Your ChatGPT prompts are public records. Here is the retention schedule and the policy that keeps you clean.

WHAT YOU NEED TO HAVE READY

• An AI use policy that fits on a staff report
• A records-retention line covering prompts and outputs
• The procurement file: under the threshold, a cooperative contract, or a sole-source justification
• Who reviewed the AI output, for the auditor
• An enterprise-account-only rule for student and resident data

WHO WILL ASK FOR IT

• County counsel or the city attorney
• The clerk, as custodian of records
• The auditor
• The council or board
• A resident at the podium

What you hold

• Resident and student records
• Public records and correspondence
• Procurement and contract files
• Employee and payroll data
• Meeting records and public comments

What keeps you up at night

• AI outputs that become public records nobody planned for
• Procurement rules and data-residency requirements vendors don't mention
• Employee decisions informed by AI under new state rules
• A meeting-notes bot in closed session
• A constituent chat assistant that answers confidently and wrongly
• A vendor that isn't here in three years

The standard we work to

• Data that names a person stays inside your environment
• A person approves anything that touches a person, a record or a dollar
• Every AI use disclosed in plain language to the people it affects
• Aligned to NIST AI RMF and designed to ISO/IEC 42001 structure; threat-modeled to OWASP and MITRE ATLAS
• You own what we build and can leave with it