The VA Chief AI Officer (CAIO) team provides this information as guidance on the use of generative AI at VA, a summary of benefits and risks, and resources to learn more about the responsible use of generative AI.

What is generative AI?

Generative AI refers to artificial intelligence systems that can create new content — such as text, images, audio, and software code — based on patterns learned from large datasets. Unlike traditional AI models that are designed mainly to classify or predict, generative AI models create outputs that can feel human-like and creative. These tools use advanced machine learning techniques to generate responses based on instructions (or prompts) from users.

Generative AI tools can be used for a wide range of tasks, including but not limited to:

• Drafting or editing written content like emails, memos, or reports.
• Summarizing long documents, articles, or meeting notes.
• Creating images, graphics, or design mockups from text descriptions.
• Writing, reviewing, or debugging software code.
• Translating text or explaining complex topics in understandable terms.
• Brainstorming ideas for projects.

What is VA’s guidance for the use of generative AI technologies?

A key priority of VA’s Strategy for Adopting High-impact Artificial Intelligence to Improve Services for Veterans is to expand employee access to useful, cost-effective AI tools. To support this strategy, VA has expanded access to generative AI tools to help employees with their work, while maintaining strong safeguards for privacy and security.

To safeguard VA’s sensitive data and uphold our commitment to privacy and security, such data may only be used with tools that have received a VA Authority to Operate (ATO) for that purpose. Because most public commercial generative AI tools do not have a VA ATO, most generative AI websites are currently not available on VA’s network. Even if a website with a tool is accessible on VA’s network, employees cannot use the tool with VA sensitive data unless the tool has a VA ATO that allows its use with sensitive data. This approach ensures VA maintains control over its sensitive data and aligns with federal cybersecurity standards. Generative AI tools that have a VA ATO and are approved for use with VA sensitive data are available.

Generative AI usage guidelines are as follows:

1. VA staff are responsible for the interpretation and usage of AI-generated content and should carefully review output for accuracy prior to usage. AI can make errors, and it is the user’s responsibility to confirm the accuracy of the results.
2. Existing VA Rules of Behavior apply to usage of generative AI tools. This means that users must safeguard VA data, follow security, privacy, and records-management policies, and use systems only for authorized, official VA-approved purposes.
3. Existing VA security and privacy policies apply. This means that VA sensitive data, which includes Protected Health Information (PHI) and Personally Identifiable Information (PII), cannot be entered into tools that do not have an ATO that covers usage of this data. When users enter information into an unapproved tools VA loses control of the data.

Generative AI Tools at VA

Below are generative AI tools currently available at VA, along with their usage guidelines. VA is actively expanding access to approved generative AI tools that meet security and privacy requirements. This guidance will be updated regularly as more tools are approved.

Available to all VA employees and contractors

Use	Product	Access with VA identity authentication required	Approved for use with VA sensitive data, including PHI and PII data
Generative AI chat, Editing documents	Microsoft CoPilot Chat, VA GPT	Yes	Yes
Software Coding	GitHub CoPilot	Yes	No
Clinical literature review	OpenEvidence, UpToDate	No	No
Internet data search	Perplexity, Google, Microsoft Bing	No	No

Gated availability

Use	Product(s)	Access with VA identity authentication required	Approved for use with VA sensitive data, including PHI and PII data
Custom AI-powered conversational experiences	Microsoft CoPilot Studio, Summit Data Platform’s AI Assistant	Yes	Yes

What are benefits and risks of generative AI?

Benefits of using generative AI tools include:

• Increased productivity through help with drafting documents, summarizing information, or automating repetitive tasks.
• Enhanced creativity through idea generation, design support, and draft content creation.
• Improved access to knowledge through offering quick explanations, translations, or support with navigating large amounts of content.
• Support for decision-making through organizing information, identifying potential patterns, and presenting options clearly.

While there is wide interest in the benefits of generative AI models, this technology introduces new risks that VA employees need to be aware of. Risks include:

Risk	Description	Mitigation Strategy
Incorrect Information	Generative AI tools can sound confident but may provide outdated or incorrect information.	AI-generated content should be reviewed and verified by the user before being used for decision-making.
Data Disclosure	Submitting VA sensitive data to non-approved AI services can lead to privacy and security breaches.	Use only VA-approved AI tools. Never submit VA sensitive data to tools that are not approved for that use.
Over-Reliance on AI	Errors may go unnoticed if users do not sufficiently review content.	Ensure users are reviewing and employing critical thinking. Treat AI as a support tool, and not a replacement for judgment.
Abuse and Fraud	It may be possible for guardrails in common generative AI tools to be bypassed to allow intentional misleading or harmful use.	Follow VA’s generative AI guidance and use only approved tools. Report misuse.

Tips for assessing when to use generative AI technologies

• Purpose: Consider the purpose of any decisions to use generative AI technologies and ensure that the scope of application is well-defined so that the benefits of use outweigh the risks.
• Safety and Efficacy: Understand the limits of the generative model. If your group is considering generative AI technologies, it is imperative to develop a process to verify the accuracy of the output and ensure human oversight where needed.
• Security and Privacy: As in other situations, do not share VA sensitive data, including PII or pre-decisional documents, with unapproved services.
• Ethics with Veteran Data: VA policies and federal requirements regarding trustworthy AI, including the VA Principle-Based Ethics Framework for Access to and Use of Veteran Data, VA privacy directive 6502, VA cybersecurity and privacy guidance in VA Handbook 6500, and Executive Order 13960 apply to any use of generative AI models.
• Transparency and Explainability: Generative AI models do not provide explanations of how they produce their results. To avoid violating transparency rules, laws, and policies, exercise extreme caution when using generative models as support for higher-risk scenarios and understand when the use of AI tools needs to be disclosed.
• Accountability and Monitoring: VA personnel do not abdicate accountability for actions, decisions, or outcomes informed or produced by generative AI tools.
• Use Case Documentation and Review: AI use cases are required to be documented in VA’s AI use case inventory. If the output of a generative AI technology will serve as the principal basis for a decision related to health care, benefits, financial transactions or other “high impact” areas, the use case is also subject to risk management requirements to ensure responsible AI use. The intake is on the CAIO internal SharePoint.

Where can you go for more information?

• Visit VA’s public AI website to learn more about VA AI strategy and view the VA AI use case inventory: https://department.va.gov/ai/
• Join the AI@VA Community Hub run by the National AI Institute (NAII) for VHA collaborations and information sharing
• Review section 5 of the VA Directive 6500 and its definitions of VA sensitive data, PII and PHI.
• Reach out to the CAIO team at CAIOOffice@va.gov