# AI Governance in Higher Education: Case Studies of Guidance at Big Ten Universities
## 4 Results
### Multi-Unit Governance of AI
#### 4.1.1 Information Technology  
Information Technology (IT) and similar departments in HEIs play a crucial role in managing network services, supporting various technologies and platforms, and resolving software and hardware issues encountered by students and staff [53]. Six universities from the Big Ten have issued AI guidelines through their IT departments. These guidelines mainly focused on security and privacy risks associated with Gen AI tools and how to \begin{table}
\begin{tabular}{l c c c c c c c c c c c c c} \hline \hline
**ID** & **U1** & **U2** & **U3** & **U4** & **U5** & **U6** & **U7** & **U8** & **U9** & **U10** & **U11** & **U12** & **U13** & **U14** \\ \hline Information Technology & \(\bullet\) & \(\bullet\) & & \(\bullet\) & & \(\bullet\) & \(\bullet\) & \(\bullet\) & & & & & \(\bullet\) & \\ Teaching and Learning & \(\bullet\) & \(\bullet\) & \(\bullet\) & \(\bullet\) & & \(\bullet\) & & \(\bullet\) & \(\bullet\) & \(\bullet\) & \(\bullet\) & \(\bullet\) & \(\bullet\) & \(\bullet\) \\ President and Provost & \(\bullet\) & & \(\bullet\) & & & & & \(\bullet\) & & \(\bullet\) & & & & & \\ University Libraries & & \(\bullet\) & & & & & \(\bullet\) & \(\bullet\) & & & & & \(\bullet\) & & \\ AI Center & & & & & \(\bullet\) & & & & & & & & \(\bullet\) & & \\ Additional units & & \(\bullet\) & & \(\bullet\) & & \(\bullet\) & & & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Units that publish AI guidelines on a university level. avoid them. Specifically, these risks are managed by IT through statements related to the following topics:  
Data-Sharing Policy  
IT established a specific policy for data usage as the community interacts with AI tools. These statements guide people to input limited types of data into AI tools and prohibit the sharing of institutional data and other sensitive information, which is also in accordance with the university's existing data classification system:  
_Do not share institutional data with this tool. Providing any personally identifiable information or university internal information, such as development code for systems hosting institutional data, is a violation of IU policy._--Indiana U  
The data classification can be found on other pages of the IT website, which usually categorize data into four levels: Public (Low Sensitivity), University Internal (Moderate Sensitivity), Sensitive/Restricted (High Sensitivity), and Restricted/Critical (Very High Sensitivity). Among the four levels, the Public data are considered safe to share without the need for further IT review. By recapitulating this data classification in AI guidelines, IT helps university users avoid undesired information leakage while using AI. IT also provides information on AI tools that are considered more secure through an enterprise contract or agreement with the university. These tools are approved for data interaction classified up to and including the University Internal level. The most common tool with such an agreement is Microsoft Co-Pilot due to part of the university's existing licensing with Microsoft services such as Office 365. Therefore, despite the agreement, IT still seeks to enhance risk avoidance through further qualifications of AI tools:  
_Since Microsoft released this tool as part of existing licensing, it has not yet gone through the formal review process that is part of our standard procurement process. As with any such tool, caution is advised._--Michigan State  
As this statement shows, IT has a formal review process that ensures a tool or software meets the university's security requirements. The guidelines welcome faculty to contact IT to assess security attributes for a given implementation of AI. Trustworthy AI  
While it is impossible for IT to comment on all AI tools available on the market, it has encouraged the community to use \"Trustworthy AI\" tools.