AI Tools

Before You Choose a Tool, Understand the Framework

AI use at USU is governed by:

AI Appropriate Use Procedure: the procedural expectations supporting Policy 5200, Section 2.8. Start here for principles, data classification, and tool guidance.

The throughline: whether a use of AI is appropriate is a function of three factors together: the tool and the data going into it, the use the AI is put to, and any law, regulation, or contract that applies to the work. No single factor authorizes a use on its own: an approved tool does not make a high-risk use appropriate, and a consequential decision is a consequential decision regardless of which tool runs it.

Can I Use AI for This?

Three factors: all three must clear. No single factor authorizes a use on its own.

Factor 1

Tool & Data

Is This Tool Approved for This Data?

Find the tool and your data class in the Tool Capability table.

Approved: Continue to Factor 2

Conditional: Ask IT First

Not Approved: Stop

Note: Never use free & personal accounts for USU data

Factor 2

Use

What is the AI Doing or Deciding?

Routine work (drafting, summarizing, coding): go. Verify outputs.

Public-facing (chatbots, official comms): disclose that AI was involved.

Decisions about a person (admissions, grading, hiring, aid): PIA + CDPO review first. Human makes the final call.

Prohibited Uses: never, with any tool.

Factor 3

Law & Rules

Do Special Rules Cover This Work?

Student records (FERPA) → Registrar / CDPO

Health data (HIPAA) → HIPAA Privacy Officer

Research / export controls / CUI → Office of Research + sponsor

Grant peer review (NIH / NSF) → Never, funders prohibit AI in review

Note: If a rule applies, check before you start.

All three clear → Go.

Verify outputs; you are accountable for the result, with or without AI.

Any factor fails → Stop.

Use an approved path instead, or ask: #ai_usu on Slack or mytech.usu.edu

A green mark on the tool doesn't authorize a high-risk use, and a routine use doesn't make an unapproved tool safe.

USU AI Appropriate Use • ai.usu.edu • supports Policy 5200 § 2.8 • informed by NIST AI RMF 1.0

AI Tools Available at USU

Factor 1 • Tool Capability for Institutional Data

This table answers one question: is the tool approved to hold institutional data at this data class? It does not answer whether your specific use is appropriate; that is Factor 2 below.

AI Tools	Access via USU-Managed Environments				Tool Capability by Data Class*
AI Tools	Students	Instructors	Researchers	Staff	Low-Risk	Moderate-Risk	High-Risk
Copilot Chat with Data Protection	Included	Included	Included	Included
Box AI	Included	Included	Included	Included
Zoom AI Companion	Included	Included	Included	Included
Google Gemini	Included	Included	Included	Included
Gemini Notebook	Included	Included	Included	Included
Copilot for Microsoft 365	Not Available	Subscription	Subscription	Subscription
Claude (Education)	Not Available	Subscription	Subscription	Subscription
ChatGPT (Enterprise/Teams)	Not Available	Subscription	Subscription	Subscription

The following are not provisioned through USU IT—you create and manage your own account or installation

AI Tools	Access via USU-Managed Environments				Appropriate Use for USU Institutional Data
AI Tools	Students	Instructors	Researchers	Staff	Low-Risk	Moderate-Risk	High-Risk
Free or Personal AI Accounts	Personal	Personal	Personal	Personal
Local / Self-Hosted LLMs	Self-setup	Self-setup	Self-setup	Self-setup

Table Key

Included— no extra cost, available with your USU account

Subscription — paid subscription required; Available via software.usu.edu

Not Available— not available through USU software channels

Personal/Self-setup— not managed by USU IT

HIPAA/BAA In Place FERPA School Official Designation

*See the Institutional Data Classification page for more information about data classifications. Classification is determined by the policy's criteria; when data spans tiers, treat it at the highest applicable tier.

The symbols in the table show Factor 1 only. Even when a tool is Approved for a data class, Factor 2 (Use) and Factor 3 (Law, regulation, or contract) still apply. Read both factors below before deciding.

Factor 1 Outcomes

What each symbol in the Tool Capability by Data Class columns means.

Approved

Contractual or configuration-based protections are in place for this data class. Use is still subject to USU's AI use procedure, Policy 5200 § 2.8, and applicable data classification guidance.

Conditional

Use may be appropriate depending on context and configuration. Consult IT or your data steward before proceeding. See the AI use procedure for guidance.

Not Approved

Data of this classification must not be entered into this tool. The tool is not configured or contracted for this level of risk. See the data classification guidance for examples of what qualifies.

Factor 2 levels • What is the AI being used to decide?

An approved tool with the right data class is not enough on its own. Identify which level below describes your use.

Minimal

Productivity & Drafting

Writing assistance, summarizing, brainstorming, coding help, internal research, document review. No consequential decision about a person. Use any approved tool that's appropriate for the data you're putting in. Verify outputs.

Limited

Disclosure Required

Consumer-facing chatbots, AI-generated communications, AI in tutoring or learning aids (not used for grading). Must disclose AI involvement to affected individuals.

High-Risk Use

Consequential Decisions

AI making or substantially shaping decisions about a person: admissions, grading, financial aid, hiring, performance evaluation, accommodations, conduct, resource allocation. PIA + CDPO review required before deployment, regardless of which tool is used or what data is involved. Meaningful human review mandatory.

Prohibited

Off-Limits

Emotion recognition; biometric trait inference; deepfakes; discrimination against protected classes; training external models on USU data; AI services from countries of concern. Regardless of tool.

See the full Prohibited Uses list

About the PIA. A Privacy Impact Assessment is a gate on the use, not on the data. If your use is high-risk, PIA and CDPO review are required even if the tool is Approved and the data is low risk. For routine work (drafting, summarizing, brainstorming) with the right tool for your data class, no PIA is required. The list of prohibited uses above is the lead set; the complete Prohibited Uses list is maintained in the Appropriate Use Procedure. When in doubt, ask the CDPO.

Factor 3 • Law, Regulation, or Contract

Specific laws, funder rules, sponsor contracts, or institutional agreements can place limits on what tools or uses are allowed for particular kinds of work, sometimes overriding what Factors 1 and 2 would otherwise permit. Before using AI for the kinds of work below, check the linked guidance or contact the named office.

Research Data

Sponsor and Federal Rules

Sponsor contracts, federal regulations (export controls, CUI, CMMC, NIST SP 800-171), and IRB-approved protocols may limit which AI tools can be used with research data and how. Always confirm with the Office of Research before using AI on sponsored-project data or any controlled research data.

Health Information

HIPAA

HIPAA-covered information may only be used with AI tools that have a Business Associate Agreement in place and are configured for that use. Contact the HIPAA Privacy Officer before using AI with patient or health-services data.

Student Records

FERPA

Use of AI tools with student education records is governed by FERPA. Approved tools have FERPA terms in place, but specific uses (especially decisions about students) may carry additional obligations. Contact the Registrar or the CDPO when in doubt.

Grant Peer Review

NIH and NSF Rules

NIH and NSF prohibit the use of generative AI when reviewing grant proposals. This applies regardless of which AI tool you use, including USU-licensed services. See the Appropriate Use Procedure.

Other Rules

Funder, Sponsor, or Unit-Specific

Other applicable laws, regulations, or contracts may apply to your work: for example, GLBA for financial aid, PCI-DSS for cardholder data, or unit-specific agreements. When in doubt, ask before you use AI.

Putting the Three Factors Together

A use is appropriate only when all three factors clear. Factor 1: the tool must be approved (or approved with conditions, with the condition met) for the data you are using. Factor 2: the use itself must be permitted at the applicable level; high-risk uses require PIA and CDPO review regardless of the tool. Factor 3: any law, regulation, funder rule, or sponsor contract that applies to your work must allow the tool and the use. A green dot on Factor 1 does not authorize a high-risk use; a permitted use does not override a sponsor restriction.

Tool Details & Conditions

The specifics behind each row in the matrix above: availability, data capability, and the conditions that apply.

LinkedIn Learning courses listed below are available to USU employees at no cost as part of university employment benefits. Sign in with your USU credentials.

Copilot Chat with Data Protection

Microsoft • copilot.microsoft.com

Availability

Students Instructors Researchers Administrators & Staff

Tool Capability for Institutional Data

Low-Risk Data (Public / No Impact)

Moderate-Risk Data (Regulated)

High-Risk Data (Notify on Breach)

Notes & Conditions

FERPA School Official

HIPAA/BAA In Place

The BAA (Business Associate Agreement) extends to Copilot Chat when using corporate protection; the technology is capable across all data classes. Users must be signed in with USU credentials (@usu.edu); a personal Microsoft account does not carry these protections. Actual use remains subject to Factor 2 (Use) and Factor 3 (Law & rules) above, USU administrative controls, and applicable policies.

Training

Learn how to use Microsoft Copilot (Microsoft Learn) — official documentation and getting-started guides.
Get Started with Microsoft Copilot (LinkedIn Learning path)

Box AI

Box · Built into USU Box (box.usu.edu)

Availability

Students Instructors Researchers Administrators & Staff

Tool Capability for Institutional Data

Low-Risk Data (Public / No Impact)

Moderate-Risk Data (Regulated)

High-Risk Data (Notify on Breach)

Notes & Conditions

Contractually protected

FERPA School Official

HIPAA/BAA In Place

Already enabled for all USU Box content. Contractual protections are in place and the technology is capable across all data classes; actual use remains subject to Factor 2 (Use) and Factor 3 (Law & rules) above, USU administrative controls, and applicable policies. Box AI should only be applied to content already appropriately stored in Box at the correct classification.

Training

Getting Started with Box AI (Box University) — free learning path, Box account required
Using Box AI — Box Support documentation

Zoom AI Companion

Zoom • Built into USU Zoom

Availability

Students Instructors Researchers Administrators & Staff

Tool Capability for Institutional Data

Low-Risk Data (Public / No Impact)

Moderate-Risk Data (Regulated) High-Risk Data (Notify on Breach)

Notes & Conditions

Contractually protected

Enabled for all USU Zoom accounts; contractual protections are in place and the technology is capable for low- and moderate-risk data. For meetings or recordings involving high-risk data (e.g., HIPAA-covered content), the technology may be capable depending on account configuration; confirm with IT and ensure use aligns with USU administrative controls and applicable policies.

Training

Zoom AI Companion Onboarding Resources — user guides, templates, and demo videos
Getting started with Zoom AI features — Zoom Support documentation
Zoom AI Companion: Maximizing Your Virtual Meeting Productivity (LinkedIn Learning)

Google Gemini

Google • USU Google Workspace • gemini.google.com

Availability

Students Instructors Researchers Administrators & Staff

Tool Capability for Institutional Data

Low-Risk Data (Public / No Impact)

Moderate-Risk Data (Regulated) High-Risk Data (Notify on Breach)

Notes & Conditions

FERPA School Official

Baseline security configuration; contracts are in place and the technology is capable for low- and moderate-risk data. Must be accessed with a USU.EDU account to ensure data is not used for model training. The technology is not configured for high-risk data. Use is subject to USU administrative controls and applicable policies.

Training

Gemini for Google Workspace Resources Hub — guides, tips, and use case examples
Google Workspace with Gemini (Google Skills) — free self-paced learning path on Google Skills
Introduction to Gemini for Google Workspace (LinkedIn Learning)

Gemini Notebook

Google • USU Google Workspace • gemini.google.com • formerly NotebookLM (merged into the Gemini app, July 2026)

Availability

Students Instructors Researchers Administrators & Staff

Tool Capability for Institutional Data

Low-Risk Data (Public / No Impact)

Moderate-Risk Data (Regulated) High-Risk Data (Notify on Breach)

Notes & Conditions

FERPA School Official

Baseline security configuration; contracts are in place and the technology is capable for low- and moderate-risk data. Must be accessed with a USU.EDU account. The technology is not configured for high-risk data. Use is subject to USU administrative controls and applicable policies.

Training

Gemini Notebook Help Center — official documentation, tips, and FAQ
Learning NotebookLM (LinkedIn Learning; course title predates the Gemini Notebook rename)

Copilot for Microsoft 365

Microsoft · M365-integrated (Word, Excel, Teams, Outlook, etc.)

Availability

Students Instructors Researchers Administrators & Staff

A subscription for this tool can be requested through software.usu.edu.

Tool Capability for Institutional Data

Low-Risk Data (Public / No Impact)

Moderate-Risk Data (Regulated)

High-Risk Data (Notify on Breach)

Notes & Conditions

HIPAA/BAA In Place

Available as a purchased add-on per A# account (annual commitment, using a USU index number). A Business Associate Agreement is in place and the technology is capable across all data classes; actual use remains subject to Factor 2 (Use) and Factor 3 (Law & rules) above, USU administrative controls, and applicable policies.

Training

Get started with Microsoft 365 Copilot — free official learning path
Microsoft 365 Copilot Adoption Hub — guides, scenario libraries, and quick-start resources
Learning Microsoft 365 Copilot for Work (LinkedIn Learning)

Claude (Education)

Anthropic • USU Claude for Education Tenant • upgraded from Teams (July 2026)

Availability

Students Instructors Researchers Administrators & Staff

A subscription for this tool can be requested through software.usu.edu.

Tool Capability for Institutional Data

Low-Risk Data (Public / No Impact)

Moderate-Risk Data (Regulated) High-Risk Data (Conditional)

Notes & Conditions

USU's Claude environment is provisioned under Claude for Education, which carries enterprise-grade security and administrative features (SSO, admin console, audit logs, and data controls); contracts are in place and the technology is capable for low- and moderate-risk data. For high-risk data, added contractual protections under the Education agreement may apply depending on the data involved; confirm with your data steward before use and keep high-risk content in an approved repository (Box), using Claude on materially redacted or derived inputs where approval has not been confirmed. Use is subject to USU administrative controls and applicable policies.

Training

Claude for Work (Anthropic Academy) — free courses on using Claude effectively in a professional context
Use Claude for Education at your university — Claude Help Center
Nano Tips for Using Anthropic's Claude AI (LinkedIn Learning)

ChatGPT (Enterprise/Teams)

OpenAI · USU Teams Tenant

Availability

Students Instructors Researchers Administrators & Staff

A subscription for this tool can be requested through software.usu.edu.

Tool Capability for Institutional Data

Low-Risk Data (Public / No Impact)

Moderate-Risk Data (Regulated) High-Risk Data (Notify on Breach)

Notes & Conditions

Baseline security configuration; contracts are in place and the technology is capable for low- and moderate-risk data. The technology is not configured for high-risk data. For high-risk content, keep the data in an approved repository (Box) and use ChatGPT only on materially redacted or derived non-high-risk inputs. Use is subject to USU administrative controls and applicable policies.

Training

OpenAI Academy — free structured courses on AI basics, ChatGPT, and responsible use
OpenAI Learning Hub — guides, webinars, and practical resources for business users
Building ChatGPT Skills for Business Professionals (LinkedIn Learning path)

Free or Personal AI Accounts

ChatGPT free, Claude.ai personal, Gemini personal, etc.

Availability

No Institutional Protection

Tool Capability for Institutional Data

Low-Risk Data (Public / No Impact) Moderate-Risk Data (Regulated) High-Risk Data (Notify on Breach)

Notes & Conditions

Public data only

No institutional contractual protections are in place. Inputs to free-tier or personal-account tools may be used for model training by the provider. Institutional data, regardless of classification, must be processed only in USU-procured tools. Personal accounts are for personal, non-USU content. If a free tool meets a need that no USU tool meets, request central evaluation through IT rather than using a personal account. See the Appropriate Use Procedure.

Local / Self-Hosted LLMs

Ollama, LM Studio, on-device models, etc.

Availability

Consult Your MyTech Before Use

Tool Capability for Institutional Data

Configuration-dependent

Notes & Conditions

Configuration-dependent

No centralized contractual protections: capability depends entirely on deployment configuration, hardware location, network isolation, and access controls. The technology may be capable for any data class on a properly secured USU system; actual use is subject to USU administrative controls and applicable policies. Consult IT before use with any institutional data so the deployment can be evaluated.

How USU Governs AI Risk

USU's approach to AI risk is informed by the NIST AI Risk Management Framework (AI RMF 1.0). How USU's existing practices map to the framework, including the tool inventory, risk-based oversight, review cadence, and feedback paths, is documented in the AI Appropriate Use Procedure.

Prohibited Uses

Certain uses of AI are off-limits regardless of which tool is used, including USU-licensed services. The lead set: emotion recognition and sensitive-trait inference; deepfakes and deceptive synthetic media; discrimination against protected classes; consequential decisions about a person without meaningful human review; training external models on USU data; processing institutional data outside approved tools; and AI services from countries of concern. The complete list, with the legal grounding for each item, is maintained in the AI Appropriate Use Procedure.

Other Resources

Centers & Programs

USU's centers and programs advancing AI research, teaching, and applied work.

Learn More about Centers & Programs

Projects at USU

AI-related projects, initiatives, and partnerships underway across the institution.

Learn More about Projects at USU

Are you aware of an AI resource that may be of interest to USU students, faculty, researchers, and staff? Please share your recommendations with us!