{"resourceId":"kstate-ai-stewardship-risk-based-tool-review-20261007","versions":[{"version":"external-402e837ccc5beff4c1467c48c41eecbe7ecde20c9c155ab5dbb0611847c2df63","resource":{"id":"kstate-ai-stewardship-risk-based-tool-review-20261007","title":"K-State moves AI governance into implementation: risk-based tool intake, Claude for Teams approved only for non-institutional data, administrative workflows subcommittee","organization":"Kansas State University (AI Stewardship Committee, Office of the Provost)","sector":"Higher education institutional governance / IT and administrative operations","geography":"United States (Kansas)","publishedAt":"October 7, 2026","publicationDate":"2026-10-07","eventDate":null,"sourceName":"K-State Today (letter from James Wiser, K-State Libraries dean and committee chair)","sourceLabel":"Institutional announcement (operator self-report, not an independent evaluation)","sourceUrl":"https://www.k-state.edu/news/articles/2026/10/advancing-responsible-ai-adoption.html","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["governance-procurement","data-security","operating-model","accessibility-workforce"],"finding":"K-State's AI Stewardship Committee, which succeeds the generative AI task force and implements its April 2026 report, adopted an interim AI tool review and approval framework. Requests are risk-tiered on data sensitivity, security, privacy, institutional impact, regulatory requirements and how far an AI system gains access to university data and systems, through a new AI Tool Approval Request intake. Its first published decision approved Claude for Teams only for limited use on non-institutional data. Five subcommittees were formed, including Cybersecurity and Risk Management, Data Governance and Records Management, and Administrative and Operational Workflows. An institutional AI policy and an approved tool registry are still to be developed during 2026-27.","sledRelevance":"A concrete example of a campus turning AI principles into an operating intake process, with records management and administrative workflows treated as standing governance areas. The data-scoped approval of an enterprise assistant shows how campuses are limiting tools before contracts and data agreements are in place.","evidence":"Opened the K-State Today article dated Wednesday, Oct. 7, 2026 and read the full text, including the framework criteria, the Claude for Teams decision, the subcommittee list and the 2026-27 workplan.","architectureImplications":"Approval criteria explicitly weigh how deeply an AI system integrates with university data and systems, so agentic or connector-based tools will face heavier review than standalone chat. Limiting an assistant to non-institutional data implies no connectors to enterprise systems until data controls exist.","governanceImplications":"Moves from a task force to a standing committee with subcommittees and an intake process, but the formal policy and tool registry are not yet in place, so decisions rest on an interim framework.","securityPrivacyImplications":"Data sensitivity, privacy, security and records management are named review criteria; restricting Claude for Teams to non-institutional data keeps regulated records out of the tool for now.","caveats":"Self-reported institutional announcement. It gives no counts of requests reviewed, turnaround times or outcomes, and does not explain why Claude for Teams was limited. The approved-tool registry and policy do not yet exist. Transferability depends on each campus's data classification scheme.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: the buyer's first hurdle is now a risk-based intake gate, not a pilot budget. K-State has formalized AI tool review and approved Claude for Teams only for non-institutional data, which means vendors and partners must arrive with data-flow, records and integration documentation. Credible engagements help institutions design intake criteria and tool registries. This evidence does not support claims that intake processes speed adoption or reduce risk; no outcomes or turnaround times are reported.","engineering":"Engineering framing: integration depth drives review intensity. K-State's criteria weigh how far an AI system reaches into university data and systems, so a chat-only deployment and a connector-based agent will be judged differently. Engineers should document data classes touched, connector scopes, logging and retention for each tool before submission. Proof of value should test whether a tool can be technically constrained to the approved data tier, such as non-institutional data only.","delivery":"Delivery framing: the interim framework has to become a repeatable service. Delivery work is to run the intake queue, publish decisions with their data limits, and build the planned tool registry and policy during 2026-27. The AI Stewardship Committee and its subcommittees own decisions; IT security and records management run reviews. Acceptance should track review turnaround and registry coverage. Risk is a backlog or inconsistent decisions while the formal policy is still missing."},"roleDetails":{"sales":{"customerProblem":"Campuses with AI principles but no consistent way to evaluate, approve and scope AI tools and enterprise integrations.","stakeholders":["Provost or AI governance chair","CIO and CISO","Records manager","Data governance lead","Procurement director","Accessibility office"],"discoveryQuestions":["Do you have a single intake route for AI tool requests?","What data tiers can each approved AI tool touch?","Who decides when an approved tool can connect to enterprise systems?","Is there a public registry of approved AI tools and their limits?"],"valueHypothesis":"Interpretation: a documented intake and registry could make AI tool decisions more consistent and auditable; speed and risk reduction are unmeasured.","potentialEngagement":"A bounded 4-6 week engagement to design AI intake criteria, decision templates with data-tier limits, and a starter tool registry.","unsupportedClaims":["No data shows the framework shortens approval time.","No evidence of reduced incidents or data exposure.","The article does not explain why Claude for Teams was limited."]},"engineering":{"fit":"Institutions evaluating AI assistants, AI features in existing systems and connector-based or agentic tools against data classification.","architectureIntegration":"Map each tool's connectors, data stores and identity integration to the institution's data tiers; enforce approved scopes at the tenant or connector level.","prerequisites":["Institutional data classification scheme","Inventory of AI tools and AI-enabled features in use","Records retention schedule covering AI outputs","Identity and access controls for enterprise tools"],"constraints":["Interim framework only; policy and registry not yet adopted","State records and privacy law apply to retained prompts and outputs","Approved scope limited to non-institutional data for the reviewed assistant"],"security":"Gate integrations by data sensitivity, confirm vendor retention and training terms, and log connector access to university systems.","proofOfValue":["Demonstrate a tool can be technically restricted to an approved data tier","Run a tabletop review of one connector-based tool against the criteria","Check that review records capture data-tier decisions and conditions"]},"delivery":{"work":"Operate the AI tool intake, publish decisions with data limits, and build the tool registry and institutional AI policy during 2026-27.","dependencies":["AI Stewardship Committee decisions","IT security and privacy review capacity","Records management guidance","Procurement alignment with the intake gate"],"ownership":"AI Stewardship Committee, with operational reviews by IT security, data governance and records management subcommittees.","skillsAdoption":"Train requesters on what information an AI tool request needs and expand AI literacy for staff using approved tools.","governanceCheckpoints":["Intake triage by data sensitivity","Security and privacy review","Records management sign-off","Committee decision with documented scope"],"acceptanceCriteria":["Proposed: median review turnaround tracked and published each term","Proposed: every approved tool listed in the registry with data-tier limits","Proposed: policy adopted by end of 2026-27"],"risks":["Review backlog pushes staff to unsanctioned tools","Inconsistent decisions before formal policy exists","Approved scope not technically enforced"]}},"retrievedAt":"2026-10-07T21:53:11-05:00","enrichedAt":"2026-10-07T21:53:11-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Accessibility is listed as a review consideration and AI literacy training is being expanded for faculty, staff and students; no staff-impact analysis is described.","procurementImplications":"Faculty and staff must request review before institutional adoption, which places AI tool requests ahead of purchasing and gives procurement a gate tied to data risk.","operatingModelImplications":"Governance is distributed across five subcommittees, with an Administrative and Operational Workflows group that could own back-office AI adoption decisions.","sourceVerification":{"openedUrl":"https://www.k-state.edu/news/articles/2026/10/advancing-responsible-ai-adoption.html","referenceExcerpt":"The committee recently completed its review of Claude for Teams and approved its limited use for non-institutional data inquiries","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}