Trying AI 4 min read
The questions to ask before choosing an AI tool
The questions IT, records, legal, and department leads should ask any AI provider, with GovAI’s own answers alongside.
Part of the path I’m ready to try AI
Before you choose an AI tool, get clear, checkable answers on five things: your data, your records, the proof behind security claims, how the AI handles your documents, and who helps your departments after launch. You’re deciding where staff will do their work and what they’ll put into it, so the questions go well beyond features.
Why this choice carries more weight in local government
Staff will paste real work into whatever you choose. In GovAI, half of all messages start with staff pasting in their own documents, and nearly half include sensitive information. Whatever tool you pick will hold resident details, HR files, and draft decisions within weeks.
And local government answers to more people than most buyers. Your IT lead, your records officer, your counsel, your procurement rules, and eventually your council will all want to know what you checked. Ask the questions below early, in writing, so nobody discovers a problem after the contract is signed.
The questions, and how GovAI answers them
Use these with any provider. We’ve put our own answers alongside so you can see what a clear answer looks like.
| Question | GovAI’s answer |
|---|---|
| Your data | |
| Is our content used to train AI models? | No. Your content stays yours, and we don’t use it to train models. |
| When we delete something, is it actually gone? | Yes. Staff can delete a conversation at any time, and documents you delete are removed from what AI searches. Separately, your admin sets how long conversations are kept before they’re deleted automatically. |
| Where is our data, and which other companies handle it? | The app runs on AWS. AI features use OpenAI under enterprise terms that don’t allow training on your data. The full subprocessor list is public at trust.govai.com. |
| How is our data protected? | Encrypted at rest and in transit, using TLS 1.2 or higher. |
| Records and oversight | |
| How would we answer a records request that involves AI conversations? | Tell us, and our team exports the records for you. |
| Who controls how long conversations are kept? | Your admin, and staff can see the limit. |
| Can IT see how the tool is used across the organization? | Yes. Admin controls and an audit trail are built in, and admins can see where sensitive information turns up. |
| Do you support single sign-on? | Yes. SAML single sign-on is included. |
| Proof | |
| Which independent security reviews have you passed? | SOC 2 Type II. Request the report at trust.govai.com. |
| Which frameworks do you follow? | The NIST AI Risk Management Framework and the OECD AI Principles. Annual third-party penetration tests. |
| Is it accessible to staff using assistive technology? | WCAG 2.1 Level AA, with a VPAT on the Trust Center. |
| Are you FedRAMP or StateRAMP authorized? | Not today. We can show you SOC 2 Type II and the live controls on our Trust Center. |
| The AI itself | |
| Can it show where an answer came from when it’s using our documents? | Yes. Answers drawn from your documents can say which document they came from, so staff can check. |
| What happens when it doesn’t know? | You set the rules: say the documents don’t cover it, or pass the question to a person. |
| Fit for the work | |
| Does it know how local government work runs: agendas, records, council reports, approvals? | Yes. It’s built for local government, with workflows and guardrails ready on day one. |
| Will someone help set up our first jobs? | Yes. Our local government experts coach your teams department by department as work goes live. |
| Will you tell us when a job isn’t a good fit? | Yes. We’d rather say no than set up something that won’t work. |
| Cost | |
| Does the cost go up as more staff use it? | No. One annual price covers the organization, so everyone can have access. |
| Will the price stay the same for the contract? | Yes. The price is set for the year, so month-to-month use doesn’t change your bill. |
How to judge any provider’s answers
- Ask for the document behind the claim. “We’re secure” isn’t an answer. A report, a public trust page, or a contract clause is.
- Ask about defaults. If an answer depends on settings, ask which settings, who controls them, and what they’re set to on day one.
- Watch for answers that blur two things. “We don’t keep your data” and “we don’t train on your data” are different promises. Ask about each one.
- Ask what happens in month six. Launch support is easy to promise. Ask who helps when the fourth department starts.
Who should ask which questions
| Who | The questions they own |
|---|---|
| IT director or CIO | Data, security, single sign-on, oversight |
| Clerk or records officer | Records requests and retention |
| Legal or counsel | Training on data, contract terms, sensitive material |
| A department head with a backlog | Fit for the work, and who helps after launch |
| Procurement and finance | Cost, contract length, and how you can buy |
You don’t need everyone in every meeting. Bring each person in early enough that their questions aren’t discovered after you’ve chosen. One technical contact and one business sponsor, from the start, is the minimum.
Try this week
Copy the questions above into a one-page document, assign each section to the person in the second table, and send it to every provider you’re considering. Compare the answers side by side. Vague ones are an answer too.
If Microsoft Copilot is one of your options, read this next: Where does Microsoft Copilot fit beside GovAI?