# MBAC + Ohio AI Compliance Checklist

**Version v1.0 (2026-07-27). Plain-language, source-cited. Review quarterly and at ODOD grant renewal.**

## The lay of the land (3 facts)

1. Ohio's governing rule for AI in state government is **Ohio Administrative Policy IT-17, "Use of Artificial Intelligence in State of Ohio Solutions"** (Department of Administrative Services, effective Dec 4, 2023). It covers all state agencies under the Governor, which includes the Ohio Department of Development (ODOD), and it explicitly extends its generative-AI rules to **contractors** doing state business.
2. The oversight body is the **State of Ohio Artificial Intelligence (AI) Council** (chartered January 2024 under IT-17). That is the correct name; there is no body called "AI Ohio Counsel," and there is no Governor's executive order on AI.
3. Ohio currently has **no general AI statute**. The direction of travel is clear though: HB 96 already requires every school district to adopt a written AI policy, and multiple AI bills are pending. A written AI policy is the cheapest insurance MBAC can buy.

**Does IT-17 bind MBAC directly?** ODOD, yes. The Cincinnati MBAC's host (the African American Chamber) is a grantee, so it depends on flow-down language in the ODOD grant agreement, which is not public. **Action: pull the current agreement and check.** Until then, the defensible posture is to operate as if IT-17 applies. Everything below assumes that posture.

## The checklist

**Data**
- [ ] No client PII or non-public business data ever goes into a general AI chat. Category labels only ("Client A"). *(IT-17 §III.B.3, §III.D)*
- [ ] PII beyond ordinary contact details is only ingested after double-verifying with its author/owner (see MBAC Global Instructions rule 3).
- [ ] MBAC uses a business-grade AI deployment with training on our data disabled (Claude for Work), never free consumer accounts. *(IT-17 bans sensitive data in "unconstrained, publicly accessible" AI tools)*
- [ ] Nothing is deleted by AI, ever. Archive folders + human-only final deletion. *(MBAC Global Instructions rule 2; supports ORC 1347 record duties)*

**Approval & contracts**
- [ ] Written approval for AI use from the host org's executive director, on file. *(mirrors IT-17 §III.B.1 director approval)*
- [ ] ODOD program manager notified in writing of MBAC's AI use and safeguards. *(mirrors AI Council use-case approval)*
- [ ] Current ODOD grant agreement checked for AI/data flow-down clauses; recheck at renewal. *(IT-17 §III.C.3 requires state contracts to restrict contractor AI use of state data)*

**Disclosure & consent**
- [ ] The approved AI disclosure line appears wherever a client relationship starts (intake page, first outreach email, session recording notice).
- [ ] Clients consent at intake before AI touches their information (consent checkbox on the landing page). *(IT-17 §III.D.2; ORC 1347)*
- [ ] Internal log notes when AI helped produce any client deliverable or correspondence. *(IT-17 §III.B.2 disclosure duty)*

**Human control**
- [ ] Every AI-assisted output a client sees gets a human review before it goes out. Nothing auto-sends. *(IT-17 §III.A.6-7)*
- [ ] Anything with legal or financial impact on a client (loan packaging, certification advice) gets a documented human verification step, not just a skim. *(IT-17 §III.A.7)*
- [ ] Each skill file names its human checkpoint and zone; the counseling relationship stays human-only. *(IT-17 §III.A.5: AI never makes the decision)*

**Records**
- [ ] One page per AI workflow (the skill file IS that page) kept in the Monday SOP library. *(mirrors IT-17 use-case documentation)*
- [ ] This checklist reviewed quarterly; pending Ohio AI bills (HB 185, HB 524, SB 163, HB 628) rechecked each review.

## Sources

- IT-17 policy: das.ohio.gov/technology-and-strategy/policies/it-17 (full text: digitalgovernmenthub.org/wp-content/uploads/2024/02/IT-17.pdf)
- AI Council Charter: dam.assets.ohio.gov (das.ohio.gov technology-strategy policy area)
- Ohio AI legislation status: Ohio Capital Journal, 2026-05-18, "Why Ohio doesn't have any artificial intelligence regulations"; Franklin County Law Library Ohio AI guide (fclawlib.libguides.com/AI/Ohio)
- HB 96 school AI policy mandate: govtech.com, "New Ohio Law Requires Policies for AI and Cellphones in Schools"