The State University of New York's 64 campuses must establish or update artificial intelligence guidelines by Dec. 31, a binding mandate that requires bias evaluation, student data privacy protections, and responsible AI use. The policy, passed in May, is already viewed by IT leaders at other public university systems as an early indicator of what AI governance in higher education will require.
SUNY CISO Jesse Sloman said protecting student data-including personal information and academic records-is a top concern. "We don't want a SUNY student using a SUNY AI tool and have that data used to train external models outside of narrow, contractually defined terms," Sloman told EdTech when the policy was announced.
The mandate leaves campus IT leaders to design vendor evaluation processes, data governance workflows, and training programs for responsible AI use.
Deadline and minimum requirements
Each campus's policy must be in place by Dec. 31, 2026, with a possible one-time, two-month extension. At minimum, the guidelines must:
- Clarify AI roles and responsibilities for campus stakeholders
- Provide training on safe and responsible AI use
- Add procurement safeguards to protect SUNY data and prevent biased use of AI
Policies must also account for differences among teaching, research, and administrative uses, apply stronger oversight to higher-risk systems, and include regular review cycles.
Procurement safeguards and data privacy
Without strong governance, AI tools can spread across a campus faster than oversight can keep up. Gartner has noted that AI governance is still maturing, and evaluating AI tools means working with complexity and rapid technology shifts. Schools should develop detailed risk assessments and mitigation strategies during procurement, rather than accepting vendor claims at face value. Institutions can also share AI-specific tool evaluations with one another.
On the data front, colleges house enormous volumes of sensitive records-academic, financial, and donor data. AI raises the stakes for how that data is governed. In procurement, institutions can require vendors to document how they protect user data, whether uploaded information is used to train AI models, and how anonymization works. Protecting sensitive data may mean modernizing identity, access, and security infrastructure.
Bias evaluation and oversight
AI tools can produce biased outputs because of biases in training data. EDUCAUSE recommends regular audits of AI algorithms and data sets, testing systems with diverse data to spot and reduce discriminatory outcomes. The organization also advises training models with representative data and setting clear policies that prohibit discrimination by AI applications.
Governance across a diverse system
The SUNY policy acknowledges that not all universities have the same resources for AI governance. That can lead to uneven application, but every campus must meet minimum standards to mitigate risk. According to one study, fewer than 40% of institutions have policies outlining acceptable AI use. SUNY's approach-encouraging campuses to align new AI governance with existing IT and procurement policies-offers a template. "We don't want campuses to re-create all of their existing policies in a separate AI document," Sloman said. "Instead, they should think about how AI fits into their existing policy frameworks and update those where necessary."
Meanwhile, the Empire AI consortium, a statewide partnership including SUNY, CUNY, and private research universities, launched the first stage of a high-performance computing center in October 2024. The full center is scheduled for 2028, giving member institutions more control over how sensitive data is handled during AI workloads.
For additional guidance on AI governance in higher education, the AI for Education section at Complete AI Training offers practical resources.
Why this matters for education professionals
SUNY's binding policy is a signpost for public higher education: AI governance expectations are shifting from optional to mandatory. IT leaders at universities outside New York should expect similar mandates and can use SUNY's model-tying AI rules to existing procurement and IT frameworks-as a starting point. The deadlines, protections for student data, and bias evaluation requirements will likely appear in future policies elsewhere, making early preparation a strategic move.
Your membership also unlocks:
