EIU Office of Internal Auditing

#128 - Artificial Intelligence and Data Protection

Approved: October 26, 2026

Monitor: President
Co-Monitor: Provost
Co-Monitor: Vice President for Business Affairs

Policy Purpose

This policy provides a general framework to the University community on the use of artificial intelligence (AI) tools and directs the community to use EIU Approved AI Tools rather than personal or consumer subscriptions when conducting University business. It establishes how University Information may be used with AI tools based on the data classification. The following requirements must be followed when using AI tools for University purposes, on a University network, or with University Information. This policy does not govern student use of AI in coursework or other academic settings. Permitted use of AI in a course is determined by the instructor and the applicable syllabus or course requirements. This policy does not address areas associated with the primary authority of faculty including pedagogy, research, and creativity. Faculty are expected to follow the guidance of their discipline and profession specific organizations. As such, the objective of this policy is to protect critical data and not limit academic freedom. Allegations of academic dishonesty, including the unauthorized use of AI, are addressed by the Dean of Students.

Additionally, the use of AI as it relates to potential questions of scientific misconduct is governed by IGP #58.

Finally, as AI technologies evolve, it is important to recognize that the integration of AI into existing platforms and software may not be evident to all users. For that reason, users should always use caution with student, employee and financial data, as well as proprietary information. The University is committed to protecting private data and required by state and federal law to ensure institution-supported software is compliant with these laws.

Scope and Application

This policy applies to all:

• Faculty members, including part-time and visiting faculty;
• Staff and other employees, including graduate assistants and student employees;
• Contractors, vendors, consultants, affiliates, and other third parties given access to University systems or data; and
• Students, when using AI tools with University Information.

This policy applies to any AI tool, whether a free-standing application or service or a feature embedded in another product, and regardless of whether it is accessed on University-owned or personally owned devices.

Policy Detail

1. Protecting University Information

AI tools carry an inherent risk of data exposure once information has been entered. Users must assume that any data entered into an Individual AI Tool may be retained by the provider, used to train the provider's models, and disclosed to third parties. University Information may be used with AI tools only as permitted in the below table based on EIU’s data classification: https://go.eiu.edu/data-classification.

Examples of how documents and information commonly produced at the University are classified are available at: https://go.eiu.edu/data-examples. If a document is not listed, or its classification is unclear, treat it as Internal and contact Information Technology Services (ITS) at support@eiu.edu before using it with an AI tool.

Securing financial information. Financial information of the University or of an individual is Confidential Information. It must not be entered into any AI tool that is not an Approved AI Tool specifically authorized for Confidential Information. Protected financial information includes, but is not limited to, bank account and routing numbers, payment card numbers and cardholder data, wire and ACH details, financial aid records, payroll and direct deposit information, and tax identification numbers. Cardholder data must not be transmitted through any AI tool outside of the University's approved payment environment, consistent with GLBA and Payment Card Industry Data Security Standard (PCI DSS).

Protecting student education records (FERPA). Student education records are Confidential Information protected by the Family Educational Rights and Privacy Act. Personally identifiable information from student education records must not be entered into any AI tool that is not an Approved AI Tool authorized for Confidential Information and covered by an appropriate data protection agreement. Entering such information into an Individual AI Tool constitutes an unauthorized disclosure under FERPA regardless of intent. De-identification is sufficient only when all direct and indirect identifiers have been removed such that a student cannot reasonably be identified.

Personal likeness, voice, and biometric information. The image, video, voice, or other recording of an identifiable individual must not be uploaded to or processed by an AI tool with the intent to generate or alter the likeness or voice of an identifiable individual, without that individual's prior written consent. In Illinois, biometric identifiers and information, including voiceprints and scans of facial geometry, are protected under the Biometric Information Privacy Act (BIPA), which requires informed written consent before collection or use. The unauthorized use of a person's name, image, likeness, or voice is also restricted under the Illinois Right of Publicity Act. Recordings made for legitimate University purposes remain subject to existing University consent, retention, and privacy requirements, and may not be repurposed for AI processing beyond the scope for which consent was obtained. Users may continue to generate captions and recordings in accordance with an approved accommodation and the Americans with Disability Act. Any human subjects research utilizing data protected under BIPA must include the disclosure of AI use as part of the submitted research protocols, even exempt research, reviewed by EIU’s Institutional Research Board (IRB). Employees who upload or process authorization data protected under BIPA without consent will be subject to disciplinary action. Students who upload or process authorization data protected under BIPA without consent will be referred to the Dean of Students for potential violations of student standards.

Research Data. Researchers and other users should exercise caution before entering research data, unpublished findings, draft manuscripts, grant proposals, source code, or potentially protectable information into an AI tool. Information entered into an Individual AI Tool may be retained, used to improve the provider's models, and disclosed to others, and the University cannot guarantee the confidentiality, exclusivity, or protectability of such information once it has been submitted. Any human subjects research must include the disclosure of AI use as part of the submitted research protocols, even exempt research, reviewed by EIU’s Institutional Research Board.

Proprietary & Legal Information. These data are unique and strategically important to everyday and long-term operations—or could expose the institution to additional risk—most notably cybersecurity concerns. Proprietary data would include confidential business practices (such as enrollment management marketing strategies), institutional source code for EIU systems, EIU network identifiers (NETIDs), E-numbers, and other data points that could pose cybersecurity risks. Proprietary information also includes activities associated licensing, branding, and materials that require brand alignment. If you have a question about the nature of data that might be considered proprietary, please consult ITS prior to introducing the data to an AI system. Memoranda and other communications regarding legal matters must not be uploaded or processed by an AI tool.

Health and Medical Information. To ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) of 1996, the personal medical and health information of students and employees must not be uploaded or processed by an AI tool.

Personnel & Employee Records. Employee records should not be uploaded or processed by an AI tool.

2. Incident Reporting

If a suspected breach or security incident has occurred, individuals should initially attempt to contact Information Technology Security Officer 217-581-1939, Executive Director for ITS 217-581-1942 or EIU ITS Help Desk at 217-581-HELP. If not available, please email ticket_infosec@eiu.edu with the information:

• Contact information
• The college or department involved
• A brief description of what happened
• A general description of the type of data
• A general description of the impact of the incident

3. Acquisition of AI Technology

If an AI tool (or new AI enabled features) will be utilized to analyze, assess, or refine user data that includes protected student, employee, financial, or proprietary information (including institutional source code or official marketing activities), departments, schools, and units may not acquire, license, pilot, or deploy an AI tool for University use, whether purchased or obtained free of charge and including new AI features enabled in existing software, without first submitting it for review using the new software tool review form at: https://go.eiu.edu/software-request

Acquisition must follow the University's standard procurement process, disclose the AI functionality for third-party and information security review, and be processed through a purchase order rather than a procurement card where terms and conditions apply. Each tool is evaluated for security, privacy, contractual, duplicative services, accessibility, and legal considerations and for the maximum data classification level, if any, for which it may be authorized, and is not approved for use with University Information until it appears on the published list of EIU Approved AI Tools at the authorized classification level. AI tools acquired for the sole purpose of research and creativity utilizing grant or non-appropriated or non-fee based financial resources that will not utilize personal employee, student, or financial data do not require approval per se; but an ITS consultation is required and compliance with the procurement rules of the State of Illinois.

A current list of EIU Approved AI Tools and the classification level each is authorized to handle is maintained by Information Technology Services and published at the ITS Approved AI Tools page: https://go.eiu.edu/ai-tools.

The University recognizes that the use of personal AI tools to support research or classroom activities is consistent with EIU’s commitment to academic freedom. However, the use of personal tools does exempt employees from the requirements to protect student, employee, and financial data or other proprietary institutional information as well as comply with approved IRB protocols. These data cannot be shared outside of EIU approved platforms. Employees should always use caution when using non-EIU approved tools.

4. Responsible Use of AI Output

AI tools can produce content that is inaccurate, incomplete, biased, or fabricated. Users are responsible for reviewing and verifying the accuracy and completeness of AI output and remain fully accountable for any output they use in University work product.

Disclosing the use of AI. Where appropriate, users should indicate that an AI tool was used to draft or edit a document. Disclosure is appropriate when the audience would reasonably expect to know, when the document is a formal University record, report, or public communication, and when required by a sponsor, publisher, funding agency, journal, or course requirement. Faculty are expected to follow the AI guidance of their discipline and profession specific organizations.

Disclosure is not expected for routine assistance such as spelling and grammar correction, limited style revisions (i.e., polishing), formatting, summarizing a user's own notes, or preparing required meeting minutes. Units may set more specific disclosure requirements for their own work. Disclosure does not transfer responsibility for the content to the AI tool; the user remains accountable for the final product.

Use of an Approved AI Tool, or compliance with this policy, does not relieve a user of the obligation to comply with other applicable policies, including academic integrity standards, research integrity guidance, and unit or course requirements.

5. Enforcement

Users who violate this policy may have their AI access terminated and may be subject to disciplinary action by the University in accordance with appropriate policies or student code of conduct procedures.

Definitions

*This document was developed with the assistance of artificial intelligence. The policy was reviewed and edited by University personnel prior to adoption.