From the Campus Operations edition of October 12, 2026
University of Utah AI Use Guidelines v1.0 require approved-inventory tools, impact assessments for high-risk uses and vendor no-training clauses
University of Utah Office of Artificial Intelligence (Chief AI Officer) · Higher education AI governance / procurement and data policy · Utah, U.S.
- Publisher
- University of Utah Office of Artificial Intelligence
- Original publication
- Guideline PDF, effective and last revised September 2026, version 1.0
- Source retrieved
- 2026-10-13
What happened
Utah's first AI Use Guidelines (v1.0, September 2026) cover all faculty, staff, contractors and AI embedded in licensed software. Institutional data may only go into tools on an official approved inventory; unlisted tools need an AI Tool Form and review, and use is not permitted until approval. High-risk uses may require an AI Impact Assessment covering bias, privacy, accessibility and human oversight. Vendors must contractually prohibit training on university data unless authorized, and any use of institutional data for model training needs documented approval. Consequential decisions on employment, admission, aid or accommodations require meaningful human review.
Why it matters
A concrete, citable template for administrative AI controls: tool inventory, intake form, impact assessment and contract terms, applied to staff and embedded vendor features alike. Newly relevant because peer campuses are switching on suite AI this month without equivalent gates.
Evidence and measured results
Primary policy text; it sets rules but reports no compliance, inventory size, review times or enforcement data.
Limitations and uncertainty
Guidance (v1.0) rather than measured practice; enforcement, staffing and review throughput unknown. Effective date given only as September 2026, so publicationDate is set to the first of the month.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-12; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- A campus lacks a working approved-tool inventory, intake process and AI contract terms, while vendors add AI to existing software.
- Stakeholders
- Chief AI Officer or CIO
- Chief information security officer
- Chief data officer and data stewards
- Purchasing / procurement
- General counsel
- Discovery questions
- Do you maintain an approved AI tool inventory, and does it include embedded features?
- How long does AI tool review take today?
- Do contracts bar vendors from training on your data?
- Which uses are classed as high-risk?
- Value hypothesis
- Adopting a comparable control set could reduce unreviewed AI use, but Utah reports no outcome data.
- Potential engagement
- A four-to-six week gap assessment of AI policy, inventory and contract terms against a reference control set such as Utah's.
- Unsupported claims
- Utah's controls have reduced incidents or risk
- Reviews are fast or well staffed
- The guideline is fully enforced
Pre-sales engineering
Role takeaway
- Fit
- Fits institutions with mature data classification that need AI-specific controls layered on.
- Architecture and integration
- Inventory linked to data-classification rules; enterprise tools configured to prevent training on institutional data.
- Prerequisites
- Current data-classification standard
- Software and vendor feature-release tracking
- AI incident response playbook
- Constraints
- Utah state law (GRAMA), FERPA and HIPAA apply
- Embedded vendor features may change without notice
- Security
- Security office runs AI risk assessments and incident response; vendors must disclose data handling and limitations.
- Proof of value
- Verify no-training settings in each enterprise AI tenant
- Run a tabletop AI incident through the documented path
- Audit a sample of software for undeclared AI features
Delivery
Role takeaway
- Work
- Operate AI intake, inventory upkeep and impact assessments as a repeatable service.
- Dependencies
- Office of AI staffing
- Purchasing Services
- Data stewards
- Ownership
- Office of Artificial Intelligence with information security and data stewards.
- Skills and adoption
- Train unit IT and procurement staff to recognise embedded AI and route it to review.
- Governance checkpoints
- Tool approval before any institutional data use
- Impact assessment for high-risk uses
- Quarterly inventory audit
- Acceptance criteria
- Proposed: published service level for tool review
- Proposed: 100% of enterprise AI contracts include no-training terms at renewal
- Proposed: quarterly inventory audit completed
- Risks
- Review backlog drives shadow AI
- Embedded AI features bypass review
- Policy outpaces enforcement capacity
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Requires a maintained tool inventory and classification-aware configuration of enterprise tools; embedded AI in existing software falls in scope, which demands visibility into vendor feature releases.
Governance
Who approves, reviews and stays accountable for outcomes?
Assigns roles to the Office of AI, information security (risk assessment and AI incident response) and data stewards; proportional review by risk level.
Security and privacy
What data, permissions and controls need testing?
Ties AI use to existing data classification and encryption rules; security office oversees AI incident response; contracts must bar unauthorised training.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Employment decisions are explicitly high-risk and require meaningful human review; impact assessments include accessibility effects.
Procurement
What should contracts, pricing and exit terms secure?
All acquisitions must follow purchasing policy; vendors must provide model transparency and no-training terms, giving procurement clear contract language.
Operating model
Which teams own the service once it runs?
A Chief AI Officer and Office of AI run the inventory, intake and literacy work, centralising AI decisions that units previously made alone.
Publication history
- 2026-10-12Campus Operations · Issue 354 resources
Stable resource ID: utah-ai-use-guidelines-v1-approved-inventory-202609