Generative AI and data governance

Artificial Intelligence (AI) is a rapidly evolving concept, with new capabilities and uses emerging every day. AI presents vast opportunities for the University across research, teaching and business process improvement. However, robust governance and legislative compliance is key to ensuring that the University maintains high levels of confidence and trust with key stakeholders, allowing us to deliver our mandate as Australia’s national university.

As the University introduces AI into its processes and information handling practices, staff should ensure they align with key AI data governance principles, aimed at maintaining the trust and confidence of the University community.

Principles

  1. Use of AI and its outputs must be consistent with ANU policies and procedures, including the ANU student and staff Codes of Conduct.
  2. Do not use AI to collect, use, store and/or disclose personal information, without the express consent of the individual(s).
  3. Only utilise AI solution/software approved for use by the University, to ensure appropriate data governance, information security and licencing. Wherever possible, an existing solution should be utilised to maximise University resources and minimise duplication of expenditure and system support.
  4. AI outputs that are classified as University records must be stored in the University’s Electronic Records Management System (ERMS).
  5. The use of AI should align with the good practice guidelines provided by TEQSA.
  6. Staff and students should be transparent about when and how AI has been used to create outputs.

Generative AI FAQs 

Can I upload personal information to AI software?

Staff must not upload personal information to AI software without consent from the individual(s). If a project or process will be handling personal information, a Privacy Impact Assessment may be required. As governance of AI is evolving rapidly, at this time, it is recommended that advice should be sought from the ANU Privacy Office, for any use of AI involving personal information.

Can student assignments be uploaded to AI software?

Students retain Intellectual Property ownership of their assignments, even when they have been submitted for assessment. Therefore, staff are not permitted to upload student work to an AI platform without their express consent. Staff looking to incorporate AI in their teaching and learning are encouraged to contact CLT.

Can I upload University corporate data to AI software?

Even where data is de-identified, it remains a University asset. New uses of ANU data should be approved by the relevant data custodian, to ensure the use of the data is appropriate and that risks are adequately managed. The data custodian will depend on the type of data, but will typically be the Director/head of the local area that is responsible for the data.

I really need to use AI for my project. Can I just purchase my own software or use a free web-based tool?

All technical solutions being used for University business and/or on ANU managed devices must be approved by the University. This is to ensure appropriate data governance, information security and licencing. Freeware poses particular risks of inadequate information security controls and unapproved software puts the ANU network at risk. Staff must comply with the Acceptable use of information technology policy. Requests for AI software may be made to the ANU ServiceDesk.

Can I use AI to write or edit my emails or business documents?

It is important to ensure that you are not sharing any personal or corporate information with AI software, without the appropriate consents and approvals. Take care when asking AI to write or edit for University business and remember that AI has limitations. ANU staff should primarily be producing outputs required for University business. It is important for the University to be transparent about the way it makes and documents decisions. Remember that access to University documents can be requested under the Freedom of Information Act.

When would AI outputs be a University record?

University records provide evidence of the business activities and processes you undertake on behalf of the University. Records can be in many formats and may include outputs from AI. Examples of records include policies/processes, business unit planning documents, committee agenda and minutes, internal/external advice and reports, research reports and data, authorisations and approvals, interactions between staff and students, legal agreements and contracts, documentation of a University project and individual notes that inform high level decision making. 

Where AI outputs meet the definition of a University record, they must be stored in the ERMS. For assistance with determining record keeping requirements, contact University Records.

Key Contacts 

Policies

Related links

Contact