SAM Changes

February 2025

Section Action Type Changes
SAM 4986.1 New Sets forth the requirements for the responsible and secure use of GenAI within the State. The policy focuses on minimizing risks while ensuring efficiency, confidentiality, and integrity to processes and operations
SAM 4986.2 New Provides the definitions specific to the GenAI policy
SAM 4986.3 New Outlines the requirements to identify, track, and maintain an inventory of high-risk GenAI for annual reporting to the State legislature
SAM 4986.4 New Requires transparency about the data used to train GenAI systems and services by posting relevant documentation on the state entity’s websites by January 1, 2026
SAM 4986.5 New Mandates that any new, expanded, or refreshed GenAI must adhere to the Cloud Computing Policy, SAM 4983.1
SAM 4986.6 New Mandates that all GenAI POCs be hosted in a CDT “sandbox” environment and all MVPs in a CDT- approved production environment
SAM 4986.7 New Mandates specific assessments and project planning prior to procuring or developing an IT Project Utilizing GenAI
SAM 4986.8 New Requires any State Entity approved to proceed with an IT Project utilizing GenAI to follow the SIMM 19H Project Delivery Lifecycle (PDL) to ensure proper management and oversight
SAM 4986.9 New Requires compliance with GenAI procurement policies and disclosures
SAM 4986.10 New Requires State Entities using or procuring GenAI to protect data privacy and security according to state and federal laws and policies
SAM 4986.11 New Outlines security incident reporting and compliance requirements for GenAI, including the State Entity’s Incident Response Plan, and prompt reporting of violations to CDT
SAM 4986.12 New Requires education and compliance with the Acceptable Use Policy. Prohibits the use of GenAI for illicit, controversial, or biased content. Outlines acceptable use of GenAI
SAM 4986.13 New Requires state personnel to complete the necessary GenAI training relevant to their roles to ensure the proper understanding and use of GenAI
Print page