About Individual Tools
Individual tools are approved for use with data at various risk levels – Low, Moderate, High, or Restricted – as defined in the UVM Data Classification Matrix
When a service is listed as approved for a risk level, that means it is not approved for higher risk levels. For example, if a service is approved for “Low to High Risk”, that means it is not approved for Restricted data such as Protected Health Information or Controlled Unclassified Information.
When examples are given below, they are only sample examples and are not comprehensive about what is allowed and what is not. Refer to the UVM Data Classification Matrix for more complete details or consult with ETS or Purchasing as part of Contract Review.
| Tool | Information Allowed | Availability |
|---|---|---|
| Microsoft Copilot | Low to High Risk allowed | Available to faculty, staff, and students |
| Microsoft Copilot for M365 ($) | Low to High Risk allowed | Available to faculty, staff upon request via Tech Team |
| All other general AI tools (ChatGPT, Claude, Gemini, etc.) | Public information only Any use cases other than Public Information require Contract Review | Free or purchased NOTE: Consider using already purchased tools such as Microsoft Copilot before purchasing other tools |
Microsoft Copilot
AI-powered assistant designed to help with various tasks, including generating content, answering questions, and providing insights.
Availability: All active UVM students and employees (included with M365 license)
Allowed data: Low to High Risk, when logged in with your UVM NetID (Enterprise Data Protection)
Appropriate use: uploading student academic data for analysis while logged into Copilot with your UVM NetID.
Inappropriate use: uploading student health information; uploading UVM non-public data while using Copilot without NetID login.
More information: Microsoft Copilot – UVM Knowledge Base
Microsoft Copilot for M365
AI-powered assistant integrated into Microsoft 365 applications including Outlook, Word, and Excel, designed to help with tasks including generating content, summarizing information, and providing insights to enhance productivity and efficiency. This is licensed for individual users and can be requested by contacting the UVM Tech Team or LCOM Service Center.
Availability: UVM employees (upon request)
Allowed data: Low to High Risk, when logged in with your UVM NetID (Enterprise Data Protection)
Appropriate use: summarizing email conversations (logged into NetID account)
Inappropriate use: uploading student health information; uploading UVM non-public data while using Copilot without NetID login.
More information: Microsoft Copilot – UVM Knowledge Base
Microsoft Teams Premium
An add-on license that adds AI-powered productivity, meeting customization, and security features, including meeting summaries with action items and live translation for multilingual collaboration. This is licensed for individual users and can be requested by contacting the UVM Tech Team or LCOM Service Center.
Availability: UVM employees (upon request)
Allowed data: Low to High Risk
Appropriate use: generating a meeting summary and action items
Inappropriate use: generating a transcript of a medical appointment
More information: Microsoft Teams Premium | Microsoft
VACC Research Computing AI
Run open-source large language models on high-performance computing systems.
Availability: UVM Researchers (upon request)
Allowed data: Low to Moderate Risk; High Risk with consultation
Appropriate use: Researching language patterns in a large corpus of public documents
Inappropriate use: Model fine-tuning with classified documents produced by the Department of Defense
More information: Research Computing - Facilitation
VACC Transcription
UVM’s VACC has a locally hosted transcription service available, based on open-source Whisper. More information.
GitLab Duo [limited availability]
GitLab’s AI assistant for DevSecOps workflows. Offers code suggestions, vulnerability detection, and pipeline optimization.
If you are interested in AI coding functionality, please reach out to ETS to discuss.
Guidance for other AI tools and services
- If your department wants to purchase solutions with AI components, they must go through Contract Review for data protection considerations.
- If a vendor adds AI capabilities to a solution already under contract, the AI functionality must go through Contract Review for data protection considerations.
- When in doubt, ask for guidance from iso@uvm.edu.
Other AI Tools in use
Other Generative AI tools, such as ChatGPT, Claude, and Gemini/NotebookLM are widely available but have not been approved for use with UVM data. For these tools:
Availability: Use of any software should either have Information Security Office approval or should go through Contract Review if being used with anything other than public data.
Allowed data: Low Risk (public) data only
Appropriate use: use tool to generate output based on public web content.
Inappropriate use: loading any non-public UVM data for analysis.
Reasoning: Vendor licensing does not provide data protection. All data and prompting interactions can be used by Vendor to train their models.
If you have further questions, please reach out to iso@uvm.edu.