Public Records

Selected-field transcription of the City’s MUNIS contract-register release. Original row 18375 identifies City Detect/vendor 37370, contract 26-1303-00: Revised Total $202,500, Expended Total $135,000, Available Total $67,500. These are register fields, not an executed agreement, invoices or bank-clearing proof. Original row 11413 separately identifies ePlus/vendor 16681, contract 20-3019-00: Expended Total $2,617,964.70 and Open Purchase Order Total $57,319.48. The reseller totals cover the contract broadly; no factory-only subtotal is supplied. Its unexplained $1,099,999,989 Original/Revised Total is not treated as a factory price. Public extract excludes unrelated rows and personal identifiers; complete original preserved.

Selected-field transcription of PO 20263204 in the City’s August MUNIS release. Header row 4232 lists ePlus/vendor 16681, contract 20-3019-00, Create Date June 24, 2026, Total Ordered and Total Liquidated $419,124.80, and status “0 - Closed.” Ten product lines in rows 4233–4251 reconcile to that amount; their account rows 4234–4252 use fund/Org 4001, object 570284, project E1903, description SOFTWARE. The product descriptions identify Prisma and Palo Alto items. The record connects this order to the cybersecurity account; it does not identify factory server hardware or establish a cleared payment. Public extract excludes unrelated rows and personal identifiers; complete original preserved.

Selected-field transcription of original row 672 from a later City MUNIS release: PO 20263204, ePlus/vendor 16681, contract 20-3019-00, Create Date June 24, 2026, Total Ordered and Total Liquidated $419,124.80, zero Total Balance and status “0 - Closed.” This is the same order in the August release, not another purchase or independent accounting origin. The summary does not supply its item or project-account detail. Do not add the two releases together or infer cash clearing or a factory-specific cost. Public extract excludes unrelated rows and personal identifiers; complete original preserved.

AI-use reference. Current. Applies to: Covered recordkeeping agencies and political subdivisions Requirements or purpose: No secret personal-information systems; establish need before collection, relevance, accuracy, reliability, correction procedures and protection from misuse. Collection must be explicitly or implicitly authorized by law; personal information may not be sold. Dissemination permitted only through specified lawful/proper-purpose pathways. Limits: Applies only to systems within chapter scope; § 2.2-3802 excludes listed court, criminal-justice, investigative and other systems. Technology-neutral safeguards can apply to AI inputs/outputs containing personal information; do not equate every AI system with a covered personal-information system.

AI-use reference. Current. Applies to: Commonwealth/local governmental entities and contractors operating personal-information systems to perform agency functions Requirements or purpose: Defines agency to include city departments and such public/private contractors, limited to contracted services. Personal information includes biometric patterns, faceprints, photos, audio/video and information supporting inferences about people. Limits: Consumer-reporting contractor may satisfy chapter by full applicable FCRA compliance. Routine internal administration with no adverse effect potential and real-estate assessment information excluded from personal-information definition.

AI-use reference. Current. Applies to: Determines scope of Government Data Collection and Dissemination Practices Act Requirements or purpose: Lists exempt personal-information systems, including courts, specified criminal/juvenile justice information systems, and city/county police and sheriffs systems dealing with criminal investigation/intelligence. Limits: Not a blanket exemption for every police administrative system or every city database. Several social-services provisions redirect requests to local custodians; scope is system/function-specific.

AI-use reference. Current version explicitly distinguished from future version. Applies to: Covered agency personal-information systems; public bodies with websites Requirements or purpose: Collect/use only lawful or proper-purpose data; maintain accuracy, completeness, timeliness and relevance for fair determinations. Require security/usage assurances before dissemination to another system, access categories, regular-access lists, qualifying access records and staff rules/training. Safeguard systems against foreseeable threats; restrict political/religious data and personal-information dissemination to enumerated pathways. Publish a conspicuous, tailored internet privacy statement describing collection and use. Limits: Access-log requirement excludes specified internal service access and lasts three years or until purge, whichever shorter. Listed intergovernmental exceptions apply. Do not cite July 1, 2027 variant as already effective. Applies only to systems within chapter scope; § 2.2-3802 excludes listed court, criminal-justice, investigative and other systems.

AI-use reference. Current. Applies to: Data subjects and covered agencies Requirements or purpose: Explain whether requested information is mandatory and known consequences; provide dissemination notices. Identified subjects may inspect their data, sources, nonregular recipients and consent records, with stated exceptions. Investigate challenges; promptly correct/purge inaccurate or unnecessary data; unresolved disputes allow a statement and downstream notification. Limits: Not a public right to everyone else’s personal data. Personnel references, examination security, tax confidentiality and chapter exemptions limit access.

AI-use reference. Current. Applies to: Agencies operating/developing covered information systems Requirements or purpose: Report system existence, nature of data and purpose; make an inventory/listing or similar display available for public inspection in the agency head’s office; provide copies on request. Limits: Does not explicitly require online posting, annual AI-only inventory, public model weights, or every full technical document. Applies only to systems within chapter scope; § 2.2-3802 excludes listed court, criminal-justice, investigative and other systems.

AI-use reference. Current. Applies to: Aggrieved persons; covered agencies and specified officials Requirements or purpose: Allows injunction/mandamus to prevent or remedy chapter violations; successful aggrieved parties receive costs and reasonable attorney fees. Specified SSN violations and knowing/willful unlawful dissemination by officials carry stated civil penalties. Limits: Penalty clauses are tied to specified statutory violations; not every AI error automatically incurs a fine. This record establishes available legal routes, not a finding of a violation.

AI-use reference. Current codified section. Applies to: Public bodies expressly include cities, city councils, school boards, public universities and advisory bodies; applies directly to Newport News within statutory terms. Requirements or purpose: No public body may use hardware, software or services DHS prohibits on federal systems, including through work for another public body. Qualifying cybersecurity incidents must be reported to Virginia Fusion Intelligence Center within24 hours of discovery. Limits: Not all AI software is prohibited, and not every technical error is a reportable incident. SubsectionC defines incident thresholds. SubsectionD protects cybersecurity information in VITA possession; it is not a blanket secrecy rule for every local AI document.

AI-use reference. Current codified section. Applies to: Employees/agents and contractors of public bodies including cities; specified government devices/equipment or Commonwealth-owned/operated/maintained Internet networks. Requirements or purpose: Prohibits covered downloading/use of applications or accessing websites developed by ByteDance or Tencent, including TikTok/WeChat; applies according to company/successor definitions. Limits: This section does not name DeepSeek and should not be described as a universal China-based AI ban. SubsectionC permits law-enforcement-related exceptions granted by State Police superintendent or appropriate city/county chief law-enforcement officer.

AI-use reference. Current. Applies to: Businesses targeting Virginia residents meeting statutory data/revenue thresholds Requirements or purpose: Coverage generally requires control or processing of at least 100,000 consumers’ personal data in a year, or at least 25,000 consumers plus over 50 percent of gross revenue from personal-data sales. Limits: § 59.1-576 exempts state/local governmental bodies, HIPAA entities/business associates, specified financial entities/data, nonprofits and higher education; numerous data exemptions also apply. Not a city-wide AI regulation; applicability to a private supplier depends on its activities and exemptions. Employment-context data and FERPA-regulated data are among express information exemptions.

AI-use reference. Current; rescinds EO 30 (2024) and ED 5 (2023) while preserving implementing policies/standards/guidelines. Applies to: State executive officials/agencies and AI Task Force; data-center provisions have separate subject matter. Requirements or purpose: Creates rapid-response AI Task Force and AI Policy Planning Unit; directs assessment of legal enforcement, workforce/privacy and cybersecurity risks and responsible-use best practices; executive agencies must prioritize requested support. Limits: Task-force creation is not a comprehensive municipal AI-use code. Crucially, rescinding EO 30 did not repeal VITA's implementing policies: p 9 expressly continues them until replaced by future executive or agency action.

AI-use reference. Current linked policy, June 2026 revision 1.1; preserved by EO 22's continuation clause. Applies to: Executive Branch state agencies and public higher-education institutions managing IT; higher-education research/instruction excluded. No automatic municipal applicability established. Requirements or purpose: Human validation; explainable decisions; documented positive business case and alternatives; AI registry/approval; notice of citizen-facing AI, employment use and AI content; appeal options for external decisions; vendor testing; data minimization/security; current inventory and monitoring. Limits: City adoption, applicable contracts or another legal instrument would need separate evidence. Approval exemptions include security-defense AI, standard embedded commercial AI and higher-education research/instruction. FAQs offer interpretation; preserve the actual policy text.