What everyone needs to know before using AI with university data 

Artificial intelligence tools are showing up everywhere—in our browsers, our inboxes, and our daily workflows. And while AI can be a genuine productivity boost, there’s a question every UT employee should be asking before they start typing: Is this information I should be putting into an AI?  

The Office of Innovative Technologies (OIT) has a clear, simple answer. Never enter personal or student information into an AI tool. That means any data protected under FERPA—student names, grades, ID numbers, enrollment status, academic records, or any other personally identifiable education records—stays out of AI, full stop. A single accidental paste into a chatbot can constitute a FERPA violation, with real consequences for students, staff, and the university. Once data is submitted, there is no undo. 

To help employees navigate the use of AI based on data types, the OIT has published an AI Guidance Matrix to help eliminate some of the guesswork. It maps out exactly which types of data can—and cannot—be used with different categories of AI tools, covering seven data classifications: Public, Internal to UT, Private, FERPA, PII, PHI/HIPAA, and CUI.  

In practice, free and public AI tools like ChatGPT Free, Gemini Free, and mobile AI apps are approved for publicly available data only—FERPA-protected student information is explicitly off-limits. UT-managed platforms like UT Verse and the UT AI Hub offer more flexibility, but even these require a formal UT agreement covering security, privacy, and data handling before sensitive data can be used. Limited does not mean permitted without review. Locally installed, offline models may technically accommodate higher data classifications, but still require a conversation with your local IT department before use. 

FERPA exists to protect students’ educational records and their privacy rights. Free, consumer-facing AI tools may use your data to train future models and often cannot meet the data security requirements set by federal law. This isn’t about slowing down your work—it’s about protecting the students who trust this university with their information. When in doubt, leave it out.  

For questions about appropriate AI use, consult the UTK OIT AI Guidance Matrix or reach out via the OIT HelpDesk.  

Protecting student privacy is everyone’s responsibility.