{"resourceId":"utah-ai-use-guidelines-v1-approved-inventory-202609","versions":[{"version":"external-850c4a078570500337e52ee76fb2e27edc27b99ef4ad43c22e5b644bbfa506e8","resource":{"id":"utah-ai-use-guidelines-v1-approved-inventory-202609","title":"University of Utah AI Use Guidelines v1.0 require approved-inventory tools, impact assessments for high-risk uses and vendor no-training clauses","organization":"University of Utah Office of Artificial Intelligence (Chief AI Officer)","sector":"Higher education AI governance / procurement and data policy","geography":"Utah, U.S.","publishedAt":"Guideline PDF, effective and last revised September 2026, version 1.0","publicationDate":"2026-09-01","eventDate":null,"sourceName":"University of Utah Office of Artificial Intelligence","sourceLabel":"Institutional guideline (policy text)","sourceUrl":"https://ai.utah.edu/guidelines/9.2026.ai.guidelines.pdf","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["governance-procurement","data-security","operating-model"],"finding":"Utah's first AI Use Guidelines (v1.0, September 2026) cover all faculty, staff, contractors and AI embedded in licensed software. Institutional data may only go into tools on an official approved inventory; unlisted tools need an AI Tool Form and review, and use is not permitted until approval. High-risk uses may require an AI Impact Assessment covering bias, privacy, accessibility and human oversight. Vendors must contractually prohibit training on university data unless authorized, and any use of institutional data for model training needs documented approval. Consequential decisions on employment, admission, aid or accommodations require meaningful human review.","sledRelevance":"A concrete, citable template for administrative AI controls: tool inventory, intake form, impact assessment and contract terms, applied to staff and embedded vendor features alike. Newly relevant because peer campuses are switching on suite AI this month without equivalent gates.","evidence":"Primary policy text; it sets rules but reports no compliance, inventory size, review times or enforcement data.","architectureImplications":"Requires a maintained tool inventory and classification-aware configuration of enterprise tools; embedded AI in existing software falls in scope, which demands visibility into vendor feature releases.","governanceImplications":"Assigns roles to the Office of AI, information security (risk assessment and AI incident response) and data stewards; proportional review by risk level.","securityPrivacyImplications":"Ties AI use to existing data classification and encryption rules; security office oversees AI incident response; contracts must bar unauthorised training.","caveats":"Guidance (v1.0) rather than measured practice; enforcement, staffing and review throughput unknown. Effective date given only as September 2026, so publicationDate is set to the first of the month.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: Utah has written the controls many campuses lack: an approved-tool inventory, an intake form, impact assessments and vendor no-training terms. Institutions without these face the gap Utah closed on paper. A bounded engagement is a gap assessment against a comparable control set. This is policy, not evidence of results, so it cannot support claims about reduced risk, faster approvals or savings, and nothing indicates Utah needs outside help.","engineering":"Engineering framing: the guideline puts embedded AI in licensed software in scope, so engineers need visibility into vendor feature releases and tenant settings, not just new purchases. Fit depends on keeping a live inventory tied to data classification. Proof of value should test whether a tool's configuration actually enforces the no-training and data-class limits the policy assumes, and whether AI incidents route to the security office as written.","delivery":"Delivery framing: turning this guideline into operations means running intake, keeping the inventory current and completing impact assessments on time. Delivery teams can propose service levels for tool review, a standard assessment template and a quarterly inventory audit. Owners are the Office of AI with information security and data stewards. The main risks are review backlogs that push staff to unapproved tools and embedded AI features going live without review."},"roleDetails":{"sales":{"customerProblem":"A campus lacks a working approved-tool inventory, intake process and AI contract terms, while vendors add AI to existing software.","stakeholders":["Chief AI Officer or CIO","Chief information security officer","Chief data officer and data stewards","Purchasing / procurement","General counsel"],"discoveryQuestions":["Do you maintain an approved AI tool inventory, and does it include embedded features?","How long does AI tool review take today?","Do contracts bar vendors from training on your data?","Which uses are classed as high-risk?"],"valueHypothesis":"Adopting a comparable control set could reduce unreviewed AI use, but Utah reports no outcome data.","potentialEngagement":"A four-to-six week gap assessment of AI policy, inventory and contract terms against a reference control set such as Utah's.","unsupportedClaims":["Utah's controls have reduced incidents or risk","Reviews are fast or well staffed","The guideline is fully enforced"]},"engineering":{"fit":"Fits institutions with mature data classification that need AI-specific controls layered on.","architectureIntegration":"Inventory linked to data-classification rules; enterprise tools configured to prevent training on institutional data.","prerequisites":["Current data-classification standard","Software and vendor feature-release tracking","AI incident response playbook"],"constraints":["Utah state law (GRAMA), FERPA and HIPAA apply","Embedded vendor features may change without notice"],"security":"Security office runs AI risk assessments and incident response; vendors must disclose data handling and limitations.","proofOfValue":["Verify no-training settings in each enterprise AI tenant","Run a tabletop AI incident through the documented path","Audit a sample of software for undeclared AI features"]},"delivery":{"work":"Operate AI intake, inventory upkeep and impact assessments as a repeatable service.","dependencies":["Office of AI staffing","Purchasing Services","Data stewards"],"ownership":"Office of Artificial Intelligence with information security and data stewards.","skillsAdoption":"Train unit IT and procurement staff to recognise embedded AI and route it to review.","governanceCheckpoints":["Tool approval before any institutional data use","Impact assessment for high-risk uses","Quarterly inventory audit"],"acceptanceCriteria":["Proposed: published service level for tool review","Proposed: 100% of enterprise AI contracts include no-training terms at renewal","Proposed: quarterly inventory audit completed"],"risks":["Review backlog drives shadow AI","Embedded AI features bypass review","Policy outpaces enforcement capacity"]}},"retrievedAt":"2026-10-12T21:55:44-05:00","enrichedAt":"2026-10-12T21:59:46-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Employment decisions are explicitly high-risk and require meaningful human review; impact assessments include accessibility effects.","procurementImplications":"All acquisitions must follow purchasing policy; vendors must provide model transparency and no-training terms, giving procurement clear contract language.","operatingModelImplications":"A Chief AI Officer and Office of AI run the inventory, intake and literacy work, centralising AI decisions that units previously made alone.","sourceVerification":{"openedUrl":"https://ai.utah.edu/guidelines/9.2026.ai.guidelines.pdf","referenceExcerpt":"Institutional Data may not be used for AI training without explicit authorization.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}