SUNY Adopts Systemwide Artificial Intelligence Policy
SUNY’s systemwide AI policy, approved in May, gives the university’s 64 campuses until Dec. 31, 2026— with a possible two‑month extension— to draft or revise guidelines that cover bias assessment, student data privacy, and responsible AI use.
Key requirements for campus IT leaders
At a minimum, each institution must define the roles and responsibilities of faculty, staff, and students who interact with AI tools. Training programs are required to teach safe and responsible use, and procurement processes must include safeguards that protect SUNY data and prevent biased outcomes. The policy also calls for separate oversight mechanisms for teaching, research, and administrative applications, with higher‑risk systems subject to more frequent review.
“One of our major concerns is making sure that SUNY data — including students’ personal information and academic records — is protected,” SUNY chief information security officer Jesse Sloman told EdTech when the policy was announced. “We don’t want a SUNY student using a SUNY AI tool and have that data used to train external models outside of narrow, contractually defined terms.”
How procurement and bias evaluation will change
Without a robust governance framework, AI tools can spread across campus faster than oversight can keep pace. Gartner notes that AI governance remains in development and that evaluating tools often involves “complexity, ambiguity and rapid technology evolution.” To address this, universities are urged to move beyond vendor promises and conduct detailed risk assessments as part of every AI purchase.
Related: Ventana College Builds AI Readiness Through Teacher Groups
In practice, that means documenting how a vendor protects user data, whether uploaded information will be used to train future models, and how data is anonymized. The EDUCAUSE recommendations call for regular audits of AI algorithms and data sets, testing with diverse inputs to uncover discriminatory outcomes, and training models on representative data to comply with antidiscrimination laws.
These steps are not purely technical; they also require coordination across legal, compliance, and academic units. Institutions may share risk‑assessment findings with peer campuses, creating a collective knowledge base that speeds up safe adoption.
Compliance is essential.
From a broader perspective, the push for AI governance reflects a growing recognition that data stewardship is central to institutional trust. As campuses digitize more of their operations, the line between routine IT management and strategic policy oversight blurs, making it essential for leaders to embed AI considerations into existing procurement and security frameworks rather than treating them as an afterthought.
Related: Engagement Rings: Are You Getting More Than You Bargained For? (The Ethical Truth)
Protecting vast amounts of sensitive information—academic records, financial aid details, payroll, and donor data—means campuses may need to upgrade identity, access, and monitoring systems. During vendor negotiations, institutions can require proof of data‑handling practices, ensuring that AI tools do not expose student information to unauthorized parties.
Next steps for SUNY IT departments
Campus leaders are encouraged to align AI governance with existing IT policies rather than drafting entirely new documents. “We don’t want campuses to re‑create all of their existing policies in a separate AI document,” Sloman said. “Instead, they should think about how AI fits into their existing policy frameworks and update those where necessary — or develop a standalone policy if needed.”
Practically, this means reviewing current procurement guidelines, data‑privacy rules, and security controls to identify where AI‑specific clauses belong. Cybersecurity teams will need to provide the same assurances they have always offered, now extended to the fast‑moving field of AI applications.
According to a recent study, fewer than 40 % of higher‑education institutions have formal AI‑use policies. SUNY’s deadline therefore serves as a benchmark that may influence public university systems nationwide, signaling that robust AI governance is no longer optional.
