XXXX | AI Governance Framework

Policy Manager: Vice President of Technology & Digital Strategy

This framework outlines CIA’s approach to governing the administrative use of artificial intelligence (AI) by College faculty and staff. Student use of AI is governed by policies and procedures in the CIA College Catalog, Student Handbook, and course syllabi.

Roles and Responsibilities

Data Governance Committee

The CIA Data Governance Committee (DGC) is the governing body overseeing artificial intelligence (AI) implementation across the College. The committee will have access to all documentation and decisions related to AI system and use case adoption as well as aggregate or de-identified data related to AI misuse or noncompliance. The convener of DGC is empowered to escalate any AI-related issue or question to CIA Cabinet (as the ultimate operational decision-making body for the College) before or after a decision would be made. The CIA Board of Directors maintains a level of oversight through the Audit and Risk Committee which will be informed of major decisions and updates as determined by the President + CEO.

DGC Executive Subcommittee

The DGC Executive Subcommittee (EXEC), composed of the DGC convener, chair, and vice chair, is the primary point of contact and reviewer of questions and issues related to the use of AI. EXEC is empowered to make decisions regarding the adoption of AI systems and use cases, but shall escalate for full DGC review and approval when restricted data are involved or policy and precedent cannot inform the decision.

Individual DGC Members

Each member of DGC is expected to serve as AI compliance officers for their respective department(s) and division(s). These responsibilities include communication of policies, procedures, and expectations related to the responsible and ethical use of AI; addressing minor questions as they arise, bringing concerns to Data Governance Committee, and informing EXEC of any situations where a colleague is believed to be misusing AI or otherwise violating AI policy.

Information Technology

CIA’s Information Technology (IT) department is responsible for implementing and maintaining CIA’s AI infrastructure as well as security and privacy protections. They shall consult on the review of new AI systems and use cases to ensure feasibility and compliance with law, regulations, and policy as it relates to data protection.

CIA Faculty and Staff

All CIA faculty and staff shall stay informed of and compliant with current policies, procedures, and expectations related to the responsible and ethical use of AI at the College. When a faculty or staff member believes a colleague to be misusing or otherwise violating AI policy, they are expected to notify their relevant DGC member or EXEC.

Policy Development

CIA’s predominant approach to policy development as it relates to AI is to consider and account for AI across existing policies and procedures as opposed to establishing a standalone AI policy. Impacted policies include but are not limited to the College’s Acceptable Use Policy, Online Services/Software Request Policy and Procedures, and Student Code of Conduct. Policy and procedure revisions will be managed in the same manner as other College policies and procedures.

Data Classification, Access, and Protection

The following list outlines how faculty and staff may submit third-party or College information to AI systems. Questions about the classification of any data or information can be submitted to EXEC.

• Public Data – CIA and third-party information for unrestricted public access, such as course catalogs, marketing materials, and event announcements can be used with AI provided compliance with copyright and licensing requirements.
• Internal CIA Data – Information meant for use within the campus community, such as policies, meeting minutes, and other non-sensitive materials can be used with AI systems designated by the College as having sufficient data protection for such use.
• Confidential Data – Information protected by College policy and/or regulatory (FERPA, HIPAA, etc.) requirements, such as academic, personnel, or financial records, to only be used for legitimate educational or business purposes can only be used after approval by DGC or EXEC for a specific use case and with support from IT to ensure proper protections are in place.
• Restricted Data – Highly sensitive information such as social security numbers, health records, and payment card data are not to be used in any circumstance unless approved by DGC and directly overseen by the VP of Technology + Digital Strategy or their designee.

Data Protection

Personally identifiable information and student records will be protected using encryption (in transit and at rest) and role-based access controls. AI generated content, logs, and metadata will follow the College’s Document Retention Policy.

AI System and Use Case Management Procedures

AI System or Use Case Prospectus and Proposal

Faculty or staff interested in deploying a new AI system or use case at the College submit a prospectus to EXEC summarizing the purpose and initial assessment of the benefits, risks, and other considerations related to the system or use case. At a minimum, the prospectus will include

• Contact information for the individual sponsoring the system or use case
• Purpose and rationale
• Process or system description
• Data, privacy, and intellectual property considerations
• Known costs
• Expected benefits and performance metrics
• Risk Assessment
• Plans to mitigate risks

EXEC will review the prospectus and determine whether to move forward to a full proposal, send back for revisions, or decline advancement of the prospectus. Upon advancement of the prospectus, EXEC and relevant IT personnel will collaborate with the sponsor on compiling full proposal, including

• Revisions and expansions of prospectus elements based on a more comprehensive understanding of the undertaking
• Technical architecture
• Deployment process and timeline
• Training
• Monitoring and reporting

After the full proposal is completed, EXEC will consider the proposal on the criteria of expected benefits, risk mitigation, and need for resources. EXEC can escalate to DGC for review, and EXEC or DGC may grant approval with or without conditions, deny approval, or defer a decision until more information or system improvements are available.

Approved AI use cases or systems are then forwarded to the appropriate venues for consideration (following the request policies and procedures outlined in the Acceptable Use Policy), including the capital request process when applicable. Approval of an AI use case or system does not guarantee implementation or deployment.

Risk Assessment

Prospectuses and proposals for AI use cases and systems are required to complete a risk assessment rubric considering the categories such as legal issues, operational issues, and reputational issues. These issues will be rated both on a scale of likelihood and of impact. Proposals found to be medium- or high-risk require sufficient mitigation plans such as pre-deployment testing, the requirement of human-in-the-loop review, protocols for flagging and reporting incidents, and specialized training. High-risk proposals also require plans for continuous oversight before approval will be granted.

Deployment

Pre-Deployment Review – confirmation of approval, documentation, and that data handling aligns with regulatory requirements and institutional policies; identification of users, roles, and responsibilities.

• Installation – establishment of the system, data connections and tools
• Training – system- or use case-specific training (and cross-training) for users as appropriate
• Testing and Validation Checks – to confirm functionality, security, and minimization of bias and harmful outputs
• Pilot Rollout – may be administered with a limited user group for feedback and monitoring before full implementation
• Launch – release of the use case or system for its intended purpose and users
• Maintenance – after deployment, maintenance will include vendor updates and patches using a staging environment for testing as available

Monitoring, Reviews, and Audits

AI systems will be monitored and reviewed by IT to ensure operational integrity and compliance. Regular reviews will include performance metrics such as uptime, latency, and error rates, as well as sampling outputs for accuracy, bias, and harmful content. Security monitoring will involve reviewing access logs, authentication events, and anomaly detection alerts, with automated notifications for threshold breaches. College tools and vendor-provided dashboards will inform these reviews as available.

EXEC or IT will conduct a more formal internal auditing process for each system and use case on at least an annual basis. These audits will consider the performance metrics, security monitoring, and other assessments of compliance, risks, incidents, meaningfulness, and effectiveness. A report of the audited information, with any recommended corrective actions will be provided to DGC and other relevant stakeholders upon the audit’s conclusion.

Decommissioning and Replacement

The decommissioning or replacement of an AI system or use case may be triggered due to contract expiration, failure to meet performance or compliance standards, or strategic decisions to migrate to a new platform, and will take place and be documented across the following phases:

• Notification of stakeholders
• Scheduling of sunset date
• Deletion of temporary data, outputs, and logs according to CIA’s Document Retention Policy
• Revocation of access credentials and API keys
• Certification of data destruction from vendors where applicable
• Review of lessons learned to improve future deployments

If transitioning to a new system, essential data and workflows will be migrated securely.

Documentation

All prospectuses, proposals, deployments, audits, corrective actions, decommissions, and replacements are documented in a centralized location by EXEC for review by DGC. Summary reports will be made available by EXEC to leadership, faculty, or staff upon request.

Compliance and Incident Reporting

CIA’s use of AI will comply with all applicable laws and regulations, including FERPA for student records, copyright and intellectual property laws, accessibility standards, relevant state or federal data protection statutes, and the College’s Acceptable Use Policy.

Communications and Training

Policies, procedures, updates, and resources related to AI use and governance will be published on myCIA and communicated to faculty and staff by their respective DGC member. Questions, concerns, and requests for clarification regarding AI-related issues are submitted via a form or ticket to EXEC for consideration and response or through a DGC member.

Training Requirements

All staff and division chairs are required to complete training on responsible, ethical, and compliant use of AI; faculty are encouraged to complete the training as well. The training will cover College AI policies, data classifications, privacy requirements, bias mitigation and intellectual property considerations. Additionally, the training will include where to access the registry of approved tools, security protocols, forms for questions or incident reporting, and other AI resources. Completion of training will be documented for access by IT, Human Resources, and DGC.

As significant policy or technology changes occur, faculty and staff will be notified of and asked to acknowledge the changes and their recommitment to linked College policies, procedures, and expectations related to AI.

Feedback and Continuous Improvement

Annually, DGC will review the College’s implementation of AI and consider revisions to this framework as well as College policies, procedures, practices, and resources. In addition to AI-related prospectuses, proposals, deployments, incidents, and other documentation will inform the review; additionally, DGC members will be asked to collect and bring feedback from their respective departments and divisions to ensure a more comprehensive understanding.

Approval Authority: Data Governance Committee

Adoption and Revision History