From the Health & Human Services edition of November 1, 2026
Michigan MDHHS AI acceptable-use policy takes effect Nov. 1: approved tools only, expert review of every AI output, and a non-AI alternative for the public
Michigan Department of Health and Human Services (MDHHS) · State health and human services agency (Medicaid, SNAP, child welfare, public health) · Michigan, United States
- Publisher
- MDHHS Administrative Policy Manual, APS 1100-02 (bulletin APB 2026-041)
- Original publication
- 2026-10-22 (issued); effective 2026-11-01
- Source retrieved
- 2026-11-02
- Event date
- 2026-11-01
What happened
MDHHS policy APS 1100-02, issued Oct. 22 through bulletin APB 2026-041 and effective Nov. 1, 2026, sets department-wide rules for AI. It covers employees, contractors, temporary workers and third parties, and all AI developed, procured or deployed by DTMB or MDHHS vendors. Rules: AI only on state-managed devices. No internal, confidential or restricted data in external AI systems. Vendor or software AI may use MDHHS data only for use cases approved by both the DTMB AI Governance Board and the MDHHS Data Governance Team. Sharing MDHHS data with an unapproved tool counts as an unauthorized disclosure, reportable on form DCH 1422; policy violations must be reported within 24 hours of discovery. A subject matter expert must review AI output before anyone acts on it. AI systems need human-in-the-loop. AI contributions must be cited. Chatbots must say they are AI and offer the public a non-AI alternative. AI recordings and transcripts may be subject to FOIA. Next review is set for Nov. 1, 2027.
Why it matters
Medicaid, SNAP, child welfare and public health all sit in one department, so this one policy governs AI across a large state HHS agency from the day it takes effect. The ACLU of Michigan has already questioned MDHHS's use of AI in SNAP payment assessments (archived in this stream, 2026-10-29). The policy shows the controls now on paper; it does not show how they are enforced.
Evidence and measured results
Primary policy text (6 pages) plus the 2-page bulletin announcing it. It sets rules and reports no outcomes, metrics or inventory of approved tools.
Limitations and uncertainty
A policy is not evidence of compliance or of results. The source does not list approved tools, how the governance bodies decide, or how SME review will be audited. Whether the policy reaches already-deployed eligibility tools is not stated. The policy applies to MDHHS staff and vendors, not to counties or providers outside its scope.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-02; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- HHS programs want AI help but every use case now needs dual approval, expert review and disclosure before it can touch department data.
- Stakeholders
- MDHHS Chief Data Steward and Data Governance Team
- DTMB AI Governance Board
- Program directors in Medicaid, SNAP, child welfare and public health
- MDHHS privacy and security officers
- Office of Communications for public-facing AI
- Discovery questions
- Which current AI uses, including vendor features, have an approved use case on file?
- How will SME review of AI output be recorded and checked?
- What does the governance board need to see to approve a use case?
- Which public channels need a non-AI alternative?
- Value hypothesis
- Bounded hypothesis: a well-documented use-case package shortens the approval cycle for one program and lowers the risk of an unauthorized-disclosure incident.
- Potential engagement
- Policy-alignment review of one program's AI uses and preparation of a single use-case submission for the governance bodies.
- Unsupported claims
- That MDHHS has approved any particular tool
- That approval timelines are known
- That the policy has reduced incidents or bias
- That the policy covers county or provider AI use
Pre-sales engineering
Role takeaway
- Fit
- Fits assistive AI that runs on state-managed devices under approved data classification, with human review before action.
- Architecture and integration
- Approved tool catalog plus identity and device controls; data-classification enforcement; logging of AI contribution for citation and FOIA retrieval; disclosure and human handoff on public chatbots.
- Prerequisites
- Approved use case from DTMB AI Governance Board and MDHHS Data Governance
- Data classification for each data element used
- State-managed device deployment
- Defined SME reviewer roles
- Constraints
- No internal, confidential or restricted data in external AI systems
- AI transcription and recordings may be FOIA-disclosable
- Public-facing AI must offer a non-AI alternative
- Applies to MDHHS scope only
- Security
- Treat any data sent to an unapproved tool as a reportable unauthorized disclosure (DCH 1422); keep internal, confidential and restricted data out of external AI systems.
- Proof of value
- Show the approval record and data classification for the pilot use case
- Demonstrate logged SME review of a sample of outputs
- Test the public non-AI alternative path
- Verify transcripts can be retrieved for a FOIA request
Delivery
Role takeaway
- Work
- Inventory AI use against APS 1100-02, route gaps to governance approval, and set up review, citation and incident-reporting steps in program workflows.
- Dependencies
- DTMB AI Governance Board decisions
- MDHHS Data Governance Team capacity
- DTMB AI guidance and training
- Vendor disclosure of embedded AI features
- Ownership
- Program leadership owns use; MDHHS Chief Data Steward owns policy questions; DTMB owns enterprise AI governance.
- Skills and adoption
- Staff need training on approved tools, data classification, output review, AI citation and the DCH 1422 incident form.
- Governance checkpoints
- Use-case approval before any data use
- SME sign-off before outputs are acted on
- Bias review of outputs
- Annual policy review due 2027-11-01
- Acceptance criteria
- Proposed: 100% of active AI uses have an approval record
- Proposed: sampled outputs show documented SME review
- Proposed: public AI channels show disclosure and a working non-AI option
- Risks
- Shadow AI use continues outside approved tools
- Review becomes a rubber stamp under caseload pressure
- Approval backlog slows useful pilots
- Embedded vendor AI features go undisclosed
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Implies an approved-tool catalog tied to state-managed devices and data classification, a use-case intake route (MDHHS Data Governance), and logging that can support citation, FOIA retrieval and incident reporting. Public-facing chatbots need an AI disclosure and a non-AI path.
Governance
Who approves, reviews and stays accountable for outcomes?
Approval sits with two bodies: the DTMB AI Governance Board and the MDHHS Data Governance Team. SME review and human-in-the-loop are mandatory. Violations go through incident response and can lead to discipline up to termination. Bias review of outputs is required, but the policy gives no testing method.
Security and privacy
What data, permissions and controls need testing?
Entering MDHHS data, including PHI or PII, into an unapproved tool is treated as an unauthorized disclosure reportable on form DCH 1422 (policy violations within 24 hours of discovery). Employees have no expectation of privacy in AI use on state systems. AI recordings and transcripts can be disclosed under FOIA.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Requiring a non-AI alternative for the public protects residents who cannot or will not use chatbots. Staff carry the review and citation duties, but the policy itself names no training requirement beyond the DTMB guidance it cites.
Procurement
What should contracts, pricing and exit terms secure?
Vendor AI that touches MDHHS data needs an approved use case before use. This applies to existing and new software contracts, including AI features added to current platforms.
Operating model
Which teams own the service once it runs?
Moves AI decisions into central data governance and makes subject matter experts accountable for outputs. Programs will need intake, approval and review steps in daily workflows.
Publication history
- 2026-11-01Health & Human Services · Issue 044 resources
Stable resource ID: michigan-mdhhs-aps-1100-02-ai-acceptable-use-effective-20261101