---
id: "workshop:ai-policy-development"
type: "InnovateUS workshop"
title: "AI Policy Development"
url: "https://innovate-us.org/ai-policy-development"
date: "2025-09-25"
duration: "60 minutes"
language: "English"
series: "AI for Law Enforcement"
instructors: ["Peter Lambrinakos"]
recording: "https://www.youtube.com/watch?v=z5qquBtX5ms"
transcript: "automatic, from the recording"
source: "InnovateUS (innovate-us.org)"
licence: "CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/), as stated on innovate-us.org"
---

# AI Policy Development

InnovateUS workshop · 25 September 2025 · 60 minutes

Organizations implementing AI capabilities must have clear, well-structured policies that describe how AI is used and what safeguards are in place to ensure ethical application. Policies should be specific to each use case and serve as training and communication tools for internal teams and external stakeholders. This session will guide public safety executives through key steps in developing effective AI policies tailored to their agency’s mission.

## Learning goals

- Learn to implement AI capabilities with clear, well-structured policies
- Understand the key steps in developing effective AI policies tailored to their agency’s mission

## Speakers

- **Peter Lambrinakos**, Director of Public Safety Program & Artificial Intelligence Centre of Excellence, uOttawa Professional Development Institute

Part of the series [AI for Law Enforcement](https://innovate-us.org/workshop-series/law-enforcement).

Recording: https://www.youtube.com/watch?v=z5qquBtX5ms

## Transcript

Automatic transcript of the recording: names and terms can be misheard, and the times can be a few seconds off. Each time links to that moment of the video. The transcript alone: https://innovate-us.org/ai-policy-development.txt (plain text) and https://innovate-us.org/ai-policy-development.json (every segment with its start and end second).

**Peter Lambrinakos**

[0:00](https://youtu.be/z5qquBtX5ms?t=0) Thank you very much. Good, thank you very much, everyone, and good afternoon. It's a real pleasure to be here with you. So I want to start with a project my team at the University of Ottawa is exploring. We're looking at how to use AI to prevent wildlife trafficking by organized crime and using the same technology on human trafficking and drug trafficking. We're also researching how that exact same technology could be applied to help solve cold cases, analyzing data in new ways to bring answers to families who have waited decades for justice. So that experience gives me deep optimism about AI's potential. It also forces us to confront the single most important question of our time. How do you stay in control when something smarter than you enters the room? So this is what I kind of call the tiger in the room.

[1:03](https://youtu.be/z5qquBtX5ms?t=63) AI is this powerful, transformative force and can do amazing things. But it is also wild and dangerous, and our job as leaders is not to try and tame it, but to build the policy, the framework and the safeguards to govern it, to respect its power and to keep our communities safe. So for the public safety executives in this room, the implementation of AI is not a question of if, it is a question of how. The integration of AI is not just another IT project. It is a fundamental organizational transformation. So this brings us to the foundational principle for this entire discussion, which actually comes directly from the International Association of Chiefs of Police. Artificial intelligence should be used as a tool to assist police personnel, not replace them. Our systems inform, our officers and analysts decide.

[2:08](https://youtu.be/z5qquBtX5ms?t=128) The human remains the moral agent accountable for the outcome. When you hear AI, I want you to set aside the science fiction. We're not here to debate sentient robots right now, maybe in the future, but not right now. Today, we're here to talk about the narrow AI, not artificial superintelligence or that. So narrow AI is what is already in your agencies today, specialized pattern recognition tools. So let's look at some real world examples. For example, many documented in research from the National Institute of Justice, the NIJ, and also use cases from the Department of Homeland Security. They have a whole list of use cases. So in investigations, for example, the NIJ document the tools that can, for example, untangle mixed DNA from a crime scene, figuring out which DNA belongs to which person.

[3:12](https://youtu.be/z5qquBtX5ms?t=192) When samples are combined from multiple contributors, where a human analyst might hit a wall. We see it in video analysis, where tools can search thousands of hours of footage to find every person wearing a red jacket. In operations in cyber, defensive tools use AI for network anomaly detection, which learns your network's baseline of normal activity and flags anomalies that could indicate a malicious threat. And in analytics, we see tools for crime forecasting and acoustic gunshot detection. So these are powerful data-driven capabilities that are already in the field. So this brings us to the urgency. We don't have the luxury of setting this out. This is a dual-use technology.

[4:15](https://youtu.be/z5qquBtX5ms?t=255) And as our international partners, and for anybody to go onto the Europol Innovation Lab report, I strongly advise their website, lots of interesting reports over there. So criminals are innovating. This creates a defensive imperative. You know, we must understand this technology. You know, we're already seeing deep fakes and large language models used as a crime as a service, force multipliers, you know, enabling sophisticated fraud and disinformation really at an industrial scale. This speaks to a powerful axiom from the tech world. Today is the slowest day of the year. From this moment on, the pace of change will only increase. And it's also framed perfectly, if anybody of you knows Amaro's Law, which says we tend to overstate the impact of the technology in the short term. So we overestimate the impact of technology in the short term, but we dangerously underestimate its impact in the long term.

[5:23](https://youtu.be/z5qquBtX5ms?t=323) So this isn't just speed, it's really compression. Compression shrinks our decision windows and our margin of error. You know, criminals, they adapt faster. We must adapt quickly. Disinformation spreads faster. We must adapt quickly. And in an age of compression, leaders cannot wait for perfect information. In an age of compression, leaders cannot wait for perfect information. We must adapt quickly. We must act earlier, because if we don't prepare for this acceleration, the tiger doesn't just grow, it really just runs right past us. So that is the landscape. We have a powerful, wild, new capability at our disposal. And we are facing dangerous new criminal threats. So this all leads to the important challenge we're here today to discuss. How do we as leaders responsibly govern this tiger in the room? How do we build the framework to manage it, to dig into that? So I'd like to turn this over again to Ashwini Ejara, who has some specific questions that get to the heart of this process.

[6:27](https://youtu.be/z5qquBtX5ms?t=387) So Ashwini, over to you.

**Ashwini Jarral**

[6:28](https://youtu.be/z5qquBtX5ms?t=388) So, Peter, thanks a lot for that wonderful overview and for taking us off with this workshop. So the question I have is that as we're looking at AI and bringing that into the public sector, especially in the criminal justice organization, can you please share your thoughts on why do organizations need to have policy in place before implementing AI?

**Peter Lambrinakos**

[6:54](https://youtu.be/z5qquBtX5ms?t=414) Thank you, Ashwini. Yeah, and it's probably one of the most fundamental questions, right? And it's the one we basically hear the most often. Many people see policy as a bureaucratic hurdle that slows innovation down. But I argue the exact opposite. A policy is not a hurdle. It is the enabler of innovation. So it enables innovation. It's your playbook before the game starts. And trying to play without it is operationally reckless, according to me. You need the policy in place before implementation, I guess, for three main reasons. Legal defensibility, operational risk, and public trust. First, for public safety leaders, legal defensibility is critical. If you deploy a high-risk AI tool, especially one used in investigations like facial recognition, without a clear policy, your agency is operating without a legal shield.

[7:59](https://youtu.be/z5qquBtX5ms?t=479) You will be challenged in court. An attorney will put officers on the stand and ask them to explain, for example, how the AI tool that justified a Fourth Amendment stop actually works. They will file discovery motions demanding the tool's error rates, its confidence scores, and details about its training data. So I'm not sure many people right now in front of the stand will be able to actually answer those questions. So while the courts are still evolving on exactly how much must be disclosed, we're already seeing rulings in DNA software cases and growing pressure in facial recognition matters where judges require disclosure under Brady principles or in Canada's stitch cone. The bottom line is assume disclosure will be demanded and prepare your policy as if it's inevitable. And if you don't have a policy, you can't explain the black box.

[9:00](https://youtu.be/z5qquBtX5ms?t=540) And you don't have the error rates, your case gets suppressed, and your agency faces massive civil liability. A perfect example is the Clearview AI case, which actually I was also responsible when I was chief of police at VRL Canada. We were also using it, and then I was in the forefront where our agency was in the news. But in Canada, especially for federal law enforcement, the RCMP, so in Canada, a federal privacy commissioner ruled that the RCMP's use of Clearview AI was unlawful and contravened the Privacy Act precisely because it was done without a policy and without a proper risk assessment. So that is what can happen when you deploy a tool before you have the governance in place. So the RCMP agreed to implement changes to its policies, systems, and training to ensure compliance with privacy legislation.

[10:02](https://youtu.be/z5qquBtX5ms?t=602) So this included conducting complete privacy assessments of third-party data collection policies and ensuring new technologies are onboarded in a manner that respects privacy rights. Your policy is your documented proof of due diligence. And second, you need policy to manage operational risk, and the biggest operational risk is bias. For example, the National Institute of Standards and Technology, NIST, its AI risk management framework that was released in 2023, while voluntary in the U.S. government's leading voluntary guide for managing AI risks, it makes one point crystal clear. Bias is not something you can patch after deployment. It has to be addressed at the start. And the most dangerous type is historical data, excuse me, historical bias. Our AI tools learn from our old data. If we feed an AI 30 years of our old arrest reports, it isn't learning crime patterns.

[11:09](https://youtu.be/z5qquBtX5ms?t=669) It's learning our old policing patterns. Worse, you're creating the bias feedback loop. The bias tool recommends patrolling Area A. Your officers go to Area A and make more arrests. That new arrest data is fed back into the AI, which confirms the original bias, and then it amplifies it. So a policy-first approach breaks this loop. And finally, you need a policy before implementation to build public trust. This is a core principle. You cannot bolt it on the trust at the end, right? If the community finds out you're using a tool, especially after a mistake or a false arrest, you have already lost. So really, global best practice, for example, from the United Nations, INTERPOL, requires stakeholder engagement. Giving agencies a platform to proactively engage in the communities, you're really showing them the blueprint before you build. You're placing that suspicion with transparency. So to summarize, the policy is your legal strategy, your operational risk assessment, your training plan, and your community contract all in one.

**Ashwini Jarral**

[12:16](https://youtu.be/z5qquBtX5ms?t=736) So, Peter, thanks. So you've covered a lot of ground here just in creating the policy. And there's a lot of coordination, right? There's a lot of stakeholder management, a lot of consideration that goes into developing the policy. So with all of these stakeholders that are involved in helping develop the policy and manage the policy, because not one and done deal, so who should be governing the oversight of the policy development and its implementation?

**Peter Lambrinakos**

[12:42](https://youtu.be/z5qquBtX5ms?t=762) So the most common mistake is treating AI as just an IT project and handing the policy to the chief information officer. And I believe this is a recipe for failure in my experience. AI is an organizational, legal, and community issue. Governance cannot live in a single asylum. It must be a multidisciplinary team. I kind of basically break this up into three parts, the internal team, the executive sponsor, and the external advisors. The internal team is your core working group. It must include legal counsel to navigate the Fourth Amendment, greater disclosures and liability risks, for example, operational end users, the detectives, analysts, frontline officers, supervisors who actually use the tool. They are really your ground truth and technical experts, from your CIO's team who can look under the hood and challenge vendor claims, and policy analysts who can actually write governance.

[13:53](https://youtu.be/z5qquBtX5ms?t=833) This internal team must be led by an executive sponsor, for example, a deputy chief, lieutenant colonel, or equivalent, someone with the authority to champion the process and be held accountable. And finally, the governance structure must include external advisors like we talked about earlier. You must proactively engage your community groups, civil rights organizations, any existing civilian oversight bodies before you've made a decision. So this structure ensures the policy is legally sound, operational and practical, and it builds public trust.

**Ashwini Jarral**

[14:38](https://youtu.be/z5qquBtX5ms?t=878) So, Peter, with that being said, right, so we talk about policy development, oversight, and all of that good stuff that goes into developing and managing a policy. The question I have is that as we are looking at developing the policy, right, policy has a lot of different aspects to it, different considerations. So what are some of the areas that should be considered? in your policies to reduce the risks and liabilities on an organization?

**Peter Lambrinakos**

[15:11](https://youtu.be/z5qquBtX5ms?t=911) Thank you. I'm trying to find the right slide. So this is really, I guess, the core of how to, right? I like to focus on a certain, likes to focus on the big five standards that must be written to any high-risk AI policy. First, a risk-based approach. Your policy must force your team to use a framework like the NIST AI Risk Management Framework, for example, to classify the tool's impact. For example, if it's a high-risk tool, your policy must explicitly address the criminal justice information services security policy. For example, many AI tools are cloud-based. Your policy must forbid any solution that stores or processes criminal just information in a vendor's cloud environment, unless that vendor provides documented evidence that has written that their controls fully meet CJIS security policy. So in practice, this requirement alone rules out many vendors. Third, mandatory human oversight. We have to fight the problem called automation bias, the tendency to believe the computer is right. Even if our gut tells us it's wrong, this is how false arrests can happen. So your policy must be designed to break that bias.

[16:39](https://youtu.be/z5qquBtX5ms?t=999) And another risk is AI hallucinations. This is when a generative AI confidently gives you a completely made-up answer. It could be a fabricated legal precedent or a non-existent suspect name. So if your staff suffering from automation bias trusts that hallucination, you are building a real decision on false information. Therefore, your policy must be designed to break that bias. It must mandate a human-in-the-loop model, what US policy increasingly calls meaningful human oversight. So this means that the AI can suggest a match, but there must always be a hard stop where a trained human reviews and validates that suggestion before any operational action is taken. So the policy must force them to articulate their reasoning, not just the computer said so. And fourth, strict procurement standards. Your policy is your procurement document. It must include what we call the no-black-box rule. This means your RFP must demand the right to audit and test the tool and full disclosure of its known error rates.

[18:03](https://youtu.be/z5qquBtX5ms?t=1083) If a vendor won't provide transparency, you can't buy what you can't defend in court. And finally, auditing and accountability. The policy must schedule regular independent audits of the tool's performance to check for model drift and ensure it's not becoming more biased over time. In Canada, we use a simple mnemonic to summarize this, call it the faster principles. F for fair, for example, was the tool tested for bias? A for accountable, is a human responsible for the decision? S for safe, are safety and security controls in place for data and systems? T for transparent, can we explain policies, processes, and limits? E for explainable, can users and auditors understand that tool's outputs?

[19:17](https://youtu.be/z5qquBtX5ms?t=1157) And R for responsible, are we meeting legal, ethical, and community standards?

**Ashwini Jarral**

[19:28](https://youtu.be/z5qquBtX5ms?t=1168) So Peter, that's great, right? So you gave us the overall framework, what should go into the policy, but as we know that the nature of policy is so different, right? There are different types of AI. Now there are different types of use cases, which might have a different aspects of policy and different types of information that we are trying to utilize to build a model, develop a model, and also implement it. So my question is, should AI policy be in general in nature or specific to each use case? That's a great question, Ashwini. So

**Peter Lambrinakos**

[19:59](https://youtu.be/z5qquBtX5ms?t=1199) the answer is both. You need two types of policy. First, you need a general enterprise AI policy. That's kind of your constitution for AI. It establishes the broad principles. For example, we will adhere to all constitutional and legal standards, or we will mandate human oversight for all high-risk decisions, and we will not procure black box systems. But that general policy is not enough. For every high-risk AI system, you must also have a specific use case policy. So the risks, data, and legal issues for a facial recognition tool are completely different, for example, from a crime forecasting tool. You cannot have one policy that effectively governs them all.

[21:03](https://youtu.be/z5qquBtX5ms?t=1263) Each demands its own policy detailing its exact authorized purpose, you know, the specific data it can use, and the exact human oversight and auditing rules, for example. So I would say

**Ashwini Jarral**

[21:18](https://youtu.be/z5qquBtX5ms?t=1278) use both. Thanks, Peter. So of course, we can develop a policy, right? And thanks for clarifying that you need both areas to cover general areas of policies around AI and the specific use cases, right? And there are a lot of templates when it comes to justice and public safety stakeholders because we also have a lot of compliances to meet. So I assume that we have to capture all of that. So as we develop these policies, now we also have to train our staff. So what are your thoughts on how these policies should be used to raise awareness and training our staff on the use of AI?

**Peter Lambrinakos**

[21:56](https://youtu.be/z5qquBtX5ms?t=1316) So a policy that just sits on a shelf is useless. The policy must be the foundation for your training program even. The biggest mistake, I feel, is a vendor-led training that only focuses on features. And that doesn't mean that all vendors do that. Lots of vendors actually combine all encompassing training. However, when we're just focusing on features, this can be a mistake. Your policy mandates basically a different kind of training. It mandates that you train your people, for example, on the tool's limitations, for example. That's, I guess, the key shift. You don't just train on what the tool can do. You train what it can't do and where it fails. So mandatory training for any high-risk tool, I guess, must cover four areas. One, purpose and scope. You know, what the tool is explicitly forbidden to be used for. So some tools, according to, let's say, for underprivacy reasons, cannot be used for certain aspects or operations. Now, obviously, in Canada, we have much more stricter privacy rights than in the US. So it's obviously different countries have different jurisdictions and different laws. Another thing is known limitations. The tool's error rates and biases.

[23:31](https://youtu.be/z5qquBtX5ms?t=1411) Human oversight. The mandatory procedure, for example, human-in-the-loop review. Officers must understand on AI recommendation does not mean probable cause. Legal implications for the states, the Fourth Amendment, Brady Disclosure, very similar to our laws as well in Canada. So the policy isn't just a rule book. It's the curriculum for a new kind of training that builds a culture of critical thinking and human accountability.

**Ashwini Jarral**

[24:14](https://youtu.be/z5qquBtX5ms?t=1454) So just building off of that, in your opening remarks and in your earlier slides, anyone in the governance discussion, you talk about stakeholder engagement, right? The community leaders engagement, community that we, our officers serve and our agencies serve. So how do these policies need to be used for community engagement, especially when it comes to outreach and raising awareness on how we're using AI? Yeah, I think that's a really good question.

**Peter Lambrinakos**

[24:42](https://youtu.be/z5qquBtX5ms?t=1482) Yeah. So I think often many agencies can get this completely backward. I know that we did at one point when we purchased tools and we didn't engage the community. Clearview AI was one of them. We didn't look at our privacy commission or anything like that and had to answer a lot of questions to the board when our agency was in the newspaper. So often agencies buy a tool in secret and then they try to defend it to the community. And then after a news story breaks, by then it's too late. Modern responsible approach says the policy is your community engagement tool. Use the policy development process itself as the platform for transparency and outreach. Your policy must mandate that before any high-risk tool is procured, you proactively engage with external stakeholders. This means community groups like we mentioned earlier, like we mentioned the civil rights organizations, civilian oversight bodies, the police board, depending on jurisdiction and how the oversight is on the police agency or the public safety agency. And you'll use the policy also to create plain language summaries that answer four key questions for the public. You don't hand them that big 50-page legal document. And the summaries basically I think should answer four key questions to the public. One, here is the problem we are trying to solve.

[26:44](https://youtu.be/z5qquBtX5ms?t=1604) Two, here is the technology we are considering. Three, here are the safeguards we're building into our policy. And last, what are your concerns? And I believe this builds buy-in. You're replacing suspicion with transparency. So now this does not mean that you put every operational detail on the table. Obviously when we're talking about intelligence, when we're talking about high-risk procedures for policing, it's a critical balance. We're talking about national security. Yes, be transparent about policy and purpose, but we also have to protect the tactics and investigative techniques and sources that keep your people safe. So the policy isn't just an internal rule book. It's really your public-facing contract with the community.

**Ashwini Jarral**

[27:58](https://youtu.be/z5qquBtX5ms?t=1678) Thanks, Peter, for that. So my next question is that it's great that we are talking about all of these considerations, right? And we have to review it. So again, as we talked about, it's not a one-and-done deal on the policies. How often the policies should be reviewed once implemented, and what should be the triggers for reviewing those policies?

**Peter Lambrinakos**

[28:25](https://youtu.be/z5qquBtX5ms?t=1705) Thanks, Ashwini. So we know that a policy must be a living document. It requires, I think, two basic review mechanisms. First, a mandatory time-based review, at least annually, and my policies will always have those reviews annually. But second, your policy must define specific event-based triggers that force an immediate review. For example, I think you can have a new procurement of a high-risk AI tool. I think that would trigger a mandatory review. Another trigger could be an incident or failure, like a false identification or a biased output that hits the media. Maybe another trigger, a new law or a court case.

[29:33](https://youtu.be/z5qquBtX5ms?t=1773) You know, when a new law is passed in New Jersey, for example, or a new Supreme Court ruling lands, your legal counsel must trigger a review. And as well, I think last probably would be an audit finding, you know, when a regular audit reveals the tool's performance has drifted, meaning its error rate is creeping up or it's becoming more biased. That immediately triggers a review. So I believe that this is a mechanism for continuous improvement. And it's really how you execute the off-ramp also or decommissioning plan if a tool fails an audit or it's no longer viable.

**Ashwini Jarral**

[30:22](https://youtu.be/z5qquBtX5ms?t=1822) So Peter, I want to ask a question on just this topic because it's great that you talk about the procurement perspective, decommissioning perspective. And one of the questions that a lot of folks are asking is as they're buying or procuring or building some of the AI models, what policy should address when it comes to the data that is being used to train the model or the ownership of the data? Who owns the data? And I know a lot of folks say, yeah, if I'm a company and I'm working with an agency, agencies own the data. What should policy actually address and how should policy address the data consideration when it comes to AI?

**Peter Lambrinakos**

[31:04](https://youtu.be/z5qquBtX5ms?t=1864) Yeah, so let me stop sharing. So yes, so obviously it's a hugely important question, right? When you're acquiring technology, the policies you establish around data before you ever even sign a contract will determine, I guess, the long-term success, legality as well, and really, I guess, the trustworthiness of the system. So when you're buying AI models, the conversation around that is not just a technical detail. It is really a fundamental policy issue. So how I think law enforcement, public safety agencies should address this is in your policy, you must build, for example, three core pillars, I would say. One is data ownership, one is data integrity, and one is data security. So single most, I guess, important policy is really to establish in writing who owns the data. The clear, you know, the police agency, public safety agency owns its data and it should be clear. This includes the data your agency generates in the course of its operations, for example. It also includes the inferences or outputs created by the AI model when it processes your data. You must be very wary of vendors whose business model involves absorbing your agency's data, you know, to improve their own propriety models, which they then sell often to others.

[33:05](https://youtu.be/z5qquBtX5ms?t=1985) So your procurement contracts and policies must explicitly state that your agency retains full ownership and control of its data. Clear limits, you know, on how the vendor can use your data. Can they use it for research to improve their algorithms? If so, under what specific anonymized conditions? And what happens to your data when the contract ends? There must be a clear and verifiable process for the vendor to return and or securely delete all of your agency's data. And without these clear lines, the risk of losing control of your company's sensitive information is great. And actually, I've seen a lot of agencies now that when they want to pull out their data, they are having some serious problems pulling it out because basically, they didn't really look at that aspect and now all their data is locked in to one vendor that they cannot pull out and it's in multiple platforms or they don't have the tools to pull it out because the data is in different types of systems. So it can become a mess and a huge risk. And I think obviously policies on data integrity and bias, right?

[34:20](https://youtu.be/z5qquBtX5ms?t=2060) You're not just buying an algorithm, you're buying the decisions and makes based on the data it was trained on. So therefore, you must have policies that demand transparency into that training data. Your agency needs to ask the vendor, for example, the tough questions and your policy should require more than satisfactory answers, you know, really good answers before purchase. You know, where did the training data come from? Was it ethically and legally sourced? Does it reflect the demographic realities of your jurisdiction? Or was it sourced from somewhere else? You know, for example, or how was the data cleaned and labeled, for example? Often like Europol, their documents, they talk about where they highlight bias, inaccuracies or biases in the original data, as we mentioned earlier, will be amplified by the AI. And I guess what steps were taken to test for and mitigate bias? I think that's hugely important. The vendor must provide evidence that they have audited their model for performance disparities across racial, ethnic and gender groups, for example. So your policy should state that the agency will not procure those black box systems where the vendor cannot or will not provide adequate transparency to the data used to build the model. And I guess third one mentions policy for data security and access control, which is obviously hugely important. You know, apart from talking about internal threats and internal security, you know, your policies must address how this sensitive data will be protected both by the vendor and within your agency. For example, the National Social Safety Chiefs of Police have guidelines that are very clear on this point.

[36:05](https://youtu.be/z5qquBtX5ms?t=2165) And I recommend that you read those guidelines. You must have policies that cover, for example, data security protocols. The vendor must meet stringent cybersecurity standards for how they store, transmit and protect your data from breaches, access control, who at the vendor company can access your data, for what reasons. And there must be strict controls on audit logs and third party sharing. You know, your policies should explicitly prohibit the vendor from sharing, selling or otherwise transferring your data to any other third party without obviously your consent. So yeah, I guess pretty much it's built on ownership, integrity and security.

**Ashwini Jarral**

[36:53](https://youtu.be/z5qquBtX5ms?t=2213) I do that point also that how data is being used, how your data is being used to train the models, and there needs to be some rules around it. So Peter, you've given us a lot of information for consideration in the policy development. So before we open, we do have a few questions before we open for the other Q&A session. Do you want to share some of the final thoughts around the policy development?

**Peter Lambrinakos**

[37:18](https://youtu.be/z5qquBtX5ms?t=2238) Sure. Let me share my screen. I have one final slide. I hope you can all see this. Okay, excellent. So thank you again, Ashwini. I'd like to, I guess, leave everyone with three questions. First, what must remain human? The pressure to automate is immense. But decisions about liberty, justice and use of force can never be delegated to a machine. Second, how will we verify the machine? We know automation bias makes us overtrust AI. So where in our process does a human have the authority and responsibility to check its work? And third, you know, which crisis will you rehearse? You know, often in public safety agencies, we're rehearsing the act of shooter. There's various different crises. But we also have to look at these from the cyber attacks to the AI attacks. So organizations that survive disruption don't avoid failure, but they practice for it, right?

[38:51](https://youtu.be/z5qquBtX5ms?t=2331) So will you simulate, for example, a deepfake campaign, an AI network breach, a catastrophic algorithmic failure? These are the questions that turn, I guess, foresight, I really like the topic of foresight, into action. The signals are here. So basically, the only variable I think left is our leadership, you know, as humans, and as public safety leaders and at all levels. And for example, at the University of Ottawa, often this is what we do, you know, it's not just theory for me, I really love what we're doing there on AI. For example, partnering with IGIS, you know, our AI Center of Excellence, we're working with public safety partners to build the very governance frameworks and training programs that we've discussed today. At our information integrity lab, we're tackling one of the greatest threats we all face, disinformation, misinformation, malinformation. And we've developed a UODetect platform for national security, for communications and various other law enforcement and defense uses, which is an advanced open source intelligence tool, and a risk assessment tool designed to help agencies detect and analyze these complex campaigns, and be able to kind of decide, well, is the risk actually going? Should we actually look at that issue? Or this is really high on the radar, but it's actually going to just fizzle out, and we don't really need to pay attention to that. So it's really designed to help agencies detect and analyze these complex campaigns. And often, we just had a visit yesterday from the Senate and Senators from Virginia that actually came over to the University of Ottawa and IBM Cyber Range, where we showed them the immersive training center where agencies can rehearse their response to a deepfake crisis,

[40:56](https://youtu.be/z5qquBtX5ms?t=2456) or an AI-driven cyber attack before it happens on their streets. We are exploring how to use the same technology to support investigators in cold case and homicides. That's a real passion of mine, since I used to head the major crime, the homicide department. It's a huge passion of mine. I really want to be able to bring long overdue answers to families. And that is really the promise of this technology. So when it is governed by sound, ethical, and legally defensive policy, it's really, really important. So please don't hesitate to reach out. So thank you, Ashwin.

**Ashwini Jarral**

[41:36](https://youtu.be/z5qquBtX5ms?t=2496) Thanks, Peter. So we'll open up for Q&A. So we do have a few questions. So let me read the first question.

* * *

Original page: https://innovate-us.org/ai-policy-development · Licence: CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/), as stated on innovate-us.org