How risky is ChatGPT? Depends which federal agency you ask
From exploratory pilots to temporary bans on the technology, most major federal agencies have now taken some kind of action on the use of tools like ChatGPT.
While many of these actions are still preliminary, growing focus on the technology signals that federal officials expect to not only govern but eventually use generative AI.
A majority of the civilian federal agencies that fall under the Chief Financial Officers Act have either created guidance, implemented a policy, or temporarily blocked the technology, according to a FedScoop analysis based on public records requests and inquiries to officials. The approaches vary, highlighting that different sectors of the federal government face unique risks — and unique opportunities — when it comes to generative AI.
As of now, several agencies, including the Social Security Administration, the Department of Energy, and Veterans Affairs, have taken steps to block the technology on their systems. Some, including NASA, have or are working on establishing secure testing environments to evaluate generative AI systems. The Agriculture Department has even set up a board to review potential generative AI use cases within the agency.
Some agencies, including the U.S. Agency for International Development, have discouraged employees from inputting private information into generative AI systems. Meanwhile, several agencies, including Energy and the Department of Homeland Security, are working on generative AI projects.
The Departments of Commerce, Housing and Urban Development, Transportation, and Treasury did not respond to requests for comment, so their approach to the technology remains unclear. Other agencies, including the Small Business Administration, referenced their work on AI but did not specifically address FedScoop’s questions about guidance, while the Office of Personnel Management said it was still working on guidance. The Department of Labor didn’t respond to FedScoop’s questions about generative AI. FedScoop obtained details about the policies of Agriculture, USAID, and Interior through public records requests.
The Biden administration’s recent executive order on artificial intelligence discourages agencies from outright banning the technology. Instead, agencies are encouraged to limit access to the tools as necessary and create guidelines for various use cases. Federal agencies are also supposed to focus on developing “appropriate terms of service with vendors,” protecting data, and “deploying other measures to prevent misuse of Federal Government information in generative AI.”
Agency policies on generative AI differ
| Agency | Policy or guidance | Risk assessment | Sandbox | Relationship with generative AI provider | Notes |
| USAID | Neither banned nor approved, but employees discouraged from using private data in memo sent in April. | Didn’t respond to a request for comment. Document was obtained via FOIA. | |||
| Agriculture | Interim guidance distributed in October 2023 prohibits employee or contactor use in official capacity and on government equipment. Established review board for approving generative AI use cases. | A March risk determination by the agency rated ChatGPT’s risk as “high.” | OpenAI disputed the relevance of a vulnerability cited in USDA’s risk assessment, as FedScoop first reported. | ||
| Education | Distributed initial guidance to employees and contractors in October 2023. Developing comprehensive guidance and policy. Conditionally approved use of public generative AI tools. | Is working with vendors to establish an enterprise platform for generative AI. | Not at the time of inquiry. | Agency isn’t aware of generative AI uses in the department and is establishing a review mechanism for future proposed uses. | |
| Energy | Issued a temporary block of Chat GPT but said it’s making exceptions based on needs. | Sandbox enabled. | Microsoft Azure and Google Cloud. | ||
| Health and Human Services | No specific vendor or technology is excluded, though subagencies, like National Institutes of Health, prevent use of generative AI in certain circumstances. | “The Department is continually working on developing and testing a variety of secure technologies and methods, such as advanced algorithmic approaches, to carry out federal missions,” Chief AI Officer Greg Singleton told FedScoop. | |||
| Homeland Security | For public, commercial tools, employees might seek approval and attend training. Four systems, ChatGPT, Bing Chat, Claude 2 and DALL-E2, are conditionally approved. | Only for use with public information. | In conversations. | DHS is taking a separate approach to generative AI systems integrated directly into its IT assets, CIO and CAIO Eric Hysen told FedScoop. | |
| Interior | Employees “may not disclose non-public data” in a generative AI system “unless or until” the system is authorized by the agency. Generative AI systems “are subject to the Department’s prohibition on installing unauthorized software on agency devices.” | Didn’t respond to a request for comment. Document was obtained via FOIA. | |||
| Justice | The DOJ’s existing IT policies cover artificial intelligence, but there is no separate guidance for AI. No use cases have been ruled out. | No plans to develop an environment for testing currently. | No formal agreements beyond existing contracts with companies that now offer generative AI. | DOJ spokesperson Wyn Hornbuckle said the department’s recently established Emerging Technologies Board will ensure that DOJ “remains alert to the opportunities and the attendant risks posed by artificial intelligence (AI) and other emerging technologies.” | |
| State | Initial guidance doesn’t automatically exclude use cases. No software type is outright forbidden and generative AI tools can be used with unclassified information. | Currently developing a tailored sandbox. | Currently modifying terms of service with AI service providers to support State’s mission and security standards. | A chapter in the Foreign Affairs Manual, as well as State’s Enterprise AI strategy, apply to generative AI, according to the department. | |
| Veterans Affairs | Developed internal guidance in July 2023 based on the agency’s existing ban on using sensitive data on unapproved systems. ChatGPT and similar software are not available on the VA network. | Didn’t directly address but said the agency is pursuing low-risk pilots | VA has contracts with cloud companies offering generative AI services. | ||
| Environmental Protection Agency | Released a memo in May 2023 that personnel were prohibited from using generative AI tools while the agency reviewed “legal, information security and privacy concerns.” Employees with “compelling” uses are directed to work with the information security officer on an exception. | Conducting a risk assessment. | No testbed currently. | EPA is “considering several vendors and options in accordance with government acquisition policy,” and is “also considering open-source options,” a spokesperson said. | The department intends to create a more formal policy in line with Biden’s AI order. |
| General Services Administration | Publicly released policy in June 2023 saying it blocked third-party generative AI tools on government devices. According to a spokesperson, employees and contractors can only use public large language models for “research or experimental purposes and non-sensitive uses involving data inputs already in the public domain or generalized queries. LLM responses may not be used in production workflows.” | Agency has “developed a secured virtualized data analysis solution that can be used for generative AI systems,” a spokesperson said. | |||
| NASA | May 2023 policy says public generative AI tools are not cleared for widespread use on sensitive data. Large language models can’t be used in production workflows. | Cited security challenges and limited accuracy as risks. | Currently testing the technology in a secure environment. | ||
| National Science Foundation | Guidance for generative AI use in proposal reviews expected soon; also released guidance for the technology’s use in merit review. Set of acceptable use cases is being developed. | “NSF is exploring options for safely implementing GAI technologies within NSF’s data ecosystem,” a spokesperson said. | No formal relationships. | ||
| Nuclear Regulatory Commission | In July 2023, the agency issued an internal policy statement to all employees on generative AI use. | Conducted “some limited risk assessments of publicly available gen-AI tools” to develop policy statement, a spokesperson said. NRC plans to continue working with government partners on risk management, and will work on security and risk mitigation for internal implementation. | NRC is “talking about starting with testing use cases without enabling for the entire agency, and we would leverage our development and test environments as we develop solutions,” a spokesperson said. | Has Microsoft for Azure AI license. NRC is also exploring the implementation of Microsoft Copilot when it’s added to the Government Community Cloud. | “The NRC is in the early stages with generative AI. We see potential for these tools to be powerful time savers to help make our regulatory reviews more efficient,” said Basia Sall, deputy director of the NRC’s IT Services Development & Operations Division. |
| Office of Personnel Management | The agency is currently working on generative AI guidance. | “OPM will also conduct a review process with our team for testing, piloting, and adopting generative AI in our operations,” a spokesperson said. | |||
| Small Business Administration | SBA didn’t address whether it had a specific generative AI policy. | A spokesperson said the agency “follows strict internal and external communication practices to safeguard the privacy and personal data of small businesses.” | |||
| Social Security Administration | Issued temporary block on the technology on agency devices, according to a 2023 agency report | Didn’t respond to a request for comment. |
Note: Chart displays information obtained through records requests and responses from agencies. The Departments of Commerce, Housing and Urban Development, Transportation, and Treasury didn’t respond to requests for comment. The Department of Labor didn’t respond to FedScoop’s questions about generative AI.
