{"resourceId":"utk-oneit-ai-guidance-matrix-data-classes-20261012","versions":[{"version":"external-ccdeacb33177e04c8f389770a95ef89dee983bca85b675f7b8e8e35bfac8bed9","resource":{"id":"utk-oneit-ai-guidance-matrix-data-classes-20261012","title":"UT OneIT publishes an AI Guidance Matrix mapping six data classes to AI platforms, limiting free tools to public data and requiring agreements even for UT-managed platforms","organization":"University of Tennessee, Knoxville Office of Innovative Technologies (OIT); UT OneIT","sector":"Public research university: IT governance, data privacy and FERPA compliance","geography":"Knoxville, Tennessee, United States","publishedAt":"12 October 2026 (OIT News)","publicationDate":"2026-10-12","eventDate":"2026-10-12","sourceName":"UT Knoxville Office of Innovative Technologies","sourceLabel":"Institutional IT guidance announcement","sourceUrl":"https://oit.utk.edu/news/think-before-you-type-ai-tools-and-student-privacy/","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["data-security","governance-procurement"],"finding":"OneIT published an AI Guidance Matrix mapping which data may be used with AI platforms ranging from public, non-UT-managed tools to UT-contracted, centrally managed AI, across six data classes: Public, Internal Use Only, Private: FERPA, Restricted: PII, Restricted: HIPAA and CUI. Free public tools (ChatGPT Free, Gemini Free, mobile AI apps) are approved for public data only, and FERPA data is off-limits there. UT-managed platforms such as UT Verse and the UT AI Hub allow more, but still need a formal UT agreement covering security, privacy and data handling before sensitive data is used. Locally installed offline models still require a conversation with local IT. Why now: not previously archived; it supplies the data-class rules that sit alongside UT's agentic-tool licensing and the archived UT Verse item.","sledRelevance":"A reusable control: a published platform-by-data-class matrix that tells staff what can go where, including that limited does not mean permitted without review and that local models are not automatically exempt.","evidence":"Institutional guidance summary; the full matrix is linked but was not opened. No compliance or usage data.","architectureImplications":"Treats deployment mode (public SaaS, contracted SaaS, local offline model) as a control dimension alongside data class.","governanceImplications":"Contracted platforms need agreement-based approval for sensitive data; staff guidance frames privacy as everyone's responsibility.","securityPrivacyImplications":"Explicit FERPA, PII, HIPAA and CUI handling rules by platform type.","caveats":"Summary of the matrix only; exact cell-by-cell permissions were not inspected. Guidance, not evidence of compliance.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: UT's matrix shows campuses want simple rules for which data can go into which AI tool. Many institutions have policies but no usable matrix. A bounded offer is building or refreshing a platform-by-data-class matrix tied to contracts and tenant settings. Do not claim the matrix reduces incidents or improves compliance; the source reports no compliance or usage data at all.","engineering":"Engineering framing: the matrix treats deployment mode as a control, so pre-sales should map each AI platform's contract terms, tenant settings and hosting to the six data classes. Local offline models still need review, which matters for proposals using on-premises inference. Proof should show that technical controls, such as data-loss prevention and connector limits, actually enforce what the matrix says.","delivery":"Delivery framing: a matrix is only useful if it stays current as contracts and features change. OneIT owns the matrix; data stewards own class definitions. Proposed acceptance: each listed platform has a contract and settings reference behind its matrix row, reviewed each term, and help-desk scripts point staff to the matrix when they ask about AI and data."},"roleDetails":{"sales":{"customerProblem":"Staff do not know which data they may put into which AI tool, and policies are too abstract to follow.","stakeholders":["CIO and CISO","Privacy and FERPA officers","Data stewards","Help desk leads"],"discoveryQuestions":["Do you publish a platform-by-data-class AI matrix?","Which contracted AI platforms are approved for FERPA or HIPAA data?","How are local models reviewed?"],"valueHypothesis":"Interpretation: a maintained matrix tied to contracts could reduce ad hoc data decisions; no outcome data supports this yet.","potentialEngagement":"Build or refresh an AI data-class matrix with contract and settings evidence for each row.","unsupportedClaims":["Reduced incidents","Staff compliance levels","Exact cell permissions"]},"engineering":{"fit":"Relevant to any campus offering several AI platforms across data classes.","architectureIntegration":"Map public SaaS, contracted SaaS and local models to data classes; align data-loss prevention and connector settings.","prerequisites":["Data classification scheme","Contract terms per platform","Tenant configuration records"],"constraints":["Sensitive data needs formal agreements","Local models still need review"],"security":"Enforce matrix rules with data-loss prevention and connector restrictions where possible.","proofOfValue":["Test blocking of FERPA data on a public-tool path","Verify contracted platform settings match the matrix"]},"delivery":{"work":"Maintain the matrix and the evidence behind each row; publish help-desk guidance.","dependencies":["Contract repository","Data steward input"],"ownership":"OneIT owns the matrix; data stewards own class definitions.","skillsAdoption":"Short employee training on the matrix and data classes.","governanceCheckpoints":["Matrix update when a contract or feature changes","Term-by-term review"],"acceptanceCriteria":["Proposed: every platform row cites a contract and settings record","Proposed: matrix reviewed each term"],"risks":["Matrix goes stale as features change","Staff misclassify data","Local models used without review"]}},"retrievedAt":"2026-10-18T21:51:50-05:00","enrichedAt":"2026-10-18T22:00:09-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Shifts judgment to individual employees; training and clear tooling reduce the burden.","procurementImplications":"Contracted AI needs a formal agreement covering security, privacy and data handling before sensitive data is allowed.","operatingModelImplications":"Central matrix with local IT consultation for offline models.","sourceVerification":{"openedUrl":"https://oit.utk.edu/news/think-before-you-type-ai-tools-and-student-privacy/","referenceExcerpt":"UT-managed platforms like UT Verse and the UT AI Hub offer greater flexibility, but even these require a formal UT agreement","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}