Office of Information Security Statement

Because OSU representatives have no recourse for holding externally hosted AI platforms accountable for data storage or use, and because these platforms may be hosted outside of OSU's legal jurisdiction the accidental or deliberate introduction of protected data could result in organizational, legal, or even regulatory risks to OSU and university employees. Unlike vendors who have undergone vetting before implementation in support of OSU business needs, OSU administrators lack the authority to enforce standard data governance, risk management, and compliance requirements upon publicly available AI platforms. Pursuant to these concerns the Office of Information Security (OIS) strongly recommends that OSU employees who wish to utilize externally hosted artificial intelligence tools for research, instruction, or administration, reach out to OIS for a brief consultation prior to proceeding.

The introduction of Sensitive/IRB Level II (e.g., FERPA-protected or proprietary) or Confidential/IRB Level III (e.g., PII or PHI) data to AI platforms is strictly prohibited. OSU instructors who assign AI-enabled assignments should also remind their students that they should avoid providing sensitive data to AI prompts. OIS recommends that instructors who wish to direct their students to utilize Internet-based AI tools include the following language in their syllabi:

"Because OSU does not control the online AI tools associated with the curriculum of this course, the Office of Information Security advises students to avoid entering Personally Identifiable Information (PII) or otherwise sensitive data into any AI prompt. For additional information, contact the Office of Information Security,"

Finished here?

Return to AI Tools: Implications for Teaching and Learning