AI, Public Records, and Governance: What Cities Should Consider Before Deploying Planning AI

Authority: What the System Does Not Do

The Intelligence Advisor does not issue approvals.
It does not certify compliance.
It does not grant entitlements.

It provides citation-based research guidance drawn from adopted documents.

Users acknowledge that responses are informational before accessing the tool. Every response includes a visible reminder that final determinations remain with authorized staff.

Planning authority remains with planners.

Model Providers and Architecture

The Intelligence Advisor operates on a configurable AI platform that can integrate with multiple large language model providers, including OpenAI, Google Gemini, Anthropic Claude, and others.

Model selection is configurable. Access occurs through secure API connections.

This means the system is not tied to a single model vendor. It also means data flows through an API during query processing. That data flow is governed by the platform’s security architecture and the provider’s API policies.

Uploaded jurisdiction documents are not used to fine-tune or retrain foundation models. They are supplied as contextual inputs during response generation.

How Municipal Documents Are Used

The platform uses retrieval-augmented generation (RAG).

When documents are uploaded:

• They are segmented into indexed chunks.
• Relevant segments are retrieved when a query is submitted.
• Only the relevant segments are sent to the selected model as context.

The full document is not transmitted wholesale.

The system also includes human-in-the-loop tools that allow administrators to review and refine how content is indexed and retrieved. That matters in a regulatory setting where accuracy is more important than novelty.

“Training” in this environment refers to refining retrieval behavior and prompts. It does not mean retraining the underlying model.

Hosting and Security Certifications

According to vendor documentation:

• The platform is hosted on Amazon Web Services (AWS) in Oregon, USA.
• It maintains ISO/IEC 27001 certification.
• It maintains SOC 2 Type 1 certification.
• It is GDPR compliant.
• Security documentation is available through a public Trust Center.

Those certifications are relevant because they indicate external security review under recognized standards.

They are not a substitute for local IT review, but they establish a baseline.

Encryption and Access

Vendor documentation states that encryption technology and access controls are used to protect stored data.

The platform does not provide end-to-end encryption that would prevent operational access. Vendor engineers may access uploaded documents under confidentiality obligations and internal policy controls.

For municipalities, that means the system operates like other cloud-hosted enterprise software: secure, but not air-gapped.

Detailed technical controls should be reviewed during procurement.

Data Flow and Model Interaction

During a query:

1. The system retrieves relevant document segments.
2. Those segments are transmitted via API to the selected model.
3. The model generates a response.
4. The response is returned with citations.

Customer data is not used to train shared models. However, contextual segments are transmitted during query processing. That distinction matters.

Cities evaluating AI should understand where data travels and under what agreements.

Jurisdiction Separation

Each jurisdiction’s documents are configured within its own designated environment.

Documents are not blended across clients and are not accessible across jurisdictions.

Architectural specifics — such as tenant isolation mechanisms — should be reviewed directly with the vendor during IT evaluation.

Conversation Records and Public Records Considerations

The system allows:

• Download of individual responses.
• Export of full conversation sessions.
• Administrative visibility into conversation history.

How those records are classified under state public records law depends on the jurisdiction.

Cities should determine:

• Whether AI sessions are retained.
• How long they are retained.
• Whether exported records become part of official files.

Those decisions belong to the city’s legal and records management teams.

Versioning and Updates

When ordinances or plans are amended, updated documents can be uploaded so responses reflect current adopted materials.

Previous versions are replaced within the active configuration.

Model and prompt adjustments may affect system behavior over time. Cities that require historical reconstruction of outputs should incorporate session exports into their retention policies.

Liability

AI does not remove municipal liability.

It can reduce informal paraphrasing and improve consistency by linking answers directly to adopted language.

It does not replace review. It does not override procedure.

Liability remains governed by local law and administrative practice.

What Cities Should Review Before Deployment

Before deploying AI for planning research, municipalities should review:

• Data retention policies.
• Encryption standards.
• Tenant isolation architecture.
• Subprocessor disclosures.
• Logging and audit controls.
• Backup and disaster recovery documentation.

Those are standard procurement questions for any cloud-hosted system.

AI should not be treated differently — but it should not be treated casually either.

AI is capable. That part is settled.

The only question worth asking is whether the system is bounded by the same governance standards as the rest of the city’s infrastructure.

That is the standard for responsible deployment.

The Wrap Up

Deploying AI in planning requires governance discipline.

Authority remains with staff. Records obligations remain in place. Liability continues to be governed by law and administrative practice.

AI can improve research speed and consistency while operating within established review processes and security standards.

Responsible deployment means ensuring the system functions inside the same governance framework that protects the rest of your municipal infrastructure.

That standard defines readiness.

Interested in exploring the implementation of AI in your community? Schedule a consultation with our CEO.

Need deeper context?