Short answer
Set a simple policy that says which AI features are allowed, which decisions always need a person, how outputs are logged and reviewed, and who owns the risk. Then put matching terms in your vendor contracts so the policy has teeth.
Finance and HR data is some of the most sensitive information an agency holds, and decisions about pay, hiring and payments are exactly where residents and employees expect a human to be accountable, so I think governance here should be practical and specific rather than a long statement of principles. The first key is an inventory of which AI features are turned on in your systems today, since many vendors now enable them by default, followed by a short list of approved uses and a rule that AI may draft or recommend but a person approves anything that pays money, changes pay or affects employment.
The second key is visibility, so require that AI suggestions and the human decisions that follow are logged in a way your auditors can review, and that someone in finance or HR periodically checks a sample of those suggestions for accuracy and bias. Records retention matters too, because AI prompts and outputs can be public records in many states, and your clerk and attorney should weigh in before you find that out the hard way.
Finally, back the policy with contract terms covering data use, model changes, incident notice and the right to disable features, and review the whole framework at least once a year as the products change. We built an AI governance readiness template for exactly this, and you can find it through Start at Zero.