AI Security and Governance

The University cannot manage the security, privacy, and compliance risks of artificial intelligence without knowing which tools staff use and what data those tools receive. This policy requires Center for Information Technology approval for every AI tool used for University purposes. It also sets the conditions a tool must meet to be approved.

This policy applies to all faculty, staff, student employees acting in the course of University employment, and authorized affiliates who use AI tools for a University purpose or with University data. It applies whether the tool is bought by the University, licensed by an individual, or free. It applies whether the tool is its own application or a feature built into another product.

AI tools used solely for personal purposes that involve no University data fall outside this policy. This policy does not govern academic integrity, course-level expectations for student use of AI, or the instructional application of AI.

• Artificial intelligence tool. Any software application or software feature that uses machine learning, large language models, or algorithmic methods to generate, summarize, analyze, classify, or transform text, images, code, audio, or other content in response to user input.

• Approved AI tool. An AI tool that the Center for Information Technology has evaluated, placed on the CIT Approved AI Tool list, and authorized for use with University data at one or more stated data classification levels. The list, including each tool's authorized classification levels, is published and maintained on the CIT website.

• Education record. Records that are directly related to a student and maintained by the University or by a party acting for the University, as defined at 34 CFR 99.3.

• Public data. Data the University has intentionally made available to the general public without access restriction, including published research, marketing and communications materials, and content posted on public-facing University websites, as defined in the University Information Classification Policy.

• Controlled Unclassified Information (CUI). Information the federal government requires to be safeguarded or disseminated under controls, in accordance with Executive Order 13556 and 32 CFR Part 2002. CUI includes information created or received under a federal contract, grant, or cooperative agreement where the sponsoring agency has applied CUI markings.

Bethune-Cookman University requires that every AI tool used for any University purpose appear on the CIT Approved AI Tool list. No AI tool may be used for University purposes without prior evaluation and authorization by the Center for Information Technology, regardless of the nature of the data involved and regardless of whether that data is publicly available. How individuals may use approved tools, and what uses are prohibited, is governed by the Acceptable Use of Artificial Intelligence Policy.

The Approved AI Tool list states which data classification levels each tool is cleared for.

A tool may be approved above the Public level only when the University holds a written agreement with the provider. That agreement must require the provider to protect the information it receives. The Safeguards Rule imposes this on service providers at 16 CFR 314.4(f). The requirement applies whether the tool is purchased, licensed at no cost, or offered inside a platform the University already licenses. Without an agreement, the tool remains limited to Public data until the University's contract review process approves one.

A tool may be approved for use with education records only under two conditions. The provider must be barred by contract from using University data to train or improve its models. The provider must also be barred from sharing that data with anyone else unless the University agrees. These conditions exist because the University keeps direct control over education records it discloses to a party acting on its behalf. The school official exception requires that control at 34 CFR 99.31(a)(1)(i)(B). A tool whose terms let the provider use submitted content for its own purposes cannot be approved for education records.

The CIO holds security veto authority over every AI tool used with University data. The CIO may deny or suspend a tool that violates University information security policy, has a documented breach, or puts institutional data at unacceptable risk. This holds even where the reviewing office has approved the tool. The CIO may suspend an approved tool immediately upon confirming a breach, an actively exploited vulnerability, or a violation of the tool's approved data-handling terms. CIT notifies affected users within one business day of any suspension.

The Center for Information Technology and the relevant academic or administrative office evaluate each submission together. Neither may authorize a tool on its own.

A denial issued on security grounds is final. No University office may authorize the use of a tool that the CIO has denied or suspended on security grounds. The CIO states the specific security basis for each such decision in writing, and the Center for Information Technology retains the record.

A requestor may appeal a denial to the CIO within 10 business days of the denial notice. Where the denial was made on security grounds, the appeal is limited to whether the stated basis was correctly applied under the CIT AI Tool Evaluation Standard Operating Procedure.

CIT operates the evaluation and authorization process under the CIT AI Tool Evaluation Standard Operating Procedure, which establishes submission requirements, evaluation criteria, and service level targets.

Violations of this policy are subject to disciplinary action under University employment policies and Human Resources procedures. The CIO may suspend a person's or a department's access to a specific AI tool upon a confirmed violation, and may refer the matter to Human Resources.

The CIO may grant a written exception to the authorization requirement. The request must state the business need, the data classification involved, and the controls in place to reduce the risk. An exception lasts no more than 90 days and may be renewed once. A need continuing past that point requires an approved tool.