The purpose of this Secure Use of AI section is to help your organization define how staff, and where applicable, consultants, contractors, and partner agencies, may use generative AI tools while protecting confidential data, cybersecurity, operational systems, and public trust. This section focuses on four primary areas:
- Protecting data when using AI tools.
- Reviewing terms of service and vendor conditions.
- Risks associated with personal accounts.
- Managing cybersecurity issues related to generative AI.
Within those four areas, five requirements are mandatory:
- Classify data before entering it into any generative AI tool.
- Use only agency-approved tools through managed agency accounts, never personal accounts or unapproved extensions.
- Keep sensitive and non-public information out of public or consumer AI tools.
- Submit only the minimum information the task requires.
- Have a qualified person review and validate AI-generated content before it is used in any official work product or decision.
Additional caution applies before AI is used with operational technology or mission-critical systems such as traffic signals, Traffic Management Center (TMC) systems, Intelligent Transportation System (ITS) devices, connected vehicle infrastructure, tolling systems, transit dispatch, rail systems, bridge and tunnel systems, or emergency response coordination. For these and any other uses that could affect transportation operations, public safety, or other high-consequence decisions, the agency should understand the AI risks involved, manage operational technology data security risks, and train personnel before integrating AI, with enhanced review completed before AI is used at all.
This section is drafted with public agencies in mind, given their heightened public records and disclosure obligations, their responsibility for operational technology and public safety systems, and the requirements attached to public procurement and public funds, but by and large it applies equally to non-agency organizations in the transportation space, such as consulting firms, which often handle the same agency data under contract.
The distinction between this Secure Use section and the Governance section that precedes it is that Governance sets decision rights whereas Secure Use sets operating rules.
State of the Practice
Transportation agencies are increasingly evaluating and using generative AI to support internal productivity, planning, operations, data analysis, public communications, asset management, grants, procurement, and intelligent transportation systems. Federal and industry sources recognize that AI can support transportation safety, infrastructure, innovation, and efficiency, but also requires governance, risk management, cybersecurity, and data protection practices (USDOT 2025a).
Transportation agencies manage information that may affect public safety, infrastructure operations, emergency response, procurement, funding, and critical infrastructure. For transportation agencies, insecure use of generative AI may expose sensitive information such as traffic signal timing plans, ITS network diagrams, cybersecurity architecture, connected vehicle data, procurement documents, incident response procedures, personally identifiable information, legal materials, or non-public project information.
Cybersecurity and Infrastructure Security Agency (CISA) identifies AI security as central to federal systems and critical infrastructure, and CISA’s AI resources include guidance on data security, secure AI deployment, secure AI system development, and secure integration of AI into operational technology environments. CISA and partner agencies emphasize that data used to train, test, deploy, and operate AI systems must be protected because data security affects the accuracy, integrity, and trustworthiness of AI outcomes (CISA and ASD's ACSC 2025).
The National Institute of Standards and Technology (NIST) has developed the Artificial Intelligence Risk Management Framework (AI RMF 1.0) as a voluntary framework to help organizations manage AI risks and incorporate trustworthiness considerations into the design, development, use, and evaluation of AI systems. NIST also developed the Generative AI Profile, NIST-AI-600-1, as a companion resource to help organizations identify risks unique to generative AI and select risk-management actions aligned with organizational goals and priorities.
Consistent with this NIST risk-management approach, transportation agencies and organizations should define their own secure-use rules for generative AI, including which tools are approved, what data may be used, what cybersecurity and privacy protections are required, and how AI use will be governed and reviewed. These rules should be documented as agency policy controls, shaped by NIST guidance (NIST 2023).
TxDOT: Agency-led secure AI use
TxDOT’s AI Strategic Plan provides a useful transportation agency example for secure AI use. TxDOT identifies security, privacy, accuracy, accountability, transparency, trustworthiness, and safety as AI guiding principles. Its security principle emphasizes that AI systems should be designed, tested, and deployed securely, and that the confidentiality, integrity, and availability of agency data should be safeguarded. TxDOT’s 2026 update further emphasizes a “Human-Led, AI-Supported” approach, cross-functional risk review, and evaluation of AI risks, including information security, data privacy, and information integrity.
Protecting data when using AI tools
Protecting the data that goes into an AI tool is part of professional responsibility.
Data classification before AI use
Before entering information into a generative AI system, transportation agency transportation professionals should determine the classification of the data. Data classification is based on the sensitivity level or disclosure level of that data, such as whether the information is public, internal, confidential, sensitive, regulated, security-sensitive, or mission-critical. Maintaining the classification scheme itself (keeping the categories current, publishing them, and deciding which tools each category may be used with) sits with this section rather than with Governance, because its purpose is operational.
This is important because AI systems rely on data throughout development, testing, deployment, and operation, and CISA’s joint AI data security guidance identifies data resources as a critical component of the AI supply chain that must be protected and secured (NSA, CISA, and FBI 2025).
Agencies should consider prohibiting or restricting generative AI input involving:
- Personally identifiable information, protected personal data, or employee records.
- Non-public procurement information, cost estimates, scoring materials, or proposal evaluations.
- Security-sensitive ITS, TMC, tolling, signal, fiber, network, or connected vehicle architecture.
- Emergency response procedures or law enforcement coordination information.
- Cybersecurity vulnerability information, penetration test results, or incident response details.
- Draft legal positions, claims, litigation materials, or privileged communications.
- Unreleased financial, budget, grant, or interagency negotiation materials.
- Confidential consultant work products or proprietary vendor information.
Restrict public AI use
Agency users should not paste sensitive or non-public agency data into public or consumer generative AI tools. Public AI tools may process, retain, log, or use submitted information in ways that are inconsistent with agency confidentiality, public records, procurement, privacy, or cybersecurity obligations unless the agency has reviewed and approved the tool’s terms and technical controls.
This policy position aligns with the broader federal direction that agencies using AI should maintain public trust, preserve privacy, and apply risk management practices.
Data minimization for AI
Transportation agency personnel should use the minimum amount of information necessary when using AI-assisted tools. This follows the data-security principle of data minimization. CISA’s AI data-security guidance identifies data minimization, access controls, encryption, anonymization, and secure data transfer as focus areas during AI data collection and processing.
For practical use, agency staff should remove unnecessary sensitive details, such as personal identifiers, internal cost assumptions, procurement-sensitive content, or security-related information, before using an AI tool, unless the tool has been approved for that data type. CISA also identifies encryption, secure storage, provenance tracking, digital signatures, and trusted infrastructure as techniques that support secure AI data handling (White House 2025).
Human review of AI outputs
Secure use of generative AI extends beyond protecting input data and managing the cybersecurity risks of AI tools. Transportation agencies should also consider how AI-generated outputs may shape agency decisions, technical recommendations, operational procedures, procurement materials, grant materials, executive briefings, or public communications. Because these outputs can affect service quality, safety, reliability, cybersecurity, and public trust, agencies should require human review and validation before AI-generated content is used in official work products or decisions.
USDOT recognizes AI’s potential to support transportation safety, infrastructure, innovation, efficiency, and decision-making (USDOT 2025c), while the U.S. Government Accountability Office (GAO) notes that agencies face challenges using generative AI, including compliance with federal policies, data privacy policies, and appropriate-use policies (GAO 2025).
As a recommended transportation-agency control, AI-generated content should be reviewed for factual accuracy, consistency with agency procedures, protection of sensitive information, and technical validity before use in reports, public communications, engineering materials, procurement documents, grant materials, operational procedures, or executive briefings. This recommended control is also consistent with public-sector AI policies such as Texas Department of Information Resources (DIR)’s AI Acceptable Use Policy, which requires users to review and verify AI outputs, cross-check critical details against authoritative sources, and seek subject matter expert review for specialized content (Texas DIR 2026).
Reviewing terms of service and vendor conditions
Before approving a generative AI tool, transportation agencies should review the provider’s terms of service, privacy policy, data processing terms, security documentation, and procurement conditions. This review is necessary because the terms may determine whether agency prompts, uploaded files, outputs, user metadata, or other information can be retained, reviewed, disclosed, used for model training, transferred to third parties, or stored outside approved environments.
The White House Office of Management and Budget (OMB)’s federal AI procurement guidance emphasizes efficient AI acquisition while protecting privacy, public data, intellectual property, transparency, and vendor-related concerns, which are directly relevant to transportation agencies procuring or approving AI tools (Ropes & Gray 2025).
For agencies procuring such a tool for the first time, the list of topics that should be included in the review should include at least the following:
| Review topic | What the agency should determine |
|---|---|
| Data retention and deletion | The agency should determine how long prompts, uploaded files, outputs, logs, and metadata are retained, and whether it can require their deletion. |
| Use of agency data for model training | The agency should determine whether the vendor may use agency data to train, fine-tune, evaluate, or improve AI models. |
| Data ownership and intellectual property | The agency should determine who owns prompts, uploaded files, generated outputs, derivative works, and system logs. |
| Confidentiality and public records | The agency should determine whether AI tool records may become subject to public records, litigation holds, audits, or records retention requirements. |
| Cybersecurity and access controls | The agency should evaluate authentication, logging, encryption, administrative access, incident notification, vulnerability management, and third-party hosting arrangements to ensure alignment with agency policies and security requirements. |
| Data location and subcontractors | The agency should determine where data is stored, processed, and backed up, and whether subcontractors or downstream providers have access. |
| Acceptable use limitations | The agency should determine whether the tool’s terms allow transportation agency use cases such as planning, public communications, coding assistance, data analysis, procurement support, or operational support. |
CISA’s AI data security guidance (Cassidy et al. 2025) highlights risk across the AI lifecycle and recommends protections such as access controls, trusted infrastructure, encryption, secure storage, and secure deletion, which should be reflected in vendor review and procurement requirements.
Risks associated with personal accounts
Consistent with agency information security practices, transportation agency personnel should conduct agency business only through agency-approved tools, managed accounts, and controlled environments. Personal generative AI accounts, plug-ins, browser extensions, and unapproved third-party AI applications should not be used for project work, consultant deliverables, procurement support, operational analysis, public communication drafting, or other agency business. These tools may lack agency-approved security controls, contractual protections, auditability, administrative oversight, records management, data loss prevention, logging, and monitoring. Where access permissions are broad or unmanaged, such tools may also access, process, retain, or expose information beyond the user’s intended prompt or uploaded file.
Using a personal account for agency work may create the following risks:
- Agency information may be stored under an individual’s personal terms of service rather than agency-approved terms.
- The agency may not be able to retrieve, audit, preserve, or delete records.
- Sensitive project or operational information may be exposed outside agency systems.
- The agency may lose visibility into who accessed, uploaded, or generated content.
- Work products may not comply with public records, procurement, confidentiality, or cybersecurity policies.
- Agency data may be mixed with personal data or unrelated work.
This is especially important because federal and transportation-sector sources identify governance, oversight, procurement, data standards, and risk management as key AI adoption needs for transportation agencies (NOCoE 2025). Using only agency-approved AI tools and managed accounts is essential to secure AI use. Managed enterprise environments provide the controls agencies need to govern AI activity, including role-based access, logging, retention controls, data protection, security review, and administrative oversight. These controls help reduce the risk of unauthorized access, unmanaged data retention, and use of agency information outside approved environments. This approach is consistent with NIST’s AI RMF emphasis on governance, risk management, and trustworthy AI practices, as well as CISA’s emphasis on securing AI systems and the data used to operate them.
Managing cybersecurity issues related to generative AI
Generative AI should be treated as part of the agency’s cybersecurity environment when it connects to agency data, applications, cloud platforms, operational systems, code repositories, document management systems, traffic systems, or public communication channels.
Transportation agencies already face cybersecurity considerations for ITS assets, signal systems, field devices, traffic management centers, and communications networks. USDOT’s ITS cybersecurity best practice guidance provides practices for cybersecurity planning and penetration testing for state and local DOTs, while USDOT procurement guidance provides cybersecurity language for ITS equipment procurement (USDOT ITS JPO n.d.).
Transportation agencies should consider the following cybersecurity risks:
Data leakage
Sensitive agency information may be exposed through prompts, file uploads, browser extensions, plug-ins, APIs, or connected applications.
Prompt injection
AI tools connected to documents, websites, email, or workflows may be manipulated by malicious instructions embedded in content. The vectors that matter most for transportation agencies today are documents received from outside the agency, such as external submittals and plan sets, where hidden text can bias a summary or suppress a caveat; retrieval over manuals and standards, where the text the tool pulls in may have been deliberately altered to steer its answer, a practice known as poisoning, or may simply be outdated or non-authoritative, and is then returned as though it were agency guidance; and connectors or agents with tool access, where a single injected instruction can cause the tool to query a database, edit a file, or send a message. It is a workflow, tool-use, and supply-chain risk, affecting AI tools and agents that read external content, use connectors, execute reusable skills or workflows, retrieve documents, or take actions on a user's behalf. It applies equally to retrieval systems, connector servers, web browsing, email assistants, coding agents, and document-review workflows. Agencies should treat external content as data to be analyzed rather than as instructions to the tool, require cybersecurity review before AI is connected to any system that can take an action, and require human confirmation before an AI-initiated action reaches agency systems or external recipients. Key risks are provided in the table below.
| Risk | Relevance and Impact |
|---|---|
| Uploaded PDFs / reports | Hidden instructions may bias summaries, omit caveats, or alter conclusions. |
| RAG over manuals and standards | Retrieved text may contain poisoned instructions, outdated material, or non-authoritative guidance. |
| AI agents with tools | The assistant may query databases, edit files, send messages, or call APIs. |
| Claude /skills or similar reusable workflows | Shared workflow instructions may embed unsafe procedures or excessive permissions. |
| MCP/connectors | Tool outputs and external systems become part of the model’s context and attack surface. |
| Persistent project memory | A one-time injection may become a standing instruction. |
| Coding agents | PRs, issues, READMEs, or comments can manipulate the agent into unsafe code or credential exposure. |
Malicious or insecure code generation
AI-generated code, scripts, formulas, or configurations may introduce vulnerabilities if used without review.
Phishing and social engineering
Generative AI can be used by attackers to create convincing phishing messages, impersonation attempts, fake notices, and fraudulent communications.
Unauthorized system integration
Staff may connect AI tools to agency systems without cybersecurity review, creating unmanaged access paths.
Data poisoning and integrity risks
AI systems may be affected by unreliable, maliciously modified, or drifting data, which can undermine AI outcomes.
CISA’s AI data security guidance identifies data supply chain risks, maliciously modified or poisoned data, and data drift as significant AI data security risk areas, and CISA’s AI resources include guidance on secure AI deployment and secure AI system development.
Transportation agencies should apply additional caution before using AI with operational technology or mission-critical systems such as traffic signals, TMC systems, ITS devices, connected vehicle infrastructure, tolling systems, transit dispatch, rail systems, bridge/tunnel systems, or emergency response coordination.
CISA and international partners have issued guidance on the secure integration of AI into operational technology, emphasizing that agencies should understand AI risks, manage operational technology (OT) data security risks, and train personnel on AI before integrating AI into OT environments.
To support secure AI use and maintain agency control over approved AI tools, agencies should consider implementing the following controls:
Roles and responsibilities
The roles below are the operational roles for secure AI use. They sit alongside the governance roles defined in the Governance section (executive sponsor, AI policy owner, AI review group leader, AI system owner, and data steward), which set direction, own the policy, approve tools, and answer for the data rather than administer day-to-day security.
Agency leadership
Agency leadership should define acceptable AI use, approve risk tolerance, assign governance responsibilities, and ensure AI use aligns with the agency's mission, public trust, cybersecurity, and legal obligations. NIST’s AI RMF is organized around governance, mapping, measuring, and managing AI risks (NIST 2023), and OMB’s federal AI guidance emphasizes governance and public trust in agency AI use (OMB 2025).
Information technology and cybersecurity
IT and cybersecurity staff should review AI tools before use, assess vendor security, monitor risks, manage access, and coordinate incident response.
Legal and procurement
Legal and procurement staff should review terms of service, data ownership, confidentiality, public records, insurance, indemnity, intellectual property, and vendor obligations.
Program and operations staff
Transportation program staff should confirm whether AI use is appropriate for specific planning, operations, safety, engineering, communications, or grant-related tasks.
Consultants and contractors
Consultants and contractors should use only agency-approved AI tools for agency work and should not submit agency data to personal or unapproved AI systems.
Sources cited on this page are listed in full on the References page.