Using AI Responsibly

The AI tools currently approved for use with public and confidential data are:

• Microsoft 365 Copilot & Copilot Chat
• Zoom Companion AI
• Vertex AI
• Azure Open AI

For a full list of applications and tools approved for university use, as well as NOT approved, please visit the page Reviewed University Applications (requires SSO). 

The University of Colorado has adopted data classification types including Highly Confidential Information, Confidential Information and Public Information. Review the CU Data Classification Table for more information about data types (or see accordion below and chart to the right). 

Be cautious when using AI tools, ensuring that personal, sensitive and university data are not uploaded or shared with unvetted AI systems, as they may not be secure. How an AI tool or assistant processes and uses the data that is input into it is a key factor in determining its security.

In addition to using university approved AI tools with public or confidential data, all users must follow and abide by university policy - and relevant state and federal law regarding protecting data and information systems. These include but are not limited to: 

• HIPAA 
• FERPA
• GLBA 
  
• FISMA (NIST 800-53Rev5)
• GDPR 
• University HIPAA Policy
• University Acceptable Use of Information Technology Resources - Policy 5001
• Administrative Policy Standard 6005 - IT Security Program

Please note: For Microsoft AI tools, though Microsoft assures that your data and university data won’t be used to train their artificial bot, it is still advisable to exercise caution. When using Copilot Chat, be sure you are logged in to your university account and confirm that the "protected shield" is visible in the prompt area. Additional information about securely using AI are available. Visit the ISIC webpages: Microsoft Copilot products, Zoom AI Companion features and AI Security and Compliance. 

The popularity of artificial intelligence technology is making news and we are seeing excitement about its use within the university. CU is in the process of establishing guidelines and compliance requirements for using AI — with the complexity of this technology, it may take some time. And without proper security controls, AI technology can become susceptible to privacy, confidentiality, and security threats. Cybercriminals could inject malicious data or images into a machine learning model to deliberately attack the integrity of the data. Data uploaded into AI technology could remain there permanently, circumventing appropriate university protections and security controls.

Be sure to avoid uploading or sharing university data into unvetted AI systems as they are not secure. Contact the Risk and Compliance team at [email protected] for assistance vetting AI prior to acquiring a technology, particularly if the AI is intended for clinical purposes or will use highly confidential data such as FERPA or HIPAA data.

Learn more: CU Anschutz Security Policies, Standards and Guidance

Document Classification Quick Guide

Below are further resources to ensure you are using Microsoft AI tools safely and securely.

• Learn how to use Microsoft Copilot AI tools safely with university data on our Securely Using Microsoft AI page. 
• Explore Microsoft's guidance on AI privacy, safety, reliability, and accountability on their Responsible AI page. 

Below are further resources to ensure you are using Zoom AI tools safely and securely.

• Learn how to use Microsoft Copilot AI tools safely with university data on our Zoom AI Companion security features page.  
• Explore Zoom's guidance on AI privacy, safety and security on their website.

Definition: Generative AI will produce different results every time even if the exact same prompt is used. While fun an exciting for creative activities, this can be problematic for tasks requiring predictability and consistency. 

Workaround: Always fact-check the results of any prompt to ensure accuracy.

Definition: Hallucinations are when a generative AI produces a clearly false statement or result but presents it as fact. Hallucinations happen because LLMs are trained by massive data sets, including information and data found on the internet. Not all data sets have been fact checked because of the enormity of their size. It is well known that not all the information found on the internet is accurate, but the AI has no way of differentiating fact from fallacy or misinformation. 

Workaround: Always fact-check the results of any prompt to ensure accuracy. If you discover a hallucination, correct the AI and either upload or reference a reliable source with the correct information. Then, try your prompt again. If you get another hallucination, revise your prompt to include specific and well-defined boundaries and constraints. 

Definition: Generative AI is great for administrative tasks and narrow prompts. However, it is limited in its scope and currently unable to process broad challenges like developing a strategy, decision making, or navigating ethical dilemmas. It does not currently have the capability to understand context or complex situations. It focuses mainly on causality (cause and effect) and pattern recognition. 

Workaround: Use it to support your work in these areas to make the administrative part easier. It can also help with brainstorming and idea generation, but you will need to piece it all together. 

It is not acceptable to use AI tools not approved by the university. Using AI tools not approved by the university inherently carries risks such as data exposure, ethical concerns, and potential inaccuracies. Users must be aware of these risks and take appropriate measures to mitigate them. Inputting data into un-approved AI tools is analogous to sharing data publicly, which is prohibited by many data use agreements. 

Risks of using non-approved AI tools include:

1. Data Exposure & Privacy Sensitive Data Leakage: Inputting Confidential or Highly confidential data (e.g., PHI, HIPAA-regulated info) may result in unintended storage or exposure. 
   1. Data Usage by Providers: Many unapproved AI tools use your inputs to train their models, which may include personal or institutional data. 
   2. Retention & Access: User data may be stored indefinitely and could be accessed without authorization. 
2. Security Threats: 
   1. Breach Risk: Inputting sensitive data increases the risk of exposure through cyberattacks and provider vulnerabilities. 
   2. Phishing & Exploits: AI can be misused to craft convincing phishing messages or support other malicious activities. 
   3. Misuse of Data: Information may be exploited for identity theft, fraud, or targeted manipulation. 
3. Research & Ethical Concerns 
   1. Inaccuracy: AI-generated content may be incorrect, misleading, or fabricated (e.g., fake citations). 
   2. Bias: Outputs may reflect and perpetuate biases from training data, including synthetic datasets. 
   3. Ethical Misuse: AI can be used to generate harmful or unethical content. 
   4. Privacy in Research: Sharing research data with unapproved tools may violate privacy or data use agreements. 
   5. Reproducibility: Reproducibility is a key tenet of research and one of the challenges of AI tools, researchers, in particular, should do due diligence in documenting reproducibility for their research should scientific process questions arise.