Acceptable Use Standard for Generative AI Applications at TSTC

1. Purpose 

The purpose of the Texas State Technical College (TSTC) Generative Artificial Intelligence (Gen AI) standard is to ensure the legal and ethical use of GenAI technology.  The guidance below defines acceptable and prohibited uses and outlines employee obligations related to using or developing GenAI models and applications. 

2. Scope

This standard applies to all TSTC information resource (IR) users of GenAI applications or the development of GenAI models, including internal models, third-party models, or publicly available applications such as ChatGPT, Google Gemini, etc.  It also applies to the use of those applications on TSTC devices and/or personal devices when used for work purposes.

3. Key Context 

3.1 Generative AI (GenAI) is an artificial intelligence technology that synthesizes new versions of text, audio, or visual imagery from large bodies of data in response to user prompts. GenAI models can be used in stand-alone applications, such as ChatGPT or Gemini, or incorporated into other applications, such as internet search engines or word processing applications. If you have any questions about what constitutes GenAI, please contact oitsecurityandcompliance@tstc.edu.

3.2 Privacy, Security, and Confidentiality: Information is shared with a GenAI tool by user prompts or a series of instructions or questions for the tool. Generally, providing access to information constitutes sharing data with the tool. The sharing of data potentially makes confidential or sensitive information public as the tool may train its model on the data shared. In some cases, data that has been anonymized could be linked to personal information and become exposed. Any student’s or employee’s personal information, proprietary information or intellectual property, or otherwise confidential information entered into the prompt may appear in other users’ output. Therefore, users of GenAI should avoid entering any information into a GenAI tool that they do not want to be made public or is otherwise restricted by law or standards. 

3.3 Verification of Generative AI Output:   Outputs created by GenAI tools may provide fictitious answers; these are sometimes referred to as hallucinations. Furthermore, many open-source GenAI models are often trained on large, publicly available datasets (e.g., through data extraction of public web pages). 

The outputs may therefore contain copyrighted information or others’ intellectual property. While ownership in many of these cases is unclear, users should err on the side of caution and not use any output that contains material they suspect to be under copyright protection in any materials, internal or external facing.

Verifying the information generated by GenAI tools is important to ensure accuracy. While some tools may provide citations, double-checking the information with reliable sources is always a good practice. When using GenAI outputs at TSTC, we clearly disclose that the content was generated by AI to promote transparency.

Users of GenAI tools must also be aware that they incorporate any biases of the data sets that were used to train them. This modeling bias may not always align with TSTC’s core values of Excellence, Accountability, Service, and  Integrity and our commitment to diversity, equity, and inclusion. Therefore, model output may make systematic errors or favor certain groups, leading to unfair or discriminatory outcomes. Users of GenAI must adhere to review processes where GenAI is used to make decisions or provide analysis of information that may be subject to bias. 

Using output from GenAI tools without reviewing it for accuracy places TSTC at risk and may harm TSTC’s reputation with customers and employees. 

3.4 Transparency: Consistent with our code of conduct and other standards, we aim to provide our employees, third parties, and customers with transparency regarding how we use GenAI to support our work. All content generated using GenAI must be clearly identified on any outward-facing content.

3.5 Third-party risk: Data sent by TSTC to third parties could be used in the third party’s use of GenAI tools. Uses include but are not limited to, training new GenAI models, providing updated information for existing GenAI models, and improving the user experience. Sensitive information input into unapproved GenAI applications may appear as output for individuals outside of TSTC. Not using GenAI per this standard may violate TSTC’s contractual obligations with employees, students, and vendors or violate applicable laws and regulations. 

4. Acceptable Use 

Any use of GenAI via platforms, tools, and software must be consistent with the TSTC code of conduct, TSTC standards, and applicable law. Use of GenAI on TSTC devices must be limited to business purposes. Using GenAI tools on personal devices or personal accounts to conduct TSTC business is prohibited. Using GenAI tools on personal devices to circumvent TSTC policies or safeguards is strictly prohibited. 

Any violation of this standard or use cases out of the scope of the table below, will result in disciplinary action as outlined in SOS HR 2.4.1 - Employee Corrective Action.

This table is not inclusive of all possible use cases and if a use case is not specifically listed, a user should ask before proceeding. We reserve the right to make changes to, or update this table periodically:

Accepted Use

Not Permitted Use 

The following use cases are permitted: 

  • Translating text from a secondary, publicly available source

  • Conducting high-level background research into a non-sensitive topic

  • Brainstorming ideas for icebreakers at an offsite

  • Do treat the application as you would an employee of another company with whom we have no formal relationship and cite your sources. 

  • When in doubt about what is acceptable regarding the use of GenAI, please reach out to your manager, OIT, Data and Analytics, or legal as appropriate. 

  • Review the TSTC SOS’s relating to data classification and handling, intellectual property, student records, and privacy.

  • Do clearly attribute any output used for work purposes to the GenAI application that created it through a footnote or other means visible to the reader.

  • Do maintain an updated record GenAI use for work purposes and be able to share those records with your manager or other authorized TSTC personnel upon request.

  • Do review output of GenAI applications to make sure it meets TSTC’s standards for principles of equity, ethics, and appropriateness.

The following use cases are NOT permitted: 

  • Using GenAI and not disclosing the use on publicly facing sites 

  • Do not install non-approved Application Programming Interfaces (APIs), plug-ins, connectors, or software related to GenAI systems without prior approval from the IT oversight and governance committee, and/or the data governance committee.

  • Do not implement or use in any way code generated by GenAI on TSTC systems.

  • Do not input TSTC or someone else’s intellectual property into generative AI applications.

  • Do not upload any copyrighted material to GenAI platforms. This includes, but is not limited to, original works of authorship including literary, dramatic, musical, and artistic works, such as poetry, novels, movies, songs, computer software, and architecture.

  • Do not enter Personally Identifiable Information (PII), Sensitive Personal Information (SPI), Personal Financial Information (PFI), Private Health Information (PHI or HIPAA),Family Educational Rights and Privacy Act (FERPA) of employees, students, customers, or other third parties into any GenAI application.

  • Do not use any output that discriminates against individuals on the basis of race, color, religion, sex, national origin, age, disability, marital status, political affiliation or sexual orientation.

  •  Do not use GenAI applications to create text, audio, or visual content for purposes of committing fraud or to misrepresent an individual’s identity.

All Other Use 

  • -All other AI platforms require pre-authorized approval prior to creating an account and utilizing the tool. 

  • -To request approval, please submit a ticket to TSTC’s Help Desk and you will be notified of the application’s approval status as it goes through the IT Compliance software review process. 

Acceptable tools and applications:

  • Please refer to the Reviewed Vendors / Services Master Sheet for more information. Column K will designate if the application is an AI tool/application. 
  • All other AI platforms require pre-authorized approval prior to creating an account and utilizing the tool. 
 
 

5.  Guidelines 

For any use of GenAI applications, employees must adhere to the following: 

5.1 To maintain the security of our data and IT systems, employees are prohibited from attempting to gain access to unapproved GenAI applications when using TSTC systems or networks, conducting business on behalf of TSTC, or using TSTC’s data. To avoid potential data leaks or security incidents:

  • Do not install non-approved Application Programming Interfaces (APIs), plug-ins, connectors, or software related to GenAI systems without prior approval from the IT oversight and governance committee and/or the data governance committee.

  • Do not implement or use in any way code generated by GenAI on TSTC systems.

5.2 To maintain the confidentiality of TSTC’s sensitive information, including but not limited to employee, student, and vendor’s personal information, intellectual property, and copyrighted material, employees, students, vendors, contractors, and consultants must only share information with approved personnel and only input sensitive information into approved GenAI systems. To maintain confidentiality:

  • Do not input TSTC intellectual property into non-approved generative AI applications.

  • Do not enter Personally Identifiable Information (PII), Sensitive Personal Information (SPI), Personal Financial Information (PFI), Private Health Information (PHI or HIPAA), Family Educational Rights and Privacy Act (FERPA of employees, students, customers, or other third parties into any non-approved GenAI application. Treat the application as you would an employee of another company with whom we have no formal relationship.

  • Do not upload any copyrighted material to GenAI platforms. This includes, but is not limited to, original works of authorship, including literary, dramatic, musical, and artistic works, such as poetry, novels, movies, songs, computer software, and architecture.

  • Do contact your manager, or email legal@tstc.edu  and itsecurityandcompliance@tstc.edu  if you are unsure whether information you are planning to input falls into any of the above categories.

  • Do review TSTC’s data handling standards.  SOS GA 5.1.6 - Data Classification and Handling Standard. 

  • Do review TSTC’s Intellectual Property standards.  SOS ES 1.01 - Intellectual Property  

  • Do review TSTC’s Student Record standards.  SOS GA 1.5.2 - Student Records (FERPA)

  • For more information on Generative AI, review the TSTC Generative AI Guidelines

5.3 To maintain transparency with customers and employees and protect TSTC from claims against copyright infringement and/or theft of intellectual property, all GenAI-generated content must be cited and reviewed if used for work purposes. To protect TSTC:

  • Do clearly attribute any output used for work purposes to the GenAI application that created it through a footnote or other means visible to the reader.

  • Do maintain an updated record of GenAI use for work purposes and be able to share those records with your manager or other authorized TSTC personnel upon request.

5.4 To protect our employees and clients from harm and to protect TSTC from reputational damage, employees must use GenAI pursuant to TSTC’s business code of conduct and non-discrimination policies. GenAI-created content that is inappropriate, discriminatory or otherwise harmful to our employees or clients/customers must not be used for work purposes. Such use may result in disciplinary action as outlined in SOS HR 2.4.1 - Employee Corrective Action.

  • Review the output of GenAI applications to make sure they meet TSTC’s standards for principles of equity, ethics, and appropriateness.

  • Do not use any output that discriminates against individuals on the basis of race, color, religion, sex, national origin, age, disability, marital status, political affiliation, or sexual orientation.

  • Do not use GenAI applications to create text, audio, or visual content to commit fraud or misrepresent an individual’s identity.

5.5 All employees and contractors are expected to comply with applicable laws, regulations, or TSTC policies regarding the use or development of GenAI content or tools.

5.6 All employees are expected to report instances of fraud, waste, and abuse with this standard to the TSTC Ethical Advocate program or through the State Auditor’s Office through the Report Fraud, Waste, and Abuse site on the tstc.edu homepage footer or call the State Auditor’s hotline at 1-800-TX-AUDIT. Employees are encouraged to speak up when they witness misconduct. Employees who report misconduct or concerns in good faith will not be retaliated against and will remain anonymous.  For more information, see the related documents section below. 

6. Monitoring 

TSTC reserves the right to access and monitor the use of GenAI applications on any TSTC-issued devices or that appear on TSTC-managed networks to ensure compliant use of these systems. 

7. Failure to Comply

Users who fail to comply with any provision of this Standard may be subject to disciplinary action as outlined in SOS HR 2.4.1 - Employee Corrective Action. Violations by contractors may be considered breach of contract and result in removal from assignment or termination of contract. Any GenAI-related activities which appear to violate applicable laws will be reported to external law enforcement.

If monitoring systems and processes detect a possible standard violation or if a User reports a possible standard violation, the suspect event should be processed using appropriate security incident response processes (see the Cybersecurity Incident Response Policy).

8. Related Documents

9.  Contact Information

Print Article