Best Practices for Procurement of AI Tools

Description

Best Practices for Procurement of AI Tools The acquisition of generative AI tools or products that contain AI functionality, whether through purchase, subscription or free use on behalf of AU, fall under the university's managed risk framework due to several key factors: • • • • These tools often require access to university data and confidential information Their use may involve university intellectual property (both as inputs and outputs) They typically require careful review of indemnification and liability terms They can present significant institutional risk related to data privacy, security, and compliance The Procurement & Contracts Department (PCD), in collaboration with the Office of Information Technology (OIT), has established a review process for all software and AI tool acquisitions using university funds (including grant and award funding). This process ensures proper risk management, institutional protection, and preventing redundancy (including possible cost-sharing). Key Risk Considerations: • • • • • • Protection of private and confidential information Management of intellectual property rights Evaluation of vendor liability and indemnification terms Assessment of security and compliance requirements Review of data processing and storage practices Assessment of accessibility Before pursuing the acquisition of any AI tool: 1. Document your intended use case and data handling requirements (including confirming no existing/redundant licenses at AU) 2. Contact PCD to initiate the review process 3. Allow sufficient time for security and contract review 4. Do not accept or agree to vendor terms without PCD review 5. Include OIT in discussions about implementation needs Renewals or amendments to existing contracts should also involve contacting PCD