{"resourceId":"asu-system-board-approves-ai-governance-policy-20261016","versions":[{"version":"external-1bc2fd21f7c5fa1abc149f2162025b663727d7e5b92a5e62d53b36e2d646ab86","resource":{"id":"asu-system-board-approves-ai-governance-policy-20261016","title":"Arkansas State University System trustees approve an AI Governance Policy alongside new data classification and IT security policies, with system-wide implementing procedures to follow","organization":"Arkansas State University System Board of Trustees","sector":"Public multi-campus university system governance","geography":"Arkansas, United States (seven campuses plus A-State Querétaro)","publishedAt":"16 October 2026 (ASU System news release)","publicationDate":"2026-10-16","eventDate":"2026-10-16","sourceName":"Arkansas State University System","sourceLabel":"System news release on board action (operator-published)","sourceUrl":"https://asusystem.edu/asu-system-board-approves-it-management-security-enhancements/","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["governance-procurement","data-security","operating-model"],"finding":"The ASU System board on 16 October approved four IT policies for all campuses: a revised Appropriate Use of Information and Technology Resources Policy, a new Artificial Intelligence Governance Policy, a Data Security and Classification Policy and an Information and Technology Resource Security Policy. System President Todd Shields said procedures for implementing the policies would be developed to ensure consistency across institutions, while also saying his job is not to make campuses alike. What is new relative to the archived 15 October agenda item (asu-system-ai-governance-policy-proposed-20261016), which described the proposed AI policy's content: the board has now adopted it, and it arrives as a package with data classification and security policies rather than standing alone.","sledRelevance":"Confirms adoption of a system-level AI governance policy at a public system and shows AI governance being paired with data classification, a combination other systems can copy.","evidence":"Operator press release; does not restate the AI policy's provisions or give an implementation timeline.","architectureImplications":"Pairing AI governance with a data classification policy implies AI tool approvals will be tied to data classes, which requires classification labels that systems can enforce.","governanceImplications":"System-wide policy with campus-level implementing procedures still to be written; the gap between adoption and procedures is where inconsistency can appear.","securityPrivacyImplications":"New data security and classification and IT resource security policies accompany the AI policy, setting the baseline AI tools will be assessed against.","caveats":"Release does not describe policy text; content details rely on the earlier agenda (archived). Implementing procedures and timelines are not yet published.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: a public system has just adopted AI governance, data classification and security policies together and now needs implementing procedures. That gap is a concrete, bounded need: procedure drafting, tool intake workflows and data-class mappings for each campus. Avoid claiming the policy reduces risk yet; nothing is implemented, and the release gives no timeline. Lead with the procedures gap and campus consistency, which the system president named himself.","engineering":"Engineering framing: AI governance tied to data classification only works if data classes are labelled in systems and AI tools can be approved per class. Pre-sales should check whether campuses have classification labels in storage and productivity suites, and whether AI tools can be restricted by label. A proof of value is one campus's approved-tool list mapped to data classes with enforcement evidence.","delivery":"Delivery framing: the work now is procedures and consistency across seven campuses with different missions. Delivery teams would draft shared intake and review procedures, a common approved-tool inventory, and campus-specific variations. The system IT office owns the standard; campus CIOs own implementation. Acceptance should track procedures adopted per campus and tools reviewed under them, with shadow tools found outside intake counted separately."},"roleDetails":{"sales":{"customerProblem":"A university system adopted AI and data policies and now needs consistent implementing procedures across distinct campuses.","stakeholders":["System president and general counsel","System and campus CIOs","Chief information security officer","Campus chancellors","Internal audit"],"discoveryQuestions":["Who drafts the implementing procedures and by when?","How will each campus inventory AI tools?","Are data classes labelled in your systems today?"],"valueHypothesis":"Interpretation: shared procedures and a common tool inventory can reduce campus-to-campus inconsistency after policy adoption.","potentialEngagement":"An eight-week procedures and intake-workflow package for the AI policy, piloted at one campus.","unsupportedClaims":["That the policy has reduced risk","Specific policy provisions beyond the archived agenda","Any timeline for implementation"]},"engineering":{"fit":"Multi-campus public systems with central policy and campus-level IT.","architectureIntegration":"Data-classification labels in storage and productivity platforms linked to AI tool approvals; shared inventory service.","prerequisites":["Classification scheme applied in systems","Inventory tooling","Intake workflow in a service desk"],"constraints":["Arkansas state law and system policy requirements","Campus autonomy","Procedures not yet written"],"security":"Align AI approvals with the new data security and IT resource security policies.","proofOfValue":["Map one campus's AI tools to data classes","Show label-based restriction on one AI service"]},"delivery":{"work":"Draft procedures, stand up intake and inventory, roll out campus by campus.","dependencies":["Final policy text","Campus CIO capacity","Classification labelling"],"ownership":"System IT office owns the standard; campus CIOs implement.","skillsAdoption":"Campus reviewers need training on risk assessment and data classes.","governanceCheckpoints":["Procedures approved by system office","Campus inventory submitted","Annual policy review"],"acceptanceCriteria":["Proposed: procedures adopted at all campuses within two terms","Proposed: every AI tool in use has an inventory entry and data-class rating"],"risks":["Procedures lag the policy","Campuses diverge","Shadow AI persists outside intake"]}},"retrievedAt":"2026-10-17T21:53:01-05:00","enrichedAt":"2026-10-17T21:58:13-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"The archived agenda indicated training requirements; the release itself does not mention training.","procurementImplications":"AI procurement across campuses will need to follow the new policy once procedures exist; until then campuses may vary.","operatingModelImplications":"Central policy with campus distinctiveness explicitly preserved; system office sets rules, campuses implement.","sourceVerification":{"openedUrl":"https://asusystem.edu/asu-system-board-approves-it-management-security-enhancements/","referenceExcerpt":"adding an Artificial Intelligence Governance Policy, Data Security and Classification Policy and an Information and Technology Resource Security Policy","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}