Artificial Intelligence Governance Policy 3.06

Effective Date: October 16, 2026

Subject:  Artificial Intelligence Governance

Category:  IT, Security, Privacy & Records 3.06

1. Purpose

The purpose of this policy is to establish requirements, responsibilities, and governance for the authorized use of Artificial Intelligence (AI) and Automated Decision Tools (ADT) within the Arkansas State University System (ASU System). This policy ensures compliance with Arkansas Act 848 and provides a governance structure that promotes transparency, accountability, and responsible adoption of AI and ADT technologies.

2. Scope

This policy applies to all fa306culty, staff, students, contractors, affiliates, and members of the ASU System community, who use, develop, or oversee AI or ADT when conducting university business or using university technology resources, as defined in the policy. This policy applies to all digital institutional data, as governed by the Data Security and Classification Policy, and applies in all work settings, including on campus, remote-work locations, and approved telecommuting arrangements.

3. Definitions

• Artificial Intelligence – A machine-based system that can, based on a given set of human-defined objectives, make predictions, recommendations, or decisions that influence a real or virtual environment.
• Automated Decision Tool – A system or service that uses artificial intelligence and that has been specifically developed and marketed, or specifically modified, to make, or to be a controlling factor in making, consequential decisions.
• Technology Resources – The machines, devices, systems, services, and related components used in information processing. This includes the following:

1. 1. Machines, devices, and transmission facilities used in information processing, such as computers, word processors, terminals, telephones, cables, software, and related products.
   2. Devices used to process information through electronic capture, collection, storage, manipulation, transmission, retrieval, and presentation of information in the form of data, text, voice, or image, including telecommunications and office‑automation functions.
   3. Any component related to information processing and wired or wireless telecommunications, including hardware, software, services, planning, personnel, facilities, and training.
   4. Procedures, equipment, and software designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information, along with associated personnel, such as consultants and contractors.
   5. All email accounts that are issued by the ASU System.

• IT Organization – The unit at each institution responsible for providing information-technology solutions and services.
• User – Any individual, whether authorized or unauthorized, who makes use of any university technology resource from any location. This includes faculty, staff, students, contractors, affiliates, and members of the ASU System community.

4. Responsibilities

The university personnel involved in the management, authorization, monitoring, and review of standards and procedures governing the use of Artificial Intelligence and Automated Decision Tools for each ASU System campus, includes the following:

• Chief Information Officer (CIO) – Responsible for executive sponsorship and oversight of the university’s artificial intelligence and automated decision tool governance. The CIO ensures that appropriate resources, policies, and enforcement mechanisms are in place to support compliance with this policy. The CIO approves risk-based exceptions, resolves cross-unit tool management issues, and provides executive accountability for institutional data protection as it pertains to AI and ADT usage.
• Data Custodians (Digital Records) – Responsible for implementing and operating the technical and administrative controls that protect digital institutional data, in accordance with applicable compliance frameworks and institutional policy. This includes enforcing artificial intelligence usage guidelines, safeguarding data throughout its lifecycle, and supporting audit, monitoring, and incident response activities.
• Human Resources – Responsible for fulfilling the compliance and enforcement requirements outlined in this policy.
• Employee Training and Development Authority– Responsible for the coordination of user training requirements, assignments, and record maintenance outlined in this policy.
• Procurement Services – Responsible for developing and maintaining processes for the procurement of Artificial Intelligence, Automated Decision Tools, and any third-party platforms, as well as ensuring that risk assessments are performed prior to procurement.
• IT Organization – Responsible for maintaining a centralized inventory of all approved AI and ADT Systems.
• Third-Party Vendors – Third-party vendors providing AI or ADT solutions must demonstrate compliance with this policy, including transparency, bias mitigation, and data protection requirements.

5. Policy Exceptions

The Chief Information Officer for the campus is authorized to review and approve exceptions to this policy when organizational needs justify a deviation, and the associated risks are deemed acceptable. All exceptions must be documented, including a defined scope, a scheduled review date, and must incorporate compensating controls when appropriate. The CIO may delegate this authority, as necessary, but retains overall accountability for exception management and review.

6. Authorized Use of Artificial Intelligence and Automated Decision Tools

The ASU System permits the use of artificial intelligence (AI) and automated decision tools (ADT) for academic, instructional, research, and administrative purposes, when such use is explicitly authorized by institutional policy, academic program, or course instructor.

This authorized use must be ethical, transparent, and aligned with the academic integrity standards and acceptable use standards of each campus. Users remain fully responsible for the accuracy, originality, and compliance of all work produced with AI or ADT assistance. Unauthorized or undisclosed use of AI or ADT may constitute a violation of institutional policy or academic misconduct standards.

AI and ADT are authorized for use with data that is classified as appropriate for such systems, as outlined in the Data Security and Classification Policy. Regulated and confidential data, as outlined in the Data Security and Classification Policy, shall not be entered into AI and ADT, unless explicitly approved and contractually protected. Internal data is permitted for entry into AI agents, tools, and processing methods on university-maintained-and-approved platforms.

7. Human Oversight and Decision-Making

The ASU System requires an authorized human user or designee to make any final decision in the course of their employment, regardless of whatever AI or ADT the employee or designee recommends.

8. User Training Requirements

The ASU System shall develop a training program for all students, faculty, staff, and users of the system, concerning the appropriate use of AI and ADT in determining an outcome in the course of their time as an authorized user of the ASU System’s technology resources. This training shall be included in all training for employees and students, and shall be completed on an annual basis, as managed by the campus employee training and development authority.

9. Supplemental Standard(s)

Each ASU System IT Organization shall maintain a supplemental Artificial Intelligence Governance Standard, separate from this policy, that outlines how AI agents, tools, and processing are maintained in accordance with state, federal, and university regulations and policies. At a minimum, this will include and establish the following subjects:

• Information regarding the AI and ADT approved for use on the campus.
• Information regarding the AI-powered meeting transcription-and- recording tools approved for use on the campus.
• Enforcement and monitoring mechanisms of Artificial Intelligence and Automated Decision Tool usage on the campus.
• Information which outlines the ethical use of AI on campus, ensuring transparency in its official usage.
• Definition of platform-review cadence and risk-management steps for AI and ADT utilized on the campus.
• Data, classified as Confidential or Regulated, is not permitted for entry into any AI agent, tool, or processing method, unless explicitly authorized.
• Internal data is permitted for entry into AI agents, tools, and processing methods on IT organization-maintained-and-approved platforms.

10. Compliance and Enforcement Procedures

The ASU System Human Resources Department shall maintain a disciplinary procedure for any violation of this Artificial Intelligence Governance Policy concerning authorized use of technology resources. Violations of this policy are subject to the same enforcement and disciplinary procedures governing misuse of university technology resources.

• Complaint about Alleged Violations. Anyone, who believes that they have been harmed by an alleged violation of this policy, may file a complaint in accordance with established ASU System grievance procedures (including, where relevant, those procedures for filing complaints of sexual harassment or of racial or ethnic harassment) for students, faculty, and staff. The individual is also encouraged to report the alleged violation to the ASU System’s Authority overseeing the facility most directly involved, or to the IT Organization, which must investigate the allegation and (if appropriate) refer the matter to ASU System disciplinary and/or law-enforcement authorities.
• Reporting Observed Violations.  If an individual has observed, or is otherwise is aware of, a violation of this policy, but has not been harmed by the alleged violation, they may report any evidence to the ASU System’s Authority overseeing the facility most directly involved, or to the IT Organization, which must investigate the allegation and (if appropriate) refer the matter to the ASU System disciplinary and/or law- enforcement authorities.
• Disciplinary Procedures. Alleged violations of this policy will be pursued in accordance with the appropriate disciplinary procedures for faculty, staff, and students, as outlined in the applicable Handbook. ASU System administrators and the IT Organization may participate in the disciplinary proceedings, as deemed appropriate by the relevant disciplinary authority. Moreover, at the direction of the appropriate disciplinary authority, System Administrators and the Information and Technology Services unit are authorized to investigate alleged violations.
• Legal Liability for Unlawful Use. In addition to ASU System discipline, users may be subject to criminal prosecution, civil liability, or both, for unlawful use of any technology resources.
• Appeals. Users found in violation of this policy may appeal or request reconsideration of any imposed disciplinary action, in accordance with the appeals’ provisions of the relevant disciplinary procedures.

11. Risk Management

Due to the variable risks that come with AI products and the function they are set to perform, risk levels may be vastly different based on the AI product. In order to properly assess and secure internal or outsourced data, the ASU System must ensure that a risk assessment is performed to identify, assess, and manage risks associated with AI and ADT.

This risk assessment applies to stand-alone AI and ADT, as well as third-party platforms and integrations that utilize AI to process institutional data.

Procurement of Artificial Intelligence, Automated Decision Tools, and any third-party platforms and integrations that utilize AI, must follow all standard procurement processes, as dictated by the campus authority on procurement.

12. Policy Review

This document will be reviewed and reaffirmed annually, or upon significant changes to university IT governance, systems, or regulatory requirements.

Effective Date: October 16, 2026

Next Review Date: October 16, 2027

Version: 1.0

Referenced Policies, Standards, and Procedures:

• Data Security and Classification Policy
• Arkansas Act 848

(Adopted by the Arkansas State University System Board of Trustees on October 16, 2026, Resolution 26-48.)