From the Campus Operations edition of October 18, 2026
UT OneIT publishes an AI Guidance Matrix mapping six data classes to AI platforms, limiting free tools to public data and requiring agreements even for UT-managed platforms
University of Tennessee, Knoxville Office of Innovative Technologies (OIT); UT OneIT · Public research university: IT governance, data privacy and FERPA compliance · Knoxville, Tennessee, United States
- Publisher
- UT Knoxville Office of Innovative Technologies
- Original publication
- 12 October 2026 (OIT News)
- Source retrieved
- 2026-10-19
- Event date
- 2026-10-12
What happened
OneIT published an AI Guidance Matrix mapping which data may be used with AI platforms ranging from public, non-UT-managed tools to UT-contracted, centrally managed AI, across six data classes: Public, Internal Use Only, Private: FERPA, Restricted: PII, Restricted: HIPAA and CUI. Free public tools (ChatGPT Free, Gemini Free, mobile AI apps) are approved for public data only, and FERPA data is off-limits there. UT-managed platforms such as UT Verse and the UT AI Hub allow more, but still need a formal UT agreement covering security, privacy and data handling before sensitive data is used. Locally installed offline models still require a conversation with local IT. Why now: not previously archived; it supplies the data-class rules that sit alongside UT's agentic-tool licensing and the archived UT Verse item.
Why it matters
A reusable control: a published platform-by-data-class matrix that tells staff what can go where, including that limited does not mean permitted without review and that local models are not automatically exempt.
Evidence and measured results
Institutional guidance summary; the full matrix is linked but was not opened. No compliance or usage data.
Limitations and uncertainty
Summary of the matrix only; exact cell-by-cell permissions were not inspected. Guidance, not evidence of compliance.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-18; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Staff do not know which data they may put into which AI tool, and policies are too abstract to follow.
- Stakeholders
- CIO and CISO
- Privacy and FERPA officers
- Data stewards
- Help desk leads
- Discovery questions
- Do you publish a platform-by-data-class AI matrix?
- Which contracted AI platforms are approved for FERPA or HIPAA data?
- How are local models reviewed?
- Value hypothesis
- Interpretation: a maintained matrix tied to contracts could reduce ad hoc data decisions; no outcome data supports this yet.
- Potential engagement
- Build or refresh an AI data-class matrix with contract and settings evidence for each row.
- Unsupported claims
- Reduced incidents
- Staff compliance levels
- Exact cell permissions
Pre-sales engineering
Role takeaway
- Fit
- Relevant to any campus offering several AI platforms across data classes.
- Architecture and integration
- Map public SaaS, contracted SaaS and local models to data classes; align data-loss prevention and connector settings.
- Prerequisites
- Data classification scheme
- Contract terms per platform
- Tenant configuration records
- Constraints
- Sensitive data needs formal agreements
- Local models still need review
- Security
- Enforce matrix rules with data-loss prevention and connector restrictions where possible.
- Proof of value
- Test blocking of FERPA data on a public-tool path
- Verify contracted platform settings match the matrix
Delivery
Role takeaway
- Work
- Maintain the matrix and the evidence behind each row; publish help-desk guidance.
- Dependencies
- Contract repository
- Data steward input
- Ownership
- OneIT owns the matrix; data stewards own class definitions.
- Skills and adoption
- Short employee training on the matrix and data classes.
- Governance checkpoints
- Matrix update when a contract or feature changes
- Term-by-term review
- Acceptance criteria
- Proposed: every platform row cites a contract and settings record
- Proposed: matrix reviewed each term
- Risks
- Matrix goes stale as features change
- Staff misclassify data
- Local models used without review
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Treats deployment mode (public SaaS, contracted SaaS, local offline model) as a control dimension alongside data class.
Governance
Who approves, reviews and stays accountable for outcomes?
Contracted platforms need agreement-based approval for sensitive data; staff guidance frames privacy as everyone's responsibility.
Security and privacy
What data, permissions and controls need testing?
Explicit FERPA, PII, HIPAA and CUI handling rules by platform type.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Shifts judgment to individual employees; training and clear tooling reduce the burden.
Procurement
What should contracts, pricing and exit terms secure?
Contracted AI needs a formal agreement covering security, privacy and data handling before sensitive data is allowed.
Operating model
Which teams own the service once it runs?
Central matrix with local IT consultation for offline models.
Publication history
- 2026-10-18Campus Operations · Issue 417 resources
Stable resource ID: utk-oneit-ai-guidance-matrix-data-classes-20261012