From the Campus Operations edition of October 15, 2026
Arkansas State University System board to vote on AI governance policy requiring procurement risk assessments, an approved-tool inventory, human final decisions and annual training
Arkansas State University System Board of Trustees · Public university system IT governance, procurement and data security · Arkansas, United States
- Publisher
- Arkansas State University System
- Original publication
- Board of Trustees agenda and resolutions packet for the 16 October 2026 meeting (PDF metadata dated 13 October 2026)
- Source retrieved
- 2026-10-16
- Event date
- 2026-10-16
What happened
The ASU System board agenda for 16 October 2026 asks trustees to approve four linked technology policies: a revised Appropriate Use policy adding an AI section (26-47), a new Artificial Intelligence Governance Policy (26-48), a Data Security and Classification Policy (26-49) and an IT Resource Security Policy (26-50). The AI policy covers AI and automated decision tools used for academic, instructional, research and administrative purposes and cites compliance with Arkansas Act 848 (2025). It assigns roles: the campus CIO is executive sponsor and approves documented exceptions with review dates; data custodians enforce AI usage guidelines; HR handles compliance and enforcement; a training authority manages assignments and records; Procurement must ensure risk assessments before buying AI tools or third-party platforms; IT keeps a central inventory of approved AI systems; vendors must show transparency, bias mitigation and data protection. A human must make any final decision regardless of AI recommendations. Training on appropriate AI use is annual for all students, faculty and staff. Each campus IT organization must keep a supplemental standard listing approved AI tools and approved AI meeting transcription and recording tools, enforcement and monitoring mechanisms and a platform-review cadence. The classification policy sets four tiers (Public, Internal, Confidential, Regulated): confidential and regulated data may not be entered into AI unless explicitly approved and contractually protected; internal data is allowed on approved platforms. Why now: the vote is scheduled for 16 October; the policies were proposed, not adopted, at retrieval.
Why it matters
A concrete, board-level template for public university systems turning AI principles into enforceable roles across IT, procurement, HR and training. It directly covers administrative AI, meeting transcription tools and third-party platforms that embed AI, which are common campus operations issues. Transferability: tied to Arkansas statute; other states' requirements differ.
Evidence and measured results
Primary policy text and executive summaries. It shows intended controls, not implementation or results. No inventory size, training completion, risk-assessment method or enforcement data are given.
Limitations and uncertainty
Proposed policy; adoption was scheduled for 16 October and the attached text already carries a pre-written adoption line. Policy text does not show compliance or effectiveness. Supplemental campus standards, where most operational detail will sit, are not yet published.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-15; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Public university systems must turn new AI governance policy into operating controls across campuses with limited staff and unclear methods.
- Stakeholders
- System and campus CIOs
- Procurement directors
- HR and employee training leads
- Data custodians and information security
- General counsel
- Discovery questions
- How many AI tools and embedded AI features are in use today, and who owns the inventory?
- What risk-assessment method will procurement use for AI purchases?
- How will annual training be assigned and tracked for students as well as staff?
- Which meeting transcription tools are currently used and how are recordings retained?
- Value hypothesis
- Interpretation: a shared inventory, risk-assessment template and exception register could help campuses meet the policy consistently and reduce duplicate reviews.
- Potential engagement
- A bounded readiness project for one campus: AI inventory discovery, a draft supplemental standard and a procurement risk-assessment template.
- Unsupported claims
- That the policy has been adopted or implemented
- That campuses currently lack inventories or controls
- Any cost or staffing estimate for compliance
Pre-sales engineering
Role takeaway
- Fit
- Fits governance tooling for inventory, data-classification enforcement and usage monitoring across campus SaaS and AI platforms.
- Architecture and integration
- Procurement intake linked to an AI system inventory; classification-aware DLP and identity controls; logging for audit and incident response.
- Prerequisites
- Data classification applied to key systems
- Procurement intake that flags AI features
- Identity and logging coverage for approved AI platforms
- Constraints
- Arkansas Act 848 requirements specific to this state
- Campus-level variation in IT capacity
- Limited visibility into embedded vendor AI features
- Security
- Policy bars confidential and regulated data from AI without approval and contract protection; verify technical enforcement, transcription retention and vendor data-use terms.
- Proof of value
- Inventory discovery on one campus compared with known tool lists
- Test that DLP or platform settings block regulated data in unapproved AI tools
- Pilot of the risk-assessment template on two pending AI purchases
Delivery
Role takeaway
- Work
- Draft and operationalize each campus's supplemental AI governance standard, inventory, exception register and training assignments.
- Dependencies
- Campus CIO
- Procurement Services
- HR and training authority
- Data custodians
- Ownership
- The campus CIO owns AI governance and exceptions; procurement owns risk assessment; HR owns enforcement; IT owns the inventory.
- Skills and adoption
- Procurement and data custodians need AI risk-assessment skills; all users need annual training on appropriate AI use and data tiers.
- Governance checkpoints
- Board adoption of Resolutions 26-47 to 26-50
- Campus supplemental standard approved
- Annual policy review by 16 October 2027
- Acceptance criteria
- Proposed: published approved-tool and transcription-tool lists for each campus
- Proposed: every new AI purchase has a documented risk assessment
- Proposed: annual training completion tracked and reported
- Risks
- Policy without monitoring capability
- Embedded AI features missed by inventory
- Training mandate burden on students and staff
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Institutions will need a maintained AI system inventory, data-classification enforcement at the point of AI use (including embedded AI features in existing platforms), and logging to support monitoring and incident response. The companion data policy also requires classification-based watermarking.
Governance
Who approves, reviews and stays accountable for outcomes?
Places CIO accountability, procurement risk assessment and HR enforcement in one policy, with annual review and documented exceptions with compensating controls. The human-final-decision clause applies to decisions employees make in the course of their work. A placeholder ('Resolution 26-XX') remains in the 26-50 summary, suggesting late drafting.
Security and privacy
What data, permissions and controls need testing?
Prohibits confidential and regulated data in AI unless approved and contractually protected, allows internal data only on approved platforms, and requires lists of approved meeting transcription tools, a frequent source of unmanaged recordings. Enforcement relies on monitoring mechanisms each campus must still define.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Annual AI training for all students, faculty and staff, and HR-maintained disciplinary procedures for violations, create workload and fairness considerations. A human must make final decisions in the course of employment. Accessibility is not addressed.
Procurement
What should contracts, pricing and exit terms secure?
Requires risk assessment before procuring AI tools and third-party platforms or integrations that use AI, standard procurement processes for AI, and vendor demonstration of transparency, bias mitigation and data protection.
Operating model
Which teams own the service once it runs?
Distributes AI governance across CIO, data custodians, procurement, HR and a training authority, with campus-level standards under a system policy. Interpretation: success depends on campus IT capacity to maintain inventories and monitoring.
Publication history
- 2026-10-15Campus Operations · Issue 385 resources
Stable resource ID: asu-system-ai-governance-policy-proposed-20261016