Pitt Cyber: Small PA Towns Use Generative AI Without Rules

A small Pennsylvania survey worth reading closely. Researchers at the University of Pittsburgh's Institute for Cyber Law, Policy, and Security, working with the Local Government Academy, asked 35 senior staff at townships and boroughs serving 5,000 to 20,000 residents how they were using generative AI. Two-thirds said they used it at least monthly for work. In the authors' framing at Tech Policy Press, AI 'arrived rather than being formally adopted' in these offices.

The composition is the interesting part. Over half of respondents said their government had deployed enterprise tools like Microsoft Copilot, and more than a quarter said they were also using personal, free accounts like OpenAI's ChatGPT for work tasks. Most municipalities lack a generative AI policy, though a majority of the staff surveyed said one would be valuable. Primary uses were mostly writing, summarizing and taking meeting notes, with a minority mentioning surveillance and identification applications.

Why this matters beyond one state: Pennsylvania has 2,555 municipalities, nearly 90% of them with fewer than 10,000 residents. That distribution is not unusual, and the operational picture the study describes, of people quietly pasting things into whatever tool works while 'leadership sits in neutral', is what actual AI governance in local government looks like right now. The staff named lack of staff expertise as the biggest barrier to responsible adoption at 50%, with budget constraints second at 38%. They said they wanted peer-to-peer learning and examples from similar-sized governments, not another framework.

The honest caveats are that 35 respondents is a small sample, the survey does not document specific incidents of misuse, and the piece does not tell you how many of these towns already have any policy in force or what those policies actually say. Take the pattern, not the precise percentages, as the finding.

The fix the authors point to is cheap. They recommend activating what already exists: state municipal associations, councils of governments, universities, and regional nonprofits, to produce locally applicable guidance and basic training. Whoever ships a plain-language use policy and basic training first will effectively set the default for a lot of small government offices before any legislature does.