Municipal AI adoption: a practical plan for the first 90 days

Choose a task that leadership can evaluate

An AI proposal is easier to assess when it names a specific job: sort incoming service requests, draft a response from approved public information, or extract fields from a document for staff to verify. Each example has an input, an output, and a person who can judge whether the work was useful.

The first 90 days should produce a decision about a limited use case and a repeatable approval process. The schedule below is an Altioras Civic planning recommendation. A complex or higher-consequence workflow may need a longer assessment before any live use.

Days 1 through 30: select the work and establish the rules

Ask departments where staff repeatedly search, re-enter, summarize, or route information. Select a task with available examples and a willing owner. Check whether a process improvement or an existing system feature can solve it at lower cost.

Write down the current steps, staff time, common errors, and backlog. Identify who could be affected by a wrong answer. For an initial pilot, we recommend a staff-reviewed task that does not determine eligibility, hiring outcomes, enforcement action, or access to an essential service.

Set approval rules before staff upload records. Name permitted tools and data, prohibited uses, review responsibilities, records handling, and escalation contacts. Procurement, privacy, security, records, and accessibility staff should assess the requirements that apply to the selected workflow.

• Name a department owner and a reviewer who understands the task.
• Document where information will be stored and whether the supplier can use it for model training.
• Define what the tool may read, produce, or change.
• Specify how staff stop the pilot and continue the work manually.

Use a risk framework to organize the review

NIST's voluntary AI Risk Management Framework provides a useful structure for governance and risk assessment. Its functions address governing the work, mapping its context, measuring risks, and managing them. The companion Generative AI Profile addresses risks specific to generative systems.

For a municipality, apply those principles to the actual task. Record what information is used, which outputs require verification, how incorrect results are detected, and who decides whether the tool may continue. A framework does not replace applicable law, agency policy, or a review of the supplier's terms.

Sources: NIST — AI Risk Management Framework; NIST — Generative Artificial Intelligence Profile

Days 31 through 60: test normal work and difficult cases

Build a test set from approved examples that represent the work. Include incomplete requests, conflicting information, unusual formats, and cases that should be escalated. Keep a portion of the examples separate from development so the team can assess performance on material it has not tuned against.

If the pilot drafts answers, require reviewers to compare them with approved source material. If it extracts fields, compare those fields with the documents. Treat instructions embedded in submitted documents as untrusted content; they should not change the tool's permissions or approved task.

Record output quality, omissions, incorrect answers, reviewer corrections, and total staff effort. A quick draft may still require substantial checking. Measure the whole process through the point where the result is safe to use.

Days 61 through 90: decide whether to expand

Compare the pilot with the baseline using the same task mix. Count tool charges, setup effort, staff review, corrections, and ongoing administration. A useful result may be faster routing, less re-entry, or a shorter backlog; it needs an agreed measure and acceptable error handling.

Recommend expansion, revision, or stopping. Expansion should name the additional users or task volume, retained review requirements, support owner, and next review date. Changing the data, public exposure, or actions the tool can take requires a fresh assessment.

• Confirm staff can identify and correct errors before output is used.
• Check whether unusual cases reach the correct person.
• Document the measured benefit and the cost of maintaining it.
• Retain an approved operating procedure and a practical way to disable the tool.

What the city manager or CIO should receive

The final briefing should fit the decision: the task, the baseline, what was tested, the results, unresolved concerns, costs, and the proposed next step. Attach the approval record and operating instructions.

A successful first cycle leaves the agency with both a useful finding about the task and a consistent way to review the next AI proposal.