AI Acceptable Use Policy

1. Purpose and Scope

1.1 Purpose

This AI Acceptable Use Policy establishes guidelines for the acceptable use of artificial intelligence technologies by University of Oklahoma Foundation, Inc. ("Foundation") employees and any other entities with access to Foundation systems or data (each an “AI User” and collectively the “AI Users”).

1.2 Scope

This policy applies to all AI technologies, tools, and systems that are currently or may in the future become available for use by the AI Users (each an “AI Tool” and collectively the “AI Tools”), as well as any and all potential use(s) of any AI Tool by any AI User in connection with work performed for the benefit of the Foundation.

1.3 Approval Process

All new AI tool implementations require approval through the AI Governance and Review Committee before deployment. High-risk AI applications, including those processing sensitive donor data or making automated decisions affecting donor relationships, require additional approval from the President and Chief Executive Officer or Vice President and Chief Operating Officer. All AI tools and software must follow the OUF AI Tool Criteria Standard and any exceptions to the Standard must be approved and documented by the AI Governance and Review Committee, and or the President and Chief Executive Officer, depending on the level of risk the exception introduces.

2. Acceptable Use Guidelines

2.1 Permitted AI Applications

Advancement, Prospect Research and Donor Relations: AI Users performing work for the Foundation’s departments of Advancement, Prospect Research, and/or Donor Relations may use AI Tools to personalize donor communications, analyze giving patterns, identify cultivation opportunities, and enhance stewardship activities, provided all AI generated outputs such as lists, verbiage, gathered information and data analysis are reviewed by qualified staff as determined by Senior Leadership. Additionally, AI Users performing work for the Foundation’s departments of Advancement, Prospect Research, and/or Donor Relations may use AI Tools in connection with prospect identification and capacity analysis so long as all data inputted into any AI Tool for such purposes is publicly available or otherwise lawfully obtained with the exception of AI Governance Policy and Review Committee pre-approved AI software that is configured to keep all data confidential and within the Foundation’s governance.

All departments: The Foundation may use approved AI Tools to support legitimate business, administrative, operational, analytical, technical, and communications activities when such use enhances organizational effectiveness, efficiency, or quality.

AI Tools may be used to assist with activities such as developing and reviewing content, analyzing and summarizing information, supporting research and decision-making, improving business processes, automating routine tasks, assisting with technical and operational activities, and supporting other appropriate organizational functions.

Use of AI Tools must comply with applicable Foundation policies and procedures, including requirements related to privacy, confidentiality, information security, records management, intellectual property, and data protection. Users are responsible for exercising appropriate judgment and ensuring that AI use does not compromise the accuracy, security, integrity, or confidentiality of Foundation information.

2.2 Prohibited AI Uses

Autonomous Decision Making: AI Users may not use AI Tools to make final decisions without human review and approval. Critical decisions affecting the Foundation's mission, legal obligations, or stakeholder relationships must retain human oversight and accountability.

Sensitive Data Processing Without Safeguards: AI Users may not use AI Tools to process donor social security numbers, bank account information, credit card details, health information, or other sensitive personal data without appropriate encryption, access controls, and vendor security assessments as defined by OU Foundation IT and the AI Governance and Review Committee and in accordance with the Information Classification Definitions document. The Foundation maintains an internal instance of an AI platform for use with Foundation data. Additional AI platforms may be utilized upon review and approval by the AI Governance and Review Committee in advance of use. Free public AI platforms may not be used for processing confidential donor information or proprietary Foundation data. Refer to the current OUF AI Tool Criteria Standard for details.

Misrepresentation and Deception: AI Users may not use AI Tools to create false or misleading communications, impersonate real individuals, generate fake testimonials or endorsements, or create deceptive content. All AI-generated content must maintain truthfulness and transparency standards.

Discriminatory Applications: AI Users may not use AI Tools in a manner that results in unlawful discrimination, bias, or unfair treatment. All AI use must comply with the Foundation’s Code of Ethics and Standard of Conduct and applicable legal and regulatory requirements.

3. Data Protection and Privacy

3.1 Donor Privacy Protection

All AI applications processing donor data must comply with applicable privacy laws, Foundation privacy policies, and donor confidentiality commitments.

Personal donor information may only be used in AI systems when necessary for legitimate Foundation purposes and with appropriate security safeguards. Data minimization principles must be applied, using only the minimum amount of personal information necessary to achieve the intended purpose. AI vendors must agree in writing to meet the Foundation’s standards and appropriate data processing agreements.

3.2 Data Security Requirements

AI systems must implement appropriate technical and organizational security measures to protect Foundation data from unauthorized access, alteration, or disclosure. This includes encryption of data in transit and at rest, access controls limiting data access to authorized personnel, follow least privilege principles, multi-factor authentication (where applicable) and regular security assessments of AI tools and platforms.

All AI-related data breaches or security incidents must be reported immediately to the appointed AI Governance and Review Committee and addressed according to Foundation incident response procedures. Vendor-provided AI services must undergo security assessments before implementation and be subject to ongoing monitoring for compliance with Foundation security standards. Any significant changes or modifications to vendor-provided AI services must be brought to the AI Governance and Review Committee for review and approval before use.

3.3 Data Retention and Disposal

AI-generated outputs and associated data must be retained according to Foundation records retention standards and applicable legal requirements. When AI processing is no longer needed, associated personal data must be securely deleted or anonymized according to established procedures. Third-party AI vendors must provide guarantees about data deletion upon contract termination.

4. Quality Assurance and Accuracy

4.1 Human Oversight Requirements

AI outputs that materially affect donor relationships, financial decisions, or significant external communications must be reviewed and approved by designated personnel with appropriate subject matter expertise before use. Personnel responsible for AI oversight must receive training on the capabilities, limitations, and risks of the AI tools they oversee. High-risk or critical AI applications must include human reviewers with authority to validate, modify, or reject AI-generated outputs or recommendations. Users remain responsible for all work product created with AI assistance.

4.2 Accuracy Standards

AI-generated information must be verified for accuracy through appropriate validation procedures. Known limitations of AI tools must be communicated to users, and staff must be trained to recognize potential errors or biases in AI outputs. Regular testing and calibration of AI systems must be conducted to maintain accuracy standards.

4.3 Error Reporting and Correction

All AI-related errors that affect donors, financial operations, or external stakeholders must be promptly reported to the employee’s supervisor or V.P, whichever is appropriate. Error correction procedures must include notification of materially affected parties and include the implementation of preventive measures. Incidents are classified by severity; resolutions are documented; post-incident reviews are mandatory for significant events. Patterns of AI errors must be analyzed to identify systemic issues requiring policy or system modifications.

5. Vendor Management and Third-Party AI

5.1 Vendor Selection Criteria

Third-party AI vendors must demonstrate compliance with Foundation security and privacy standards through comprehensive due diligence processes. Vendor assessments must include evaluation of data handling practices, security measures, bias testing procedures, and transparency in AI system operations. Contracts with AI vendors must include specific requirements for data protection, service levels, and compliance with Foundation policies and be reviewed and approved by the Chief Operating Officer or Senior Assistant Vice President/Chief Information Officer.

5.2 Ongoing Vendor Oversight

AI vendor performance must be periodically reviewed through service level assessments, security reviews, and compliance audits. Vendors must be capable of providing regular reports on system performance, security incidents, and any changes to AI algorithms or data processing practices. Contract terms must include rights to audit vendor practices and terminate agreements for non-compliance with Foundation requirements. Vendor offering(s) must meet the criteria in the AI Tool Criteria Standard.

5.3 Vendor Incident Management

AI vendor contracts must include a provision that requires the vendor to promptly notify the Foundation of any security incidents, data breaches, system failures, or other issues affecting Foundation data or operations. Vendors contracts must require that vendors cooperate with Foundation incident response procedures and provide necessary support for incident resolution. Vendor contracts must include liability provisions for damages resulting from vendor negligence or non-compliance.

6. Training and Awareness

6.1 Mandatory Training Requirements

All Foundation personnel who use AI tools must complete mandatory training on this policy, AI capabilities and limitations, and appropriate use procedures before gaining access to AI systems. Training must be updated annually and whenever significant policy changes are implemented. Specialized training must be provided for personnel with elevated AI responsibilities or access to sensitive AI applications.

6.2 Ongoing Education

The Foundation will provide regular updates on AI best practices, emerging risks, and policy changes through newsletters, workshops, and training sessions. Staff are encouraged to participate in external AI training opportunities and share knowledge with colleagues through internal knowledge-sharing initiatives. All vendor contracts must include a provision that requires vendors to provide appropriate training and support for their AI tools and systems.

6.3 Competency Assessment

Personnel with significant AI responsibilities must demonstrate competency through periodic assessments that evaluate understanding of AI capabilities, limitations, policy requirements, and appropriate use procedures. Remedial training must be provided when competency gaps are identified. Access to advanced AI tools may be restricted until appropriate competency is demonstrated.

7. Compliance and Monitoring

7.1 Regular Compliance Assessments

The Foundation will conduct regular assessments of AI use compliance through automated monitoring, user surveys, and periodic audits. Compliance assessments will examine adherence to policy requirements, effectiveness of controls, and identification of emerging risks or improvement opportunities. Assessment results will be reported to the AI Governance and Review Committee and the President and Chief Executive Officer.

7.2 Violation Reporting and Investigation

Policy violations must be reported immediately to the employee’s supervisor or V.P, whichever is appropriate, and will be investigated promptly and thoroughly. Violations should then be brought to the Governance and Review Committee and may result in disciplinary action up to and including termination of employment or contract, depending on the severity and circumstances of the violation. Corrective actions must be implemented to prevent the recurrence of violations.

7.3 Policy Updates and Improvements

This policy will be reviewed annually and updated from time to time. Policy updates will be communicated to all affected personnel through appropriate channels and incorporated into training programs.

8. Incident Response and Risk Management

8.1 AI Incident Classification

AI incidents are to be evaluated according to the Foundation’s Incident Response Plan and specific AI Incident Response Playbooks. Severity of AI data related incidents is ranked according to the sensitivity levels defined in the Foundation’s Information Classification Definitions document. Critical incidents that pose immediate risk to donor data or Foundation operations require immediate response and executive notification. High-impact incidents affecting significant numbers of stakeholders or causing operational disruption require a response appropriate to the timeframe stipulated by any applicable laws and regulations.

8.2 Response Procedures

AI incident response follows established Foundation incident management procedures with specialized protocols for AI-specific risks such as algorithmic bias, data privacy breaches, and system malfunctions. Response teams must include technical expertise, legal counsel, and communications specialists as appropriate. All incidents must be documented with root cause analysis and corrective action plans.

8.3 Stakeholder Communication

Significant AI incidents affecting donors or external stakeholders require prompt and transparent communication coordinated through the Foundation's communications team. Communication must include an explanation of the incident, steps being taken to address the issue, and measures to prevent recurrence.

9. Responsible AI

9.1 Transparency and Disclosure

The Foundation will provide appropriate transparency regarding its use of AI in donor-facing communications, external materials, and the processing of donor information. Where AI is used in a manner that materially affects donor communications or donor-related decisions, the Foundation will ensure appropriate human oversight. Internal transparency regarding approved AI uses, capabilities, and limitations must be maintained to support responsible use and informed decision-making.

10. Definitions

Artificial Intelligence (AI): Technologies that perform tasks typically requiring human intelligence, including machine learning, natural language processing, computer vision, and automated decision-making systems.

High-Risk AI Applications: AI systems that make or significantly influence decisions affecting donor relationships, financial transactions, or legal obligations, or that process sensitive personal information.

Sensitive Data: Information requiring special protection, including donor financial information, health data, social security numbers, and other personally identifiable information subject to regulatory protection. Please refer to the Information Classification Definitions document for sensitivity classifications for Foundation data.

AI-Generated Content: Text, images, audio, or other content created by AI systems, whether partially or wholly generated by artificial intelligence.

Last updated: 8/25/26