Responsible Use of Artificial Intelligence (AI)

The use of any AI tool (stand-alone or embedded) for University academic, research, scholarly and creative work (hereafter noted as research) or administrative activities (“University Activities”) must comply with CU’s data security, privacy, and intellectual property policies.

Users need to consider the security, privacy and handling of any information they provide to GenAI tools and vendors, as well as evaluating the quality and accuracy of the output of the system.

AI should be used in ways that are consistent with the University’s mission of education, research, service, and public impact. AI should be used in ways that preserve academic freedom, safeguard privacy and institutional data, maintain appropriate security and risk management, promote fairness and inclusion, and support appropriate and equitable access to AI capabilities, recognizing that tools and implementations may vary across disciplines and use cases.

AI should not be used to deceive, manipulate, misrepresent, circumvent established requirements or controls, or compromise the integrity of research, scholarship, teaching, or other academic work.

Consistent with applicable laws, regulations, and University policies, individuals and units may determine that certain activities should not rely on AI and may establish appropriate alternative processes where feasible.

AI should be used in ways that maintain and prioritize human judgment and creativity, aligning with the University’s mission to provide high-quality education and to advance research and service. Use of AI does not replace or alter existing decision-making authority. Responsibility and accountability for decisions and outcomes cannot be delegated to an AI system. Users must recognize that AI systems may reflect or amplify inaccuracies, biases, or incomplete information and should exercise judgment when relying on AI-generated outputs. Oversight requirements will be defined through campus AI governance processes.

AI should be used with awareness of potential impacts on individual wellbeing. Users should exercise caution when applying AI in contexts involving sensitive personal, emotional, or psychological matters, and should not rely on AI as a substitute for qualified professional or institutional support services.

The University recognizes that digital technologies, including AI, consume significant computational and natural resources. Consistent with CU’s commitment to responsible stewardship, institutional decisions regarding the procurement, implementation and use of AI tools should, where feasible, consider resource consumption and environmental impact as part of broader technology evaluation.

1. Scope and General Requirements: This Policy governs the use of AI for University activities by all CU students, faculty, staff, and other individuals or entities using University information technology resources or acting on behalf of the University (“Users”). All use of AI for University activities must comply with applicable laws, regulations, and University policies and procedures, including those related to classified data. Key applicable CU policies and practices include, but are not limited to:
   1. Acceptable Use Policies: Users of AI tools must adhere to campus IT acceptable use policies which require ethical and legal use of IT resources.
       
   2. APS 6005 – IT Security Program: CU’s baseline security standards (APS 6005) apply to AI and data.  Users must protect University data when using AI tools. Confidential and highly confidential data (including but not limited to Social Security numbers, financial account numbers, driver’s license/state IDs, HIPAA Protected Health Information, FERPA-protected student information or other data classified as “confidential” or “highly confidential” under APS 6010) may only be entered into AI approved for the applicable data classification.
       
   3. APS 6010 – Data Governance: Any AI tool that handles University data must comply with CU’s data governance and data classification requirements (APS 6010).   In practice, this means data used by AI must be classified (e.g., public, confidential, or highly confidential) and protected accordingly. The input of confidential and/or highly confidential data into an AI tool that has not been reviewed and approved for use by campus IT is strictly prohibited.
       
   4. APS 2027 Code of Conduct: The use of AI tools at CU must reflect the University’s commitment to upholding the highest ethical, professional, and legal standards. AI tools may not be used in ways that violate conduct expectations for CU faculty, staff and students.
       
   5. Intellectual Property
       
      1. Faculty intellectual property (IP), such as course materials and other instructional materials, may not be submitted to AI tools for model training or other secondary uses without their express permission. See Regent Policies 5.H and 5.I, APS 1013 and APS 1014 for further details on faculty intellectual property ownership.
          
      2. Students retain ownership of their original work except where University policy, employment agreements, sponsored research agreements, or other applicable law or contractual obligations provide otherwise.
          
   6. APS 2006 Records Retention: AI-related content, including prompts, outputs, and related records that are retained, must be managed in accordance with University records retention requirements. Users are responsible for ensuring that such records are retained, managed, and disposed of in compliance with APS 2006 and applicable records management guidance.
       
   7. University procurement policies and procedures: The procurement of AI tools must follow the University’s procurement policies and procedures, including appropriate fiscal, cybersecurity and accessibility reviews.
       
   8. Users may not input, upload, or provide data to any AI tools if doing so would violate legal, contractual, or licensing restrictions, including by enabling unauthorized access, retention, reuse, disclosure, or training by AI tool vendors.
      
      Examples of materials subject to external data protection requirements include, but are not limited to:
       
      1. Protected Health Information (PHI) regulated by the Health Insurance Portability and Accountability Act (HIPAA)
          
      2. Student information protected by the Family Educational Rights and Privacy Act (FERPA)
          
      3. United States Copyright Law (Title 17 of U.S. Code)
          
      4. Research data protected by conditions specified in grants and contracts which may include adherence to standards like ITAR/EAR, CMMC, FISMA, etc.
          
      5. Payment card data protected by contractual agreement to adhere to the Payment Card Industry Data Security Standard (PCI-DSS).
          
   9. As a public institution, the University is subject to the Colorado Open Records Act (CORA). Prompts, outputs, and related records (including logs, where applicable) may be subject to disclosure upon request. The University will comply with CORA while continuing to protect information that is exempt from disclosure under applicable law.
       
   10. Responsible Implementation: University units and individuals procuring and deploying AI tools are  responsible, within the scope of their roles and authority, for complying with applicable laws, regulations, and University policies and procedures. 
        
   11. Branding standards: AI-derived content used for official communications must comply with branding, communication, marketing, photography, videography, and web policies.
        
   12. AI Model Training: University data, including information related to students, faculty, and staff, must not be used for external or commercial AI model training unless explicitly authorized through approved agreement and campus or system governance and in compliance with applicable privacy, security, and data governance policies. Data subject to third-party ownership or intellectual property rights must not be used for any AI model training without affirmative and informed consent by all intellectual property owners.
       
       The University will maintain and communicate guidance on approved AI tools and any applicable restrictions or conditions associated with their use.
        
2. Governance Structure:
   
   The University shall establish a structure of advisory committees to inform and support decision making regarding the procurement and use of AI tools and to support and not stifle innovation. These groups shall include members with expertise in the committee’s scope of responsibility to ensure that their actions are well informed.
   
   The University’s AI governance structure is intended to encourage responsible use and support innovation while managing institutional risk.
   
   Campus AI Committees: Each campus Chancellor (or designee) shall appoint a Campus AI committee(s) to implement this Policy on their campus and develop further campus-specific policy in this area. The Chancellor (or designee) shall appoint the members of the committee and shall include representation from  campus shared governance bodies. Campus governance groups shall provide 1-3 nominations for the chancellors to select from. The Chancellor shall designate a chair to provide coordination and leadership for this work. Directed by guidance from the Chancellor (or designee), the campus AI Committees should support coordination, responsible use and innovation, consistent with this Policy, campus practices and the Chancellor’s (or designee) guidance. Campus AI Committees shall not supersede the faculty responsibilities established in Regent Law 5.A.
   
   Faculty AI Committees: Consistent with shared governance principles, and Regent Law and Policy, including academic freedom, campus faculty shared governance bodies are responsible for establishing and maintaining faculty-led committees or processes to address campus level concerns in the academic and instructional use of AI tools, including guidance for teaching, learning, and research. Consistent with academic rights and responsibilities, individual faculty shall ensure that AI use aligns with academic standards, disciplinary norms, institutional practices, and pedagogical goals.
   
   Systemwide AI Committee:  The President shall appoint a Systemwide AI Committee to support coordination and oversight of AI use across the University. The President (or designee) shall appoint the members of the committee and designate a chair to convene the committee. The Systemwide AI Committee will include representation from each campus’s AI committee, representatives from each systemwide shared governance body, and other members as designated by the President. System-wide shared governance groups shall provide the President 1-3 nominations to select from.
   
   The Systemwide committee shall meet as needed and, will receive their charge from the President. At the President’s request, the committee may recommend updates to this Policy. Committee members are expected to serve as liaisons to their respective groups, and the chair will help ensure effective coordination and information flow across the University.
    
3. AI Risk Assessment: Before implementing or deploying any new AI tool for University Activities, all University units must ensure that appropriate review and approval processes are followed consistent with applicable University procedures and policies.
   
   AI tools being procured, deployed, integrated, or implemented for University use must undergo review, as defined by applicable System or Campus procedures and policies, when the tool will access, store, transmit, or otherwise process University data, significantly shape decisions affecting individuals, or integrate with University systems. Such review may include evaluation of:
    
   • Data privacy and data classification requirements
   • Information security controls and compliance with APS 6005
   • Data governance requirements under APS 6010
   • Accessibility requirements under applicable laws and University policy
   • Legal and contractual obligations
   • Potential risks related to bias, fairness, or unintended effects on individuals
   • Effects on existing content, data, technology and business processes
   • Fiscal and other resource requirements
      
4. Responsible Use of GenAI tools: GenAI, as a subset of AI, is governed by the scope and general requirements set forth earlier in this policy. Consistent with those provisions, the University of Colorado commits to a transparent and appropriate human-centered approach to GenAI. To that end:
    
   1. Disclosure of GenAI Involvement: Users must disclose their use of GenAI to an appropriate audience when such use contributes to University decisions or other high‑impact outputs created in an official University capacity, considering the context and potential impact. High-impact outputs generally include those that significantly affect individuals, communicate important institutional positions or decisions, or are distributed broadly to the University community or external audiences.
       
   2. Human Oversight and Accountability: The human oversight principles established in Section II apply to all uses of GenAI.  Because GenAI systems can generate inaccurate, biased, incomplete or fabricated content, individuals using GenAI are responsible for reviewing outputs for accuracy, appropriateness, and consistency with applicable University requirements before relying on or using them in University activities. 
       
   3. Use of GenAI tools in CU Coursework: In alignment with CU Regent Law 5.B (academic freedom), this policy does not dictate the use or non-use of AI tools in coursework. Schools, colleges, departments, or academic programs, through appropriate shared governance processes, may establish guidance regarding the use of GenAI in coursework or instructional activities within their academic units. Such guidance must be consistent with this APS and applicable campus policies and procedures.
       
   4. Use of GenAI tools in Research and Academic Works: Faculty shared governance bodies and professional academic organizations can develop best practices for risk management strategies regarding the use of GenAI tools in research and academic works.
       
   5. Use of GenAI tools in staff work: University staff may use GenAI tools to support administrative, operational, and service functions, provided such use complies with this policy, including II.D.1,2, and other applicable University policies and procedures regarding data privacy, information security, and records management.
       
   6. Supervisors and units may establish additional guidance for the appropriate use of GenAI in administrative functions, consistent with this policy and in coordination with campus and systemwide guidance where appropriate.
       
   7. GenAI depiction of real people: GenAI representations, or GenAI driven representations (images, 3D objects, video or voice) of real people must not be created or distributed without their explicit, informed consent, unless the use is intended to support academic freedom.
      
      These expectations also apply to university‑created, public‑facing content, including communications, marketing, and promotional materials, particularly where AI is used to generate or modify depictions of real individuals.
       
   8. Creation of sexualized content using GenAI: GenAI tools may not be used to intentionally create sexualized content (including images, 3D objects, video or audio) depicting real individuals. Under no circumstances may sexualized or suggestive depictions of minors be created, regardless of their relation (or lack thereof) to real people. 
       
   9. Users of GenAI tools must perform due diligence to ensure that outputs do not infringe copyright.
       
5. Violations: Policy violations may result in disciplinary action consistent with applicable University policies and procedures, including but not limited to employee discipline, student conduct processes, termination of access to University systems, and other administrative or legal remedies as appropriate.

1. APS 5065 - Protected Class Non-Discrimination.
2. APS 6005 - IT Security Program.
3. APS 6010 – Data Governance
4. APS 2027 – Code of Conduct
5. APS 2006 – Records Retention
6. APS 1013 - Intellectual Property Policy on Discoveries and Patents for Their Protection and Commercialization
7. APS 1014 - Intellectual Property That is Educational Material: Administrative and Instructional Use
8. Campus IT Acceptable Use Policies
   1. CU Boulder:  Acceptable Use of CU Boulder's IT Resources
   2. Anschutz | CU Denver:  Acceptable Use of Information Technology Resources
   3. UCCS:  Responsible Computing
9. Colorado Consumer Protection Act on Artificial Intelligence (C.R.S. 6-1-1701 - 6-1-1707)
10. Regent Law 5.A:  Faculty Governance
11. Regent Law 5.B:  Academic Freedom
12. Regent Policy 5.H:  Intellectual Property that is Educational Material
13. Regent Policy 5.I: Intellectual Property Related to Discoveries and Patents for Their Protection and Commercialization
14. Regent Policy 13.J: Artificial Intelligence Technologies

Review Cycle: This Policy will be reviewed on a periodic basis and more frequently as needed to address changes in technology, applicable law, and University practices.

• Adopted:  August 24, 2026
• Revised:  N/A
• Last Reviewed:  August 24, 2026

AI tool – a commercial or non-commercial technology that includes artificial intelligence-based capabilities. This includes tools that are open-source projects and tools developed by members of the CU community. These tools may be primarily focused on AI capabilities (like a Large Language Model chat tool) or may provide AI capabilities as an addition to the core capabilities (like a word processor with AI-based content feedback).

Generative AI (GenAI) is a subset of Artificial Intelligence (AI) that can generate text, images, code, music, or other forms of synthetic content based on patterns learned from training data.