1.32 Responsible Use of AI Policy

Last Revised: NEW

Refer Questions to: Gallaudet Technology Services (GTS)

Responsible Unit: Gallaudet Technology Services (GTS)

Effective: September 2026

1. Purpose

Gallaudet University & Clerc Center values learning, innovation, and progress. Generative AI tools can enrich learning and improve efficiency, and the University supports their responsible use while actively managing the risks they introduce.

The central problem this policy addresses is shadow AI: employees, faculty, and students experimenting with public AI tools without approval. Two specific risks follow:

• Confidential or personal information being entered into tools with unclear data-handling practices.
• AI-generated output becoming part of high-stakes decisions without oversight, verification, or review.

This policy sets expectations, prevents shadow AI, and demonstrates that the University is actively managing AI risk. It is intentionally lightweight and is paired with a one-page Quick Guide for Responsible AI Use and an AI Use Register maintained by Gallaudet Technology Services (GTS).

Key categories of generative AI risk include:

• Data privacy and confidentiality – AI tools may store prompts and could expose personal, sensitive, or proprietary data. Default tool settings do not protect privacy.
• Intellectual property – AI-generated content may raise IP ownership questions, particularly for outputs produced under federal funding or using institutionally owned data. Licensing Gallaudet data to AI developers requires institutional review regardless of compensation.
• AI production and institutional partnership for research purposes– Building or fine-tuning AI models, licensing institutional data to AI developers, and entering industry AI partnerships are subject to additional governance through the Office of Research and Innovation (ORI).
• Bias and discrimination – AI outputs can reflect unintentional bias. Bias cannot be eliminated; it must be managed through governance, transparency, and oversight.
• Accuracy and hallucination – AI tools can produce confident, fluent output that is wrong. Users remain responsible for verifying anything they rely on or share.

2. Scope

This policy applies to all staff, faculty, teachers, students, and researchers using generative AI tools in academic, research, operational, and administrative roles at Gallaudet University and the Clerc Center. It covers free, paid, embedded, and self-hosted AI tools that process University data of any classification level.

This policy will be reviewed annually and updated as technology and community practices evolve. Feedback may be submitted as ServiceNow tickets to the IT front desk.

3. Definitions

Generative AI – Artificial intelligence systems designed to create new content (text, images, audio, video, code, or other outputs) based on patterns learned from training data. Generative AI produces novel outputs and may include inaccuracies, biases, or unintended disclosure of sensitive information.

Shadow AI – Use of AI tools, plug-ins, browser extensions, or API integrations with University data or in University workflows without GTS approval and without registration in the AI Use Register.

Confidential Information – Business or technical data and research information proprietary to Gallaudet University, Clerc Center or external partners, which must remain protected from public disclosure.

Personal Information (PII) – Data that directly or indirectly identifies an individual.

Research Data and Community Data – Data generated through or collected in research activities, including linguistic, behavioral, or cultural data contributed by community members. ASL and sign language data carries additional IP, consent, and sovereignty considerations governed through ORI.

AI Use Register – The authoritative record, maintained by GTS, of AI use cases at Gallaudet and Clerc Center, including ownership, data involved, risk tier, human oversight model, approval status, and next review date.

Human-in-the-Loop, On-the-Loop, Full Autonomy – Three models of human oversight over AI output. Defined in Section 6.

No-Training Clause – A contractual or configuration commitment that prompts and other University data submitted to a vendor will not be used to train, fine-tune, or evaluate the vendor’s models.

Conflict of Interest (COI) – A situation in which an individual’s personal, financial, or professional interests could improperly influence, or appear to influence, their decisions or responsibilities related to procurement, evaluation, deployment, or oversight at Gallaudet University or the Clerc Center.

Information Security Officer (ISO) – The University official responsible for developing, implementing, and overseeing the university’s information security program, including risk management, incident response, and compliance with applicable security and privacy requirements. 

Data classification levels are defined separately in the University Data Security Classification Policy.

4. Tiered Risk Model

Every AI use case at Gallaudet & Clerc Center falls into one of three tiers. The tier determines the level of review and oversight required before the use case may proceed.

When in doubt, treat the use case as high-risk and request review. GTS will publish examples of each tier alongside this policy and update them over time.

5. High-Risk Pre-Approval Checklist

Before a high-risk AI use case goes live, the accountable owner must complete and submit the following checklist to GTS (with ORI co-review for research and community-data use cases). The checklist becomes part of the entry in the AI Use Register.

• Purpose and ownership – Why the system exists, what decisions it informs, and who is accountable.
• Data and privacy – What data flows through it, classification, retention, and a documented no-training clause for any Level 2+ data.
• Legal and compliance – Regulatory and contractual obligations addressed (FERPA, HIPAA where applicable, sponsor terms, vendor DPA).
• Security controls – Authentication, logging, access controls, and completed vendor security assessment.
• Human oversight – Reviewer roles, approval points, and escalation paths (see Section 6).
• Safeguards – Intervention triggers, kill switches, and rollback procedures.
• Explainability – How decisions can be explained to affected parties (students, employees, research participants).
• Sign-off – Documented approval from the accountable owner and from the ISO before go-live.

6. Human Review Models

The appropriate oversight model depends on the impact and reversibility of the AI’s output. Owners must specify which model applies and document it in the AI Use Register.

Automation without explanation is not acceptable for any high-risk action. If the system cannot explain an output in terms an affected person could understand, it cannot operate without a human in the loop.

7. AI Use Register

GTS maintains the AI Use Register as the authoritative record of AI use at Gallaudet & Clerc Center. Every high-risk use case must be registered before go-live. Recurring or organized low-risk uses (e.g., a department-wide use of a chat assistant) should also be registered.

Required fields

Metrics the register surfaces

• How many AI use cases have been risk-assessed.
• Which high-risk activities are operating with human review in place.
• How quickly AI-related incidents are remediated.
• Trend in shadow AI discovered through monitoring and self-reporting.

8. Responsible Use

All members of the Gallaudet & Clerc Center community are expected to follow these rules:

• Use approved tools. Before using an AI tool (free or paid) with University data, confirm it appears on the approved list maintained by GTS. To request approval for a new tool or an exception, submit a ServiceNow ticket to the IT front desk.
• Protect confidential and personal data. Do not enter Level 2 or higher data into AI tools unless an approved contract with a no-training clause is in place. Default AI settings do not protect privacy.
• Require a no-training clause for Level 2+ data. When a vendor cannot provide one in writing, the use case is high-risk by default and requires ISO approval before any institutional data is submitted.
• Verify AI output. AI output may be inaccurate, fabricated, or biased. Users are responsible for verifying anything they share, publish, or act on.
• Disclose AI use in created media. When AI is used to generate images, video, audio, or substantive written content for external distribution, clearly disclose that AI was used.
• Do not bypass safeguards. Do not use jailbreaks, prompt injection, or alternative accounts to circumvent vendor or University controls.
• No harmful use. AI must not be used to create malware, phishing content, deepfakes, defamatory or discriminatory content, or to impersonate individuals or organizations.
• Recognize and manage bias. Critically evaluate AI output, especially where it touches race, ethnicity, gender, disability, deafness, language, or other protected categories.
• AI supports, does not replace, human decision-making. Where AI informs a decision affecting an individual, a human remains accountable and the use of AI must be disclosed.

9. Academic Integrity

Academic integrity is a cornerstone of Gallaudet & Clerc Center’s mission, and the use of AI tools must not undermine the originality of academic work.

For students

• AI use in coursework or exams is not allowed unless the instructor explicitly approves it.
• Students should confirm with each instructor what AI use is permitted in a given course.

For faculty and teachers

• Clearly state AI usage expectations in each syllabus.
• Open discussions about AI-generated content can help students understand its role in their learning.

For staff

• AI may be used to draft internal communications, reports, recommendations, and documents, provided sensitive or confidential information is not included in prompts, unless the tool was authorized for such use.

10. AI Use in Research

In addition to the general rules in Section 8, research uses of AI are subject to oversight by the Office of Research and Innovation (ORI). ORI is the first point of contact for any institutional review of research-related AI activity.

• Transparency – Disclose AI use in methodology, documentation, and acknowledgments as appropriate to the venue.
• Accuracy and verification – Researchers remain responsible for the accuracy of AI-assisted analyses and outputs.
• Confidential information – Do not enter unpublished data, proprietary information, or third-party confidential data into AI tools unless a contract covers proper security measures and a no-training clause.
• Federal funding compliance – Verify that AI use does not conflict with sponsor requirements or award terms. AI-generated outputs produced under a federal grant may carry IP obligations under Bayh-Dole; consult ORI before publishing or commercializing such outputs.
• Human-subjects considerations – AI tools used to process, analyze, or generate data involving research participants may require IRB review. Consult ORI and the IRB coordinator before incorporating AI into any protocol.
• Data provenance and licensing – When Gallaudet research data (including ASL, sign language, or other community-generated data) is used to train, fine-tune, or evaluate AI models, that use must be documented and reviewed by ORI prior to execution. Licensing arrangements with external AI developers require ORI approval and, where applicable, outside IP counsel review.
• Conflict of interest – Researchers with financial interests in, or affiliations with, AI companies or platforms must disclose those relationships before using such tools in research or recommending them for institutional adoption, consistent with Gallaudet’s COI policies.

ASL and sign-language data is presumptively high-risk and must follow the high-risk vetting process before use in any AI system.

11. Bias and Explainability

AI bias is unavoidable. The goal is to manage it, not to eliminate it.

• Avoid automation without explanation. Any high-risk action must be accompanied by an explanation an affected person can reasonably understand.
• Critically evaluate AI output for bias, especially where it touches protected categories, deafness, language, or community identity.
• Manage AI through governance, transparency, and oversight rather than chasing perfection.

12. Approved Tools and Exceptions

GTS maintains a list of AI tools approved for use with University data, including the data classification levels each tool is approved for. To request approval for a new tool, an exception, or a change to an existing approval, submit a ServiceNow ticket to the IT front desk.

Exceptions are time-limited, documented in the AI Use Register, and reviewed by the ISO.

13. Monitoring and Enforcement

GTS will monitor for unapproved AI tool use through normal endpoint, identity, and network telemetry, and through self-reporting via ServiceNow. Suspected violations are handled through standard IT incident response procedures and, where appropriate, HR or Academic Affairs processes.

Discovery of shadow AI is treated first as an opportunity to bring the use case under governance. Repeated or willful violations involving sensitive data are treated as security incidents.

14. Training

The University will provide ongoing AI literacy and policy training for students, faculty, and staff. Research staff and faculty principal investigators will receive additional training on research-specific AI contexts, including data governance, federal compliance, and IP considerations.

This policy is paired with a one-page Quick Guide for Responsible AI Use that is published alongside it and used in onboarding and annual training.

15. Policy Review

This policy is reviewed at least annually by the ISO, with input from ORI, Academic Affairs, the General Counsel. Material changes are communicated to the community before they take effect.

16. Contact

Questions, requests for tool approval, exception requests, and feedback on this policy may be submitted as ServiceNow tickets to the IT front desk. Research-specific questions should also be routed to ORI.

---

Quick Guide for Responsible AI Use

One page. Print it. Post it. Share it.

Before you paste anything into an AI tool, ask:

• Is this an approved tool for the kind of data I’m about to share?
• Would I be comfortable if this prompt showed up in a vendor’s training set?
• Is anyone going to make a decision based on this output without checking it?

Green light – generally OK

• Brainstorming, outlining, summarizing public documents.
• Drafting non-sensitive internal communications.
• Learning a new topic or getting unstuck on a problem.
• Code suggestions on non-sensitive code.

Yellow light – check first

• Anything involving Level 2 data or above.
• Anything that will inform a decision about a person.
• New tools, plug-ins, or browser extensions not yet on the approved list.
• Research data, especially ASL or community-generated data.

Red light – do not do

• Pasting passwords, SSNs, banking, health, or student records into any AI tool not authorized for this type of data.
• Using AI to generate phishing, malware, deepfakes, or impersonation content.
• Letting AI make a final decision about a student, employee, or research participant.
• Working around vendor or University controls to get an AI tool to do something it refused to do.

If something goes wrong

Open a ServiceNow ticket to the IT front desk. We would rather hear about it early than discover it later. Self-reporting is treated as a chance to fix the use case, not as a violation.