{"resourceId":"asu-system-ai-governance-policy-proposed-20261016","versions":[{"version":"external-66a887feb9739036e3ccba1b18fc970e54319dbd891b113fa77918ab6a55c572","resource":{"id":"asu-system-ai-governance-policy-proposed-20261016","title":"Arkansas State University System board to vote on AI governance policy requiring procurement risk assessments, an approved-tool inventory, human final decisions and annual training","organization":"Arkansas State University System Board of Trustees","sector":"Public university system IT governance, procurement and data security","geography":"Arkansas, United States","publishedAt":"Board of Trustees agenda and resolutions packet for the 16 October 2026 meeting (PDF metadata dated 13 October 2026)","publicationDate":null,"eventDate":"2026-10-16","sourceName":"Arkansas State University System","sourceLabel":"Board agenda packet with proposed system policies (Resolutions 26-47 to 26-50)","sourceUrl":"https://asusystem.edu/wp-content/uploads/2026/10/Agenda-Resolutions-Oct-16-2026-Regular-Meeting.pdf","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["governance-procurement","data-security","accessibility-workforce","operating-model"],"finding":"The ASU System board agenda for 16 October 2026 asks trustees to approve four linked technology policies: a revised Appropriate Use policy adding an AI section (26-47), a new Artificial Intelligence Governance Policy (26-48), a Data Security and Classification Policy (26-49) and an IT Resource Security Policy (26-50). The AI policy covers AI and automated decision tools used for academic, instructional, research and administrative purposes and cites compliance with Arkansas Act 848 (2025). It assigns roles: the campus CIO is executive sponsor and approves documented exceptions with review dates; data custodians enforce AI usage guidelines; HR handles compliance and enforcement; a training authority manages assignments and records; Procurement must ensure risk assessments before buying AI tools or third-party platforms; IT keeps a central inventory of approved AI systems; vendors must show transparency, bias mitigation and data protection. A human must make any final decision regardless of AI recommendations. Training on appropriate AI use is annual for all students, faculty and staff. Each campus IT organization must keep a supplemental standard listing approved AI tools and approved AI meeting transcription and recording tools, enforcement and monitoring mechanisms and a platform-review cadence. The classification policy sets four tiers (Public, Internal, Confidential, Regulated): confidential and regulated data may not be entered into AI unless explicitly approved and contractually protected; internal data is allowed on approved platforms. Why now: the vote is scheduled for 16 October; the policies were proposed, not adopted, at retrieval.","sledRelevance":"A concrete, board-level template for public university systems turning AI principles into enforceable roles across IT, procurement, HR and training. It directly covers administrative AI, meeting transcription tools and third-party platforms that embed AI, which are common campus operations issues. Transferability: tied to Arkansas statute; other states' requirements differ.","evidence":"Primary policy text and executive summaries. It shows intended controls, not implementation or results. No inventory size, training completion, risk-assessment method or enforcement data are given.","architectureImplications":"Interpretation: institutions will need a maintained AI system inventory, data-classification enforcement at the point of AI use (including embedded AI features in existing platforms), and logging to support monitoring and incident response. The companion data policy also requires classification-based watermarking.","governanceImplications":"Places CIO accountability, procurement risk assessment and HR enforcement in one policy, with annual review and documented exceptions with compensating controls. The human-final-decision clause applies to decisions employees make in the course of their work. A placeholder ('Resolution 26-XX') remains in the 26-50 summary, suggesting late drafting.","securityPrivacyImplications":"Prohibits confidential and regulated data in AI unless approved and contractually protected, allows internal data only on approved platforms, and requires lists of approved meeting transcription tools, a frequent source of unmanaged recordings. Enforcement relies on monitoring mechanisms each campus must still define.","caveats":"Proposed policy; adoption was scheduled for 16 October and the attached text already carries a pre-written adoption line. Policy text does not show compliance or effectiveness. Supplemental campus standards, where most operational detail will sit, are not yet published.","streamIds":["campus-operations"],"roles":{"sales":"For sales, the opening is implementation, not policy drafting. A public system is about to require inventories, procurement risk assessments, vendor transparency, annual training and campus-level standards, with few details on how. That creates bounded needs for inventory discovery, risk-assessment templates and transcription-tool review. Keep claims modest: the source is a proposed policy, so it cannot support claims about compliance gaps, budgets or timelines at any campus.","engineering":"For pre-sales engineering, the fit is tooling that makes the policy enforceable: discovering AI features inside existing SaaS, mapping data tiers to approved platforms, and logging use for monitoring. Integration points are procurement intake, identity, data-loss prevention and the IT service catalogue. Check whether embedded AI features in current platforms fall under third-party platforms and integrations that use AI, since that widens scope. Validate monitoring claims against what campuses can technically see.","delivery":"For delivery, the work is building each campus's supplemental AI standard and making it operate. Stand up the approved-tool and transcription-tool lists, a procurement risk-assessment step, an exception register with review dates, and annual training assignments with records. Coordinate CIO, procurement, HR and training owners. Plan the first annual policy review with measurable evidence, such as inventory coverage and training completion."},"roleDetails":{"sales":{"customerProblem":"Public university systems must turn new AI governance policy into operating controls across campuses with limited staff and unclear methods.","stakeholders":["System and campus CIOs","Procurement directors","HR and employee training leads","Data custodians and information security","General counsel"],"discoveryQuestions":["How many AI tools and embedded AI features are in use today, and who owns the inventory?","What risk-assessment method will procurement use for AI purchases?","How will annual training be assigned and tracked for students as well as staff?","Which meeting transcription tools are currently used and how are recordings retained?"],"valueHypothesis":"Interpretation: a shared inventory, risk-assessment template and exception register could help campuses meet the policy consistently and reduce duplicate reviews.","potentialEngagement":"A bounded readiness project for one campus: AI inventory discovery, a draft supplemental standard and a procurement risk-assessment template.","unsupportedClaims":["That the policy has been adopted or implemented","That campuses currently lack inventories or controls","Any cost or staffing estimate for compliance"]},"engineering":{"fit":"Fits governance tooling for inventory, data-classification enforcement and usage monitoring across campus SaaS and AI platforms.","architectureIntegration":"Procurement intake linked to an AI system inventory; classification-aware DLP and identity controls; logging for audit and incident response.","prerequisites":["Data classification applied to key systems","Procurement intake that flags AI features","Identity and logging coverage for approved AI platforms"],"constraints":["Arkansas Act 848 requirements specific to this state","Campus-level variation in IT capacity","Limited visibility into embedded vendor AI features"],"security":"Policy bars confidential and regulated data from AI without approval and contract protection; verify technical enforcement, transcription retention and vendor data-use terms.","proofOfValue":["Inventory discovery on one campus compared with known tool lists","Test that DLP or platform settings block regulated data in unapproved AI tools","Pilot of the risk-assessment template on two pending AI purchases"]},"delivery":{"work":"Draft and operationalize each campus's supplemental AI governance standard, inventory, exception register and training assignments.","dependencies":["Campus CIO","Procurement Services","HR and training authority","Data custodians"],"ownership":"The campus CIO owns AI governance and exceptions; procurement owns risk assessment; HR owns enforcement; IT owns the inventory.","skillsAdoption":"Procurement and data custodians need AI risk-assessment skills; all users need annual training on appropriate AI use and data tiers.","governanceCheckpoints":["Board adoption of Resolutions 26-47 to 26-50","Campus supplemental standard approved","Annual policy review by 16 October 2027"],"acceptanceCriteria":["Proposed: published approved-tool and transcription-tool lists for each campus","Proposed: every new AI purchase has a documented risk assessment","Proposed: annual training completion tracked and reported"],"risks":["Policy without monitoring capability","Embedded AI features missed by inventory","Training mandate burden on students and staff"]}},"retrievedAt":"2026-10-15T21:56:42-05:00","enrichedAt":"2026-10-15T22:09:02-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Annual AI training for all students, faculty and staff, and HR-maintained disciplinary procedures for violations, create workload and fairness considerations. A human must make final decisions in the course of employment. Accessibility is not addressed.","procurementImplications":"Requires risk assessment before procuring AI tools and third-party platforms or integrations that use AI, standard procurement processes for AI, and vendor demonstration of transparency, bias mitigation and data protection.","operatingModelImplications":"Distributes AI governance across CIO, data custodians, procurement, HR and a training authority, with campus-level standards under a system policy. Interpretation: success depends on campus IT capacity to maintain inventories and monitoring.","sourceVerification":{"openedUrl":"https://asusystem.edu/wp-content/uploads/2026/10/Agenda-Resolutions-Oct-16-2026-Regular-Meeting.pdf","referenceExcerpt":"shall not be entered into AI and ADT, unless explicitly approved and contractually protected","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}