Waltham's AI Use Is Early, Uneven, and Mostly Bought From Vendors
The Waltham Times, which reported the meeting, quotes Aucoin as saying the city is still in the "infancy stages" of AI use. Not every municipal employee uses AI. Most of what does happen is "assistance" work, meaning help with writing and editing. Drafting police reports was one example he gave.
Past that baseline, use differs a lot from department to department. According to the Times, the Department of Public Works uses conversational AI for data analysis, including predicting flooding risks and infrastructure needs. The Police Department already uses AI-powered software from QED to analyze data and inform policing decisions, and it is looking at more powerful hardware so it can run other AI tools. The city is also exploring AI in municipal hiring. That last item is still at the exploration stage. Nothing has been deployed.
Microsoft Copilot is the one Microsoft product named, and the rule is narrow: it is restricted to administrative assistants. The reporting doesn't say which Copilot product or license is involved, how the restriction is enforced, or why the line was drawn there. Waltham may well be managing Copilot deliberately, but nobody has published a Copilot policy that other IT admins could learn from. What the record shows is that the city has a Copilot rule and no general AI policy around it.
Aucoin said most city software comes from third-party vendors, and AI has become a sales buzzword. "There isn't a piece of software right now that isn't claiming to be implementing some form of AI," he told councilors, describing the situation as "like the Wild West."
No Central Review Before Departments Buy AI Software
The most important admission from the meeting was about procurement. Aucoin said the IT Department does not vet other departments' software purchases. "I'm not always the one evaluating this software," he said, explaining that departments have very specific tasks and often understand those requirements better than IT does.
He also said Waltham has no central policies governing AI safety or software purchases. He and other department heads have been reading about AI risks and best practices, but that reading hasn't become rules.
Together, those two facts explain how AI can end up running inside a city without anyone deciding to put it there. If a department renews a records, analytics, or case-management product and the vendor has added AI features, nobody at the city level has to sign off. Aucoin's line about every product claiming AI is really a warning that the city's software inventory is changing underneath it.
The council's first response dealt with exactly this. Councilors asked Aucoin for a full list of city software that contains AI integrations, plus any departmental policies that govern software purchases. The reporting doesn't say how the city will define an "AI integration" or when the list is due. That definition will decide whether the inventory catches only the obvious chatbots or also the AI features built into vendor platforms.
Data Handling Is Waltham's Biggest Open Question
The weakest point in the city's position is data. Aucoin said he is very concerned about data security and access. According to the Times, however, Waltham doesn't appear to have a clear policy on how AI tools may use and store data.
Councilor-at-Large Tim King asked a sharper version of the question. Had the city considered running AI tools on a local server so that information doesn't leave the city through training data? Aucoin couldn't give a clear answer.
It's important to be precise about what that exchange shows. Nothing in the record says any Waltham tool trains on city data or that any data has left city systems. The exchange does show that nobody at the meeting could say how city data moves through the AI tools already in use. For a government whose AI use reportedly includes police report drafting and policing analytics, that's a real gap. Knowing where the data goes should come before buying more hardware or adding hiring tools.
King's local-server idea is one answer, but only one. Hosting a model locally changes where the data sits. It doesn't settle who can reach it, how long it's kept, or how outputs are checked. Those are the policy questions Aucoin says the city hasn't answered, and running things on-premises wouldn't answer them automatically.
How the Everett Incident Frames Waltham's Security Case
Aucoin named AI-assisted cyberattacks as one of his main concerns as AI use grows. He also said Waltham's digital assets are well protected, that he regularly compares notes with other municipalities, and that he isn't currently worried about an incident like the one that recently shut Everett's city hall.
The Everett incident he referred to is well documented. The city said that around 6:30 p.m. on Sunday, September 6, it discovered the cybersecurity incident and immediately began working with its IT team and cybersecurity professionals to investigate the incident and safely restore impacted systems. City Hall closed to the public on September 8, and City Hall will stay closed through Thursday, Everett announced on Tuesday afternoon, moving basic services to the Connolly Center. Third-party systems used by the City for online bill payments and other online transactions remain operational. Everett did not identify the affected systems. NBC Boston reported that Springfield Public Schools also closed after a cyber incident the same week, although there's no indication the incidents were related.
Aucoin's confidence is his own professional judgment. It isn't the result of an independent audit. His concrete plan is more useful to other admins. He told councilors he is working with state officials to get Waltham access to security programs that use AI to run constant security audits of the city's web assets. The reporting doesn't name the state program or the provider, and it doesn't say whether Waltham has access yet, so treat it as something the city is pursuing and not a tool already running.
This is also why Aucoin won't take on AI governance himself. He argued that his department needs to focus on cybersecurity and on keeping the city's digital infrastructure up to date. He sees governance work as competing for the same few people who defend the network.
Aucoin's Steering Committee Plan Puts AI Governance on Finance and HR, Too
Aucoin's proposal is a "steering committee" made up of members from across city departments, which would set AI policy and provide oversight. He suggested including representatives from Finance and HR. The Times notes, with some irony, that he said a conversational AI program suggested those two departments.
The two choices fit the problems described at the meeting. Finance is close to purchasing, and purchasing is where Waltham currently has no AI review. HR would matter if the city goes ahead with AI in hiring. Aucoin said the committee would need resources and not just a charter: "That involves funding; it involves backing and support, and it involves staffing."
He framed the issue as bigger than his department. "This isn't an IT problem," he told councilors. "This is a global, federal, state and local problem. It's a community problem."
The procedural history shows the council started this conversation. According to Ward 3 Councillor Bill Hanley's published council notes, a resolution examining AI use in municipal government was referred to the Committee of the Whole at the September 14 meeting. A separate council-meeting report attributes the resolution to Councilor-at-Large Carlos Vidal and says it asked the IT department to detail the city's AI use. The September 21 committee docket listed it as "Use of Artificial Intelligence in City Government Resolution." Hanley's notes confirm Aucoin spoke about the current and future state of AI in city applications and that the matter was tabled for further discussion. The next full council meeting is September 28, 2026. No record so far shows the council adopting a policy or forming the committee.
What this means for you
If you run IT for a city, school district, or small multi-department organization, the decision here is whether to wait for a policy or start with an inventory now. Waltham's case supports starting with the inventory. The city's AI exposure comes mostly from decentralized purchasing and vendor features, not from one tool IT controls, so a Copilot rule alone covers only a small part of it. The points below come from what Waltham did, and from what it admitted it hasn't done yet.
- Waltham's council asked first for a list of every piece of software containing AI integrations, and that is a practical first step for any organization in the same position.
- Decide how you define an "AI integration" before you start the inventory, because features built into vendor platforms are easy to miss if you only count standalone chatbots.
- Restricting Microsoft Copilot to one role, as Waltham does for administrative assistants, still leaves vendor AI in other departments' software unreviewed.
- Work out how each AI tool uses and stores your data before you expand to sensitive areas like hiring. Waltham couldn't answer that question when a councilor asked it.
- If IT doesn't approve departmental purchases, give AI review a formal place in procurement, which is why Aucoin wants Finance on his proposed committee.
- Budget for governance as its own job. Waltham's IT director explicitly declined to take it on alongside security and infrastructure work.
Waltham's meeting produced no policy, but it produced an honest account of where things stand. AI is already in police reporting, public works analytics, and vendor software. No central review exists, data handling can't be explained, and an IT director is saying plainly that his team can't close those gaps alone. The inventory councilors requested will be the first concrete measure of how much AI the city is actually running, and the September 28 council session is the next place the steering-committee idea could move forward or stall.