AI Acceptable Use & Governance Policy - Florida

AI ACCEPTABLE USE & GOVERNANCE POLICY

1. Purpose

This Policy establishes the principles, responsibilities, and controls for responsible use of artificial intelligence ("AI") and machine learning ("ML") technologies by [ORGANIZATION NAME].

2. Scope

This Policy applies to all employees, contractors, vendors, and partners who develop, deploy, procure, or interact with AI Systems on behalf of [ORGANIZATION NAME].

3. Definitions

• AI System: Software that uses machine learning, statistical techniques, or logic-based approaches to generate outputs such as predictions, recommendations, or decisions.
• High-Risk AI: An internal risk tier for systems that may materially affect individuals, safety, finances, access, or organizational obligations. This label does not assert that Florida law uses the same classification.
• GPAI: General-purpose AI models or foundational models with broad applicability.
• Human-in-the-Loop: A control requiring human review or intervention before an AI output is acted upon.

4. Governance Structure

4.1 AI Steering Committee. [ORGANIZATION NAME] maintains an AI Steering Committee responsible for approving AI initiatives, monitoring compliance, and reporting to executive leadership.
4.2 AI Product Owner. Each AI System has an owner accountable for lifecycle management, documentation, and performance monitoring.
4.3 Risk & Compliance. The Legal/Compliance team conducts impact assessments, ensures regulatory alignment, and maintains the AI inventory.
4.4 Technical Leads. Engineering/Data Science teams implement controls, testing, and monitoring.

5. Acceptable Use Principles

• Lawful & Ethical Use: AI Systems must comply with applicable laws, contractual commitments, and ethical guidelines.
• Purpose Limitation: Use AI only for approved purposes documented in the AI inventory.
• Transparency: Provide meaningful information about AI involvement to affected individuals when required.
• Human Oversight: Maintain appropriate human review based on risk tier.
• Fairness & Non-Discrimination: Conduct bias testing and mitigation for High-Risk AI.
• Security & Privacy: Protect Personal Data and sensitive business information throughout the AI lifecycle.
• Accountability: Assign clear ownership and escalation paths for issues.

6. Prohibited Uses

As an internal risk-control choice, the organization prohibits the following uses unless the AI Steering Committee and Legal/Compliance approve a documented, lawful exception:

• Real-time biometric identification in public spaces.
• Emotion recognition or inference from sensitive data without explicit approval.
• Automated decision-making that materially affects employment, credit, housing, or healthcare without documented assessments.
• Generation or dissemination of deceptive or misleading content (deepfakes) without disclosure.
• Training models on unlawfully obtained or non-compliant datasets.

7. AI Lifecycle Controls

7.1 Ideation & Intake. Submit AI projects through the intake process, including purpose, data sources, and expected outputs.
7.2 Risk Classification. Assign each AI System a risk tier (Minimal, Limited, High) with required controls per Appendix A.
7.3 Impact Assessments. Conduct an internal AI Impact Assessment before deploying High-Risk AI. If the organization is an FDBR controller, the assessment must also cover each processing activity listed in Fla. Stat. § 501.713, including covered profiling and processing that presents a heightened risk of consumer harm.
7.4 Testing & Validation. Perform pre-deployment testing, including accuracy, robustness, bias, and cybersecurity assessments.
7.5 Deployment & Monitoring. Monitor performance metrics, drift, and incident reports. Maintain logs for audit.
7.6 Change Management. Reassess risk when models are retrained, fine-tuned, or when data sources change.
7.7 Decommissioning. Document steps for retiring AI Systems, including data retention and access controls.

8. Data Management & Privacy

• Determine and document whether the FDBR, FIPA, another state privacy law, or sector-specific law applies to each use case.
• Apply data minimization, deidentification, anonymization, or pseudonymization as appropriate. For an FDBR controller, § 501.71 requires collection to be adequate, relevant, and reasonably necessary for disclosed purposes.
• For an FDBR controller, implement the applicable consumer rights and opt-outs under § 501.705 and obtain consent before processing sensitive data as § 501.71(2)(d) requires.
• Coordinate with the Data Protection Officer for cross-border transfers.

9. Vendor & Third-Party Management

• Perform due diligence on third-party AI vendors, including security reviews and contractual safeguards.
• Require vendors to provide documentation on model training data, testing, and compliance.
• Include audit and termination rights in vendor agreements.

10. Incident Response & Reporting

• Report AI incidents, such as model failures, bias findings, or security events, within [HOURS] hours to the AI Steering Committee and Security Team. This internal deadline must be short enough to support all applicable statutory clocks.
• Investigate incidents, implement corrective actions, and document lessons learned.
• Apply FIPA's incident gates when electronic data containing covered personal information is involved: third-party agents notify the covered entity no later than 10 days after determining or having reason to believe a breach occurred; covered entities generally notify affected Florida individuals no later than 30 days after that determination; and notice to the Department of Legal Affairs is required for breaches affecting 500 or more Florida individuals. See § 501.171(3), (4), and (6).

11. Training & Awareness

• Provide annual training on responsible AI use to all relevant personnel.
• Offer specialized training for developers, product owners, and compliance reviewers.
• Maintain records of training completion.

12. Policy Violations

Violations of this Policy may result in disciplinary action up to and including termination of employment or contracts. Serious violations may be referred to regulatory authorities.

13. Review & Updates

The AI Steering Committee will review this Policy at least annually, or upon significant regulatory changes, technology updates, or incidents.

14. Regulatory Change Tracking

• Maintain a jurisdiction and use-case register identifying each law actually applicable to an AI System.
• Record effective dates, implementation owners, evidence, and remediation plans only after Legal/Compliance verifies the current official source.
• Reassess the register when deployment geography, data, model purpose, affected individuals, or vendor roles change.

15. Florida-Specific Legal Gates

15.1 Florida Digital Bill of Rights (FDBR)

Do not assume the FDBR applies merely because the organization processes Florida data. Under § 501.702(9), a controller generally must be a for-profit entity conducting business in Florida, collecting consumer personal data and determining its processing purposes and means, making more than $1 billion in global gross annual revenue, and satisfying at least one listed online-advertising, smart-speaker/virtual-assistant, or large app-store condition. Controlled entities may also fall within the definition. Sections 501.703 and 501.704 contain entity, activity, and data exemptions.

If Legal/Compliance confirms controller status and no exemption:

• Implement authenticated consumer rights, including access, correction, deletion, portability, and the § 501.705 opt-outs for targeted advertising, sale, covered profiling, sensitive-data collection/processing, and voice/facial-recognition collection.
• Maintain the § 501.71 collection limits, compatible-purpose/consent gate, reasonable security practices, sensitive-data consent, and nondiscrimination controls.
• Publish and annually update the privacy notice required by § 501.711.
• Complete and document the data protection assessments required by § 501.713.

Separately, § 501.715 reaches a broader for-profit person that meets § 501.702(9)(a)1.-3., even if it does not meet the $1 billion/full-controller test. Such a person may not sell sensitive data without the prior consent required by § 501.715 and must post the statute's sale notice. This is not a blanket consent rule for every organization or every biometric use.

15.2 Florida Information Protection Act (FIPA)

For a covered entity, governmental entity, or third-party agent handling electronic data containing § 501.171 personal information:

• Maintain reasonable security measures under § 501.171(2).
• Use the statute's breach definition and investigation gates rather than treating every AI malfunction as a reportable breach.
• Calendar the Department of Legal Affairs, affected-individual, third-party-agent, law-enforcement-delay, waiver, and consumer-reporting-agency rules in the applicable subsections.

15.3 Use-Case Laws

Employment, housing, lending, insurance, health care, education, biometric, child-directed, and public-sector deployments require a separate applicable-law analysis. This policy does not convert its internal High-Risk AI tier into a Florida statutory category.

Appendix A - Risk Tier Controls

Provide a table mapping risk tiers to required controls (e.g., human oversight, DPIA/AIIA, legal review, transparency notices, technical safeguards).

Appendix B - AI Inventory Template

Include fields for system name, owner, purpose, risk tier, data sources, jurisdictions, and status.

Appendix C - AI Impact Assessment Checklist

Outline required questions covering purpose, legal basis, stakeholders, risks, mitigation measures, monitoring plan, and sign-offs.

Official Sources

• Fla. Stat. § 501.702 — FDBR definitions and controller threshold
• Fla. Stat. § 501.703 — applicability
• Fla. Stat. § 501.704 — exemptions
• Fla. Stat. § 501.705 — consumer rights
• Fla. Stat. § 501.71 — controller duties
• Fla. Stat. § 501.711 — privacy notices
• Fla. Stat. § 501.713 — data protection assessments
• Fla. Stat. § 501.715 — sensitive-data sale
• Fla. Stat. § 501.171 — FIPA