AI Tool Assessment

Completing a security assessment request for an AI tool lets faculty and staff:

• Clarify how a tool works
• Classify the sensitivity of the data it would use
• Identify any risks it might introduce

Next Steps

1. Before submitting an assessment, confirm it's not already on the AI Tools List. See if the tool is approved with use restrictions, under review or not allowed.
2. To gather tool details, use the AI Tool Discovery example prompt.
3. Download the AI Tool Discovery output as a Microsoft Word document. If needed, edit and save the document.
4. Place an ITS security assessment request.
   • For the "Request Details" field, specify the reason/purpose for the AI tool and describe data to be used.
   • Be sure to attach the completed AI Tool Discovery Word document.
5. Click or tap Place Request.
6. IT Services reviews the request, verifies the attached document, replies with results and updates the AI Tools List.
   
   

IMPORTANT: Please refrain from using the AI tool until ITS identifies sensitivity levels and adds the tool to the AI Tools List.

 

FYI: Risk Questions for AI Tools

Using an AI example prompt and providing request details can help answer several questions that IT Services considers.

• 1. Does your use of the tool require you to enter or upload non-public university data?
  • Unsure? Review data classifications for Levels 2, 3 and 4 to evaluate your data.
    
    
• 2. Does the vendor retain your prompts, files, conversations or content?
  • Unsure? Check the vendor's “Data Use” or “Retention” policy.
    
    
• 3. Is the vendor’s data storage location unclear or outside the U.S.?
  • Unsure? Ask the vendor all geographical locations university data would be stored.
    
    
• 4. Are your inputs and data used for AI training?
  • Unsure? Review the vendor's “Data Use” or “Large Language Model Training” policy.
    
    
• 5. Does the tool limit your ability to control who can see or access your data?
  • Unsure? Check the vendor's privacy policy and support documentation.
    
    
• 6. Is data transmitted or stored without encryption (i.e., lacks encryption in transit and at rest), or is encryption unclear?
  
  • Unsure? Review the vendor's security documentation.
    
    
• 7. Does the tool lack a clear option to delete your data upon request?
  
  • Unsure? Check the vendor's privacy policy and support documentation.
    
    
• 8. Does the vendor lack a recognized security framework (e.g., SOC 2, NIST 800‑53)?
  • Unsure? Seek the vendor's security framework documentation.
    
    
• 9. Does the tool share data with third parties or partners?
  • Unsure? Review the vendor’s privacy policy.
    
    
• 10. Are the vendor’s terms of service or privacy policies unclear or confusing?
  • Unsure? Check terms of service and privacy policies.