By: Jeremy Blackburn, CPA, CVA, MAFF
Artificial intelligence (AI) is actively operating across your campus right now. No longer a futuristic concept waiting on the horizon for higher education, it is transforming how colleges and universities operate. AI now touches everything from faculty developing adaptive learning modules and students utilizing generative AI for research, to finance departments automating data entry and IT teams writing code.
AI adoption is rapidly gaining attention across higher education. According to a 2026 National Association of College and University Business Officers (NACUBO) program presenting survey findings on AI in student accounts, most departments remain in the early stages of adoption, while leadership attention is growing and conversations about AI are becoming more common. AI adoption is increasing at an unprecedented rate across all industries, driven by a need to improve administrative efficiency, combat staff burnout, and deliver modern student experiences. The question for higher education leaders isn’t, “Should we allow AI?” It is already there, so proactive leaders are asking the more relevant question: “How can we harness AI responsibly while safeguarding our institution’s data, reputation and stakeholders?” As one component in an overall AI Governance Program, a well-crafted AI Acceptable Use Policy can help provide necessary guardrails without stifling academic or operational innovation.
Human in the Lead
“Human in the Lead” (HITL) is one of the most critical concepts of a responsible AI policy framework. AI is designed to assist and augment human employees, not to replace professional judgment, critical thinking, or institutional accountability. It is important to keep that fact top of mind when creating an AI Acceptable Use policy, because AI-generated information isn’t always correct; it may be incomplete, outdated, entirely inaccurate (AI “hallucinations”) or based on inherently flawed assumptions. Because of that lack of reliability, human review should be proportionate to the risk and impact of the AI use case.
For example, imagine a university finance department tasked with accounting for complex lease agreements or Subscription-Based Information Technology Arrangements (SBITAs). The finance team might deploy an institutional approved AI tool to ingest and summarize lengthy legal agreements, rapidly identify key contractual terms, flag payment provisions and assist with preliminary net present value calculations and amortization schedules.
This approach could yield significant savings in staff hours and attention, especially when there are dozens or hundreds of agreements to review before the end of the fiscal year. At the same time, the level of human review should be proportional to the risk and significance of the AI use case, with higher-risk or more complex arrangements warranting greater scrutiny and validation.
AI models can easily misinterpret legal jargon, hallucinate a discount rate or miss a deeply buried contract amendment, so HITL remains critical. A qualified finance professional still must read the underlying agreement, verify that no critical clauses were overlooked, independently validate the inputs of the amortization schedule and determine the appropriate final accounting treatment.
AI cannot replace the accountant in this scenario. It can, however, be a powerful tool that significantly reduces the time and effort involved in routine data extraction, freeing up valuable time for high-level analytical review and professional judgment.
Get Detailed
An AI Acceptable Use Policy should not operate in isolation. It is most effective when supported by a broader governance framework that identifies where AI is being used, evaluates the risks associated with those uses and establishes clear accountability when issues arise. As you draft your policy, try to move beyond generic statements and offer specific guidance to address real-world issues like:
Approved versus prohibited platforms: Clearly define which internal, institutional approved AI tools are sanctioned for campus use versus unapproved AI tools or services, which may pose data-sharing risks.
AI inventory and use-case tracking: Maintain a centralized inventory of approved AI tools and significant AI use cases across the institution. Consider documenting the business or academic purpose, responsible department, types of data involved, key system integrations and designated owner. An effective inventory can help leadership understand where AI is being used across campus and provide a foundation for ongoing risk assessment and governance.
Training and awareness: Establish appropriate AI training for faculty, staff and other authorized users, including instruction on approved tools, data protection, output validation, incident reporting and role-specific responsibilities. Training should be appropriate to the individual’s responsibilities and the nature of their AI use.
Risk classification: Not every AI use presents the same level of risk. Consider establishing a risk-based classification framework that evaluates AI uses based on factors such as the sensitivity of the data involved, the significance of decisions being supported, potential impact on students or employees and applicable regulatory or compliance requirements. Higher risk uses should be subject to greater levels of review, approval, testing, documentation and ongoing monitoring. For example, using AI to brainstorm ideas for an internal presentation generally presents a very different risk profile than using AI to support decisions involving admissions, financial aid, student conduct, employment or other consequential matters.
Data protection: Require and detail how to follow strict protocols for handling student, employee, financial and other proprietary or confidential institutional data.
Regulatory compliance: Provide explicit guidance on FERPA, GLBA and other applicable requirements to help staff and students avoid inadvertently entering protected information into AI systems in an unauthorized manner.
Academic integrity: Articulate clear expectations for both students and faculty regarding how they can use AI ethically in coursework, research and grading.
Accessibility: Consider whether AI tools and AI-generated content meet applicable accessibility requirements and institutional standards and whether their use could create barriers for students, employees or others who rely on assistive technologies.
Intellectual property: Establish expectations for submitting copyrighted, proprietary or institution-owned materials to AI platforms, as well as the ownership, attribution, disclosure and appropriate use of AI-generated content.
Records retention: Address whether AI prompts, responses, summaries and other AI-generated materials constitute institutional records and how those materials should be retained, stored and disposed of under the institution’s existing records-retention requirements.
Bias and fairness: Recognize that AI outputs may contain inaccuracies or reflect unintended bias. Require appropriate review when AI is used to support decisions affecting students, employees or other stakeholders, particularly in areas such as admissions, financial aid, academic evaluation, student conduct and employment.
Mandatory human review: Incorporate a firm requirement that material AI-generated work undergo human validation before external publication or internal execution, with the level of review proportionate to the significance and risk of AI use.
Transparency and documentation: Offer guidelines on when and how to cite or disclose the use of AI in institutional reports, communications and academic publishing.
Vendor and cybersecurity risks: Include a framework for assessing third-party vendors and AI-enabled features, including data security, privacy, contractual obligations, system access, data retention, the vendor’s use of institutional information and appropriate ongoing monitoring.
Incident reporting: Establish a clear process for reporting suspected AI-related incidents, including inappropriate disclosure of sensitive information, unauthorized AI use, materially inaccurate or harmful outputs, cybersecurity concerns or other violations of institutional policy. Employees and other users should know where and how to report concerns, and significant incidents should be evaluated through the institution’s existing information security, privacy, compliance or risk-management processes, as appropriate.
Accountability: Establish who ultimately owns the outcomes of decisions that are partially or fully informed by AI and make clear that the use of AI does not replace existing responsibilities for professional judgment, approval, documentation or institutional accountability.
Keep Up With Rapid AI Change
The AI landscape is evolving at a breakneck pace. With new models, features, and capabilities launching almost weekly, static policies you draft today may become obsolete tomorrow. To combat this, it is a good idea to establish an agile AI governance committee. It is most effective when the committee has cross-functional representation from academic affairs, information technology, finance, human resources and legal/compliance teams in addition to IT experts.
Having key, qualified employees serving on this AI team is essential. These subject-matter experts are crucial for guiding proper AI usage, evaluating emerging risks and dynamically updating institutional policies as new technologies enter the campus ecosystem. The committee can also provide oversight of the institution’s AI inventory, establish a consistent approach for classifying AI use cases by risk, monitor higher-risk applications and help ensure that significant AI-related incidents are appropriately reported and addressed. Like any automated tool, AI is only as safe and effective as the qualified people managing it.
Trust the Education Experts
Ultimately, AI makes a great assistant for your institution, but it cannot and should not replace human judgment, institutional accountability, robust data protection or appropriate internal controls. At Mauldin & Jenkins, we encourage colleges and universities to elevate this discussion and make AI governance a core, ongoing part of your broader conversations concerning risk management, cybersecurity, internal controls and institutional governance. We are here for you, whether you have questions, need help crafting an AI Acceptable Use policy that fits your organization or just want to make sure you’re getting the most value from your AI engagement.
