The distinction is more important than the generic label “AI” suggests. A staff member asking a secure assistant to summarize a report presents one set of privacy, accuracy and records-management problems. A camera-driven system observing vehicles, cyclists and pedestrians in public space creates another. Courtenay has already deployed the latter while it is still developing a broader internal AI policy; the regional district has moved first on rules for staff use while applying AI to drafting, research and communications.
That is the useful takeaway from The Discourse’s survey of Comox Valley governments and public organizations: the Valley does not have one local AI policy story. It has a patchwork of procurement controls, productivity experiments, school-district caution and library publishing rules, with significant questions still unanswered about elected officials, contractors and public disclosure.
CVRD’s GovAI rule is a procurement and data-control decision
The regional district’s policy, as described by The Discourse, permits staff to use GovAI for early drafts of communications and reports, writing suggestions, document summaries, research leads and interactions with approved AI agents. Staff remain responsible for reviewing and revising the results. A privacy impact assessment is required when authorized generative AI is used in processes that routinely collect, use or disclose sensitive personal information.
Those are sensible guardrails, but the most consequential provision is the product restriction. By banning staff from using ChatGPT, Claude, Meta AI and DeepSeek, and prohibiting acquisition of contracted services or hardware using AI other than GovAI, the CVRD has made its policy an IT procurement control as much as an acceptable-use policy.
That approach reduces the familiar risk of an employee pasting an internal draft, a resident complaint, a procurement detail or personal information into a consumer chatbot. It also makes it easier for IT staff to identify which vendor, data terms and retention model the organization has accepted. What the regional district has not publicly detailed, however, is the technical identity of GovAI, its hosting arrangement, its model provider, its logging and retention rules, whether prompts can be used to improve models, or whether it is connected to internal CVRD data.
Those omissions are not trivial. “Approved AI” is not a useful assurance by itself. Administrators and residents need to know whether the approval rests on tenant isolation, enterprise data protection, Canadian data residency, contractual controls, a privacy assessment, or simply an internal instruction to avoid public chatbots.
The policy also applies to staff, not elected officials. The Discourse reported that CVRD corporate-services manager Jake Martens said the district intends to review how the policy should apply to regional-district leaders in future. Until that happens, the organization has a defined set of rules for the people producing draft bylaws and staff reports, but no reported equivalent framework for directors who may use AI to prepare public statements, analyze documents or communicate with constituents.
Courtenay has deployed traffic AI before finishing its corporate policy
Courtenay’s Intelligent Intersection Pilot is already operating at Cliffe Avenue and 5th Street, one of the city’s busiest and most complex intersections. The city announced in May that staff began implementing Miovision’s AI-based traffic analytics technology in January 2026, ahead of intersection renewal work. The system is intended to provide a continuous picture of vehicle queues, pedestrian movements, cycling activity, transit operations and safety-related interactions rather than relying only on periodic traffic counts.
This is a narrowly defined use of AI: it analyzes transportation activity to support operational planning. It is not described as making traffic-enforcement decisions, issuing tickets, identifying people or deciding who receives a public service. That boundary deserves to be kept clear, particularly when “AI cameras” can easily be mistaken for facial-recognition systems.
Courtenay told The Discourse it completed an AI Impact Assessment for the project and said the cameras do not collect personal information. The city’s public pilot announcement separately says the system complies with British Columbia’s Freedom of Information and Protection of Privacy Act. Both statements establish the city’s position, but neither public account spells out the details that would let residents independently assess the conclusion: whether source video is retained, how long analytical data is stored, whether images are processed at the edge or sent to a cloud service, whether vehicle identifiers are technically detectable, and who at Miovision or the city can access the information.
Those are the questions that turn a privacy claim into a verifiable practice. The reported absence of personal-information collection is reassuring, but it does not remove the need for an accessible explanation of system configuration, retention and access controls—especially because the pilot continuously observes a public intersection used by people walking, cycling, taking transit and driving.
Courtenay is developing a broader AI policy, with work expected to begin later in 2026. In the meantime, it says staff are exploring AI productivity tools in a secure Microsoft 365 environment, with employees accountable for their work and final decisions. The city also told The Discourse that contractor agreements do not yet require suppliers to disclose AI use, although contractors remain bound by existing confidentiality, security, data-use, quality and intellectual-property terms.
That leaves a governance gap. A contractor can apparently use AI without telling the city, provided the work meets conventional contractual obligations. For low-risk tasks, that may be manageable. For work involving public data, confidential plans, engineering designs, communications or research, a general confidentiality clause does not tell the city which system received the data, whether material was retained, or whether AI-generated work was independently checked.
B.C.’s Copilot rules show the standard local governments should meet
The B.C. Public Service has already drawn a practical line that local governments can use as a benchmark. Provincial employees may put confidential information into Microsoft Copilot Chat only when they are signed in through the government’s identity system and enterprise data protection is active. They must not put confidential or personal information into publicly available generative-AI services such as ChatGPT.
The provincial policy also requires employees to check AI outputs for factual accuracy, completeness and currency, then edit language for inclusion, respect and compliance with government writing standards. That is not bureaucratic padding. Large language models can generate plausible but wrong statements, cite nonexistent sources, flatten legal or policy nuance, and reproduce bias from their training data. A final human reviewer must be accountable for the record.
There is a material technical caveat for anyone equating “Copilot” with unrestricted access to internal files. B.C.’s own current workstation guidance says the Copilot Chat version available to provincial employees cannot access personal OneDrive or SharePoint Online files within the government tenancy. In other words, it is an approved conversational tool with enterprise protections, not automatically a knowledge-management agent that can search everything an employee can see.
Courtenay’s statement that it is using Microsoft 365 in a secure environment does not identify which Copilot product or data-protection settings it is evaluating. The CVRD’s reported GovAI policy similarly does not identify the underlying service. For local IT teams, the product name is not enough: Microsoft offers several Copilot experiences with different controls, integrations and data-handling implications. The organization must document what is enabled, what users may enter, what data the tool can retrieve and what audit trail remains.
Schools and libraries are staying at the policy-first edge
Comox Valley Schools told The Discourse it is still exploring and consulting on AI’s possible role in the district. It has technology and privacy procedures that apply to AI as they do to other digital tools, but it has no AI-specific policy.
That restraint is appropriate given the population involved. B.C.’s privacy commissioner has warned that children are among the groups most vulnerable to generative-AI harms because they may be less able to recognize or challenge biased or inaccurate information and may be more susceptible to systems that constrain their agency. A school district cannot treat a classroom chatbot as merely another website or writing aid; student data, assessment, accessibility supports and academic-integrity rules each demand their own decisions.
The Vancouver Island Regional Library also has no formal AI policy, according to The Discourse, and says staff use is limited and varies by department. Its Sea & Cedar magazine provides a sharper, public-facing rule: it does not publish AI-generated writing or art, and accepted contributors must verify that submissions are original and human-generated.
That is a narrower policy than an internal AI-use framework, but it is clear. It tells contributors exactly what authorship standard applies and avoids a difficult editorial dispute after publication. The library’s broader challenge will be translating that clarity to information access and digital-literacy work, where patrons increasingly encounter AI-generated search answers, images and text presented with little indication of origin.
The missing public record is the next problem to solve
The Comox Valley is not waiting for a perfect policy before using AI. Courtenay’s traffic pilot proves that. The CVRD’s staff policy shows an organization can impose practical limits before every long-term question is settled. But the region’s public bodies should now make the operating details easier to inspect.
At minimum, published AI registers should identify approved tools, prohibited tools, owners, intended uses, data categories allowed and barred, privacy assessments, retention periods, human-review requirements, contractor disclosure rules and the policy that governs elected officials. For systems that observe public spaces or shape services, agencies should explain the limits in plain language before residents have to file access requests to discover them.
For now, the most concrete consequence is local and immediate: CVRD staff have an approved lane for generative AI, while Courtenay has a live AI analytics system at a major intersection but no completed organization-wide policy. The next policy documents need to close the gap between those two realities—before the technology becomes routine enough that nobody can say who authorized which use, what data went into it, or who checked the answer.