1 Purpose

Stanislaus State supports the responsible use of artificial intelligence to improve learning, research, services, and individual productivity. This policy establishes expectations for protecting information, using AI responsibly, and developing applications that can be supported over time. It also defines when a personally developed tool requires review before broader university use.

2 Scope

This policy applies to faculty, staff, students, administrators, and others using AI in university activities. It covers AI services, agents, skills, integrations, automated workflows, and applications developed with AI assistance. Applications created with AI remain subject to applicable university requirements even when the finished application does not use AI.

Academic policies govern course expectations, academic integrity, and grading. This policy complements those requirements and does not replace established academic processes. Existing CSU and campus policies for security, accessibility, procurement, records, research, and responsible use continue to apply.

3 Authorized use

Users may use authorized AI tools for routine work, individual productivity, and experimentation within the approved data, access, and capability limits. Separate approval is not required for each routine task that stays within an already authorized use. New services, acquisitions, integrations, and uses outside those limits must follow the applicable university review process.

The availability of a feature, plugin, model, or development platform does not authorize every use of it. Users must follow the campus guidance for the information, connections, and actions permitted in each environment.

4 Responsible use and human accountability

Users remain responsible for work produced with AI assistance. They must check important information and review outputs before relying on them, with greater care where an error could affect a person, university service, official record, or institutional commitment.

AI must not be used to fabricate evidence, misrepresent facts, impersonate others, bypass access controls, or unfairly disadvantage individuals or groups. Uses that materially affect eligibility, selection, evaluation, discipline, or access to university services require appropriate institutional review and meaningful human oversight. An authorized person must remain able to assess and change the outcome.

AI involvement must be disclosed when needed for people to understand a service or evaluate its results. University chatbots must identify themselves as AI-based services. Generated content must not be presented in a way that misleads people about its authenticity. Routine editing or drafting assistance does not, by itself, require a separate disclosure unless another applicable requirement calls for one.

 

 

Information protection and personal tools

5 Information security and privacy

University information may be entered, uploaded, retrieved, or stored only in environments authorized for the relevant data and purpose. Users must consider connected apps, external services, shared files, stored conversations, and generated outputs as part of the same workflow.

Permission to access information does not automatically permit sending it to another provider or making it available through a new application. Users must preserve appropriate access restrictions and use only the information and permissions needed for the task.

Passwords, API keys, and other credentials must be stored in approved credential systems, rather than in prompts, shared skills, source code, or application files. Development and testing must use public, synthetic, or appropriately minimized data wherever practical. Protected information may be used only within its authorized conditions.

6 Citizen Developer and personal productivity tools

A Citizen Developer is a member of the university community who creates an application or automation to meet a work or learning need, including through AI-assisted development. Users may develop personal tools and prototypes within authorized environments and published limits.

A tool used by one person can still require review if it accesses protected information, connects to university systems, or takes consequential actions. Calling a tool personal or experimental does not exempt it from applicable university requirements.

Low-risk tools, prompts, and skills may be shared with colleagues within approved sharing limits. Sharing does not establish university endorsement or an OIT support commitment. Creators must explain the intended use and known limitations and must not expose information, credentials, or capabilities that recipients are not authorized to use.

7 Required review

The responsible individual or department must obtain the applicable review before an application or workflow:

• Uses protected information, a new external service, or production-system access beyond an already authorized purpose or configuration.
• Allows others to act through the creator’s identity, a shared account, or an agent-owned connection.
• Sends official communications, changes institutional records, expands access, commits funds, or performs other consequential actions beyond approved limits.
• Becomes an expected part of a university process, is offered as a Stan State service, or creates operational dependence that could materially affect others if it fails.

Review must be proportionate to the intended use, information, actions, audience, and consequences. Existing platform assessments should be reused where applicable. Material changes to data, permissions, connections, audience, or purpose require reassessment before the expanded use begins.

 

 

Institutional adoption and ongoing support

8 Acceptance and ownership

An application must be formally accepted by the responsible university unit before it is represented as an institutional service or relied upon for ongoing operations. Acceptance must include the applicable technical, security, accessibility, data, and procurement reviews.

The sponsoring unit must identify a business owner, a technical maintainer, and a backup contact. It must document the application’s purpose, intended users, permitted information and actions, hosting, support arrangements, and funding. Department-supported applications are permitted when the department can meet these responsibilities.

Authorization to use an application does not automatically commit OIT to maintain or support it. Any OIT support commitment must be explicitly agreed upon, including the services provided and the responsibilities retained by the sponsoring unit.

9 Accessibility

Shared and institutional applications must follow applicable university accessibility requirements and review processes. Accessibility must be considered during development and before deployment, including the interface, generated documents and content, and the complete user workflow.

The responsible unit must provide a way to report barriers and obtain assistance. Any exception or alternative-access arrangement must follow the established campus process. Pilot status does not create an exemption.

10 Connections and automation

Shared tools must clearly distinguish actions performed through each user’s permissions from those performed through a shared or service identity. Sharing a tool must not unintentionally delegate its creator’s credentials or authority. Institutional connections require controlled ownership, appropriate permissions, and procedures for access review, transfer, and removal.

Automated actions must stay within approved purposes and limits. Higher-impact actions require confirmation or other safeguards appropriate to their effects. Unattended workflows must have an accountable owner, suitable logs and execution limits, error reporting, and a way to stop the process. Recovery or reversal arrangements must be provided where feasible.

Local AI tools on university-managed endpoints must follow approved identity, device, file-access, network, and execution controls. Specific product settings and role permissions are maintained in technical guidance.

11 Maintenance and continuity

Institutional applications must have documentation and university-controlled access sufficient for another authorized person to maintain or take over the service. Source code, configuration, accounts, and credentials must not depend solely on the continued availability of the creator.

The responsible unit must plan for updates, testing, costs, accessibility remediation, backup and recovery, and eventual retirement. Important services must have an appropriate fallback. Changes to models or providers must be evaluated for effects on accuracy, security, accessibility, and service behavior.

 

 

Administration and related guidance

12 Records and oversight

AI-related records must be handled under applicable university retention, access, and records procedures. Recording and transcription must follow applicable notice and consent requirements. Shared knowledge collections and memory features must be managed according to the sensitivity and intended audience of their contents.

Access to individual AI activity and compliance records must be limited to authorized purposes and personnel under existing university procedures. Aggregate reporting may support adoption, training, service planning, and resource management. Compliance records must not be repurposed for routine productivity or performance measurement.

13 Responsibilities and implementation

Users are responsible for appropriate use, verification, protection of information, and reporting concerns. Creators must keep their tools within approved limits and request review when the use changes. Sponsoring units are responsible for accepting institutional applications and providing ownership, resources, and continuity.

OIT and the existing campus review functions provide technical guidance and the reviews within their assigned responsibilities. Established university authorities retain approval and exception authority. This policy does not create a separate approval body or replace existing review processes.

The university will maintain supporting guidance that identifies authorized environments, permitted data and actions, review routes, and practical examples. It will provide training and consultation to help users meet these expectations. Review should use existing technology, security, accessibility, procurement, and data governance processes and avoid duplicating assessments already completed.

Responsible units must review institutional applications periodically and when significant changes occur. They must suspend affected functions when a serious security, accessibility, or reliability issue cannot be adequately controlled, arrange an appropriate service alternative, and report the issue through established campus channels.

14 Reporting concerns

Users must promptly report suspected information exposure, unauthorized actions, significant errors, or accessibility barriers through the appropriate campus support or incident-reporting process. Reports should include enough information to investigate while avoiding further disclosure of sensitive information.

 

Related campus references

Technology Acquisition Review Process
https://www.csustan.edu/access-for-all/procurement/technology-acquisition-review-process

Authorized Technology
https://www.csustan.edu/access-for-all/procurement/authorized-technology