Savannah Alderman Nick Palumbo is pushing for a formal artificial intelligence policy after his family's healthcare information was exposed in a data leak tied to city technology use. The breach underscored what he describes as an unregulated environment where departments can use AI tools without oversight, accountability, or public disclosure.
"No one can answer the question on how the city of Savannah utilizes AI," Palumbo said. "It's the Wild West, it's anything goes, any platform or generative AI usage they want to do themselves, they can use it in their practice."
Palumbo, who represents District 4 and serves on the National League of Cities board, drew inspiration from policies already in place in Seattle, Washington, and Lebanon, New Hampshire. His proposed framework rests on four pillars designed to bring structure to a rapidly expanding area of municipal operations.
The four pillars of the proposed framework
Palumbo outlined the approach in a public post Tuesday morning. Each pillar addresses a specific gap in the city's current posture toward AI tools and the vendors who supply them.
Transparency: The city would publish a public inventory of every AI system it operates, including what each system does and which department uses it. Residents could look up the information the same way they access budget documents.
Accountability: Software can sort permits, flag properties, or route requests, but when a decision affects a person's money, record, or rights, a human must make the final call. Residents would retain the right to a human appeal.
Data protection: Savannah's data would not be handed off to vendors or used to train third-party AI models. "Your information belongs to you," Palumbo's framework states.
Vendor vetting: Before the city buys software, it would review the product for privacy risk and bias and require the company to disclose what it does with city data. That review would happen at procurement, like every other purchasing decision.
A data breach sharpened the urgency
Palumbo said his family's health information was among the records leaked, leaving them uncertain about the scope of exposure. "We were furious, not because of what we heard, but what we didn't know," he said. "We don't know how much of my family's data is out there, is our social security or date of birth, or is it just my name, we're not sure."
Nicholas Bidwell, CEO of local cybersecurity firm Lowcountry Technologies, said autonomous AI systems carry inherent risk. "It's very easy for it to go and do not what you intended if you're not constantly watching it and guiding it in a direction," Bidwell said. "If you let it run autonomously, there's no guarantee it will stay on the rails."
Palumbo emphasized that his effort targets mitigation, not prevention. Both he and Bidwell said another leak is a matter of when, not if, and the city needs a clear response and accountability structure in place beforehand.
Mayor signals support for codified rules
Mayor Van Johnson acknowledged that AI is already embedded in city workflows and can be a useful tool, but agreed it requires formal boundaries. "You have to codify it in policy, and we want people to be clear about what they can expect from us when it comes to AI," Johnson said.
The city currently holds a license with Microsoft but places no limits on what or how departments use it or other AI platforms. Palumbo's framework aims to close that gap by establishing rules before procurement, not after deployment.
For government professionals watching how municipalities handle emerging technology, the Savannah proposal reflects a broader shift toward structured AI for Government adoption. The framework will first take shape as a workshop to brief the city council on the plan and its importance.
Why this matters for government professionals
Savannah's experience shows what happens when AI tools enter public agencies without governance: departments operate independently, data leaks go unmeasured, and elected officials cannot answer basic questions about usage. For policy staff, IT leaders, and municipal administrators, Palumbo's four pillars offer a starting template - publish an inventory, require human sign-off on consequential decisions, lock down resident data, and vet vendors at procurement. An AI Learning Path for Policy Makers can help teams build the technical fluency needed to draft and enforce rules like these before a breach forces the conversation.
Your membership also unlocks:
