IT budgets. They're the ones that answered the question on paper before an incident answered it for them.