These guidelines are subject to change as we await the final recommendations of the UW AI Task Force.
Everything that is created or received by the University of Washington and its employees is considered a record regardless of physical form or characteristic. All records must be retained according to a legally approved records retention schedule. Records created for, or created by, generative artificial intelligence (AI) platforms are no different.
All UW users should be wary of the data being shared with a generative AI platform. Review the interim guidelines from the Office of Information Security (OIS) and UW Privacy Office that share invaluable information on the concerns surrounding sensitive information, misinformation, and confidentiality using these platforms. One platform currently offered and approved for use at the UW is Microsoft Copilot with Commercial Data Protections. However, if UW users want to use another third party generative AI platform that is not Microsoft Copilot with Commercial Data Protections, regardless of whether it is free, downloadable software, Software as a Service (SaaS), web-based services, browser plug-ins, or even phone apps, users should work with OIS, the Privacy Office, and UWIT to ensure a meticulous review is conducted on how that third party handles the data inputted or outputted.
A prompt, also known as the input, entered into a generative AI platform is a record created by the UW, in the same way that text entered into email or into a Word document is a UW record. It is important to know whether the prompt written by the UW employee is being retained and/or used by the companies that power these platforms. If the prompt is being retained or used by the company, including residing in the servers of a third party, the prompt is still a UW record. The output created by the generative AI in response to the prompt is also a record received by the UW, and therefore subject to UW records retention requirements. Users should be aware of how the company providing the AI service may be storing a copy of the output created by the generative AI.
While all efforts should be made before engaging a product to know how that company is storing data, users are responsible for managing the prompt data they create and outputs they receive from generative AI tools, just as users have a responsibility to manage a format like email that they send and receive. Users should be cognizant of the two records management principles related to the use of these platforms:
First, generative AI platforms are not recordkeeping repositories. These generative AI platforms are not designed for efficient and effective records keeping. Therefore users should not rely on the generative AI platform to fulfill UW retention requirements. If data needs to be retained, the employee must save the data outside the platform to manage it appropriately.
Second, records of inputs created and outputs received using these generative AI platforms can be considered transitory in nature, meaning they only need to be retained until the reference purpose has been served. The prompt entered and resulting output are considered drafts and part of the brainstorming process. This records management policy aligns with the recommended use of these products where the content received should be scrupulously reviewed by humans and not relied on for accuracy. The output from the generative AI can viewed as a draft that requires review and refining before being finalized.
Combining these principles, if the input and/or the resulting output are to be relied upon to create a substantive record, users should ensure that data is exported out of the generative AI platform and into a more secure UW location to be retained based on the function of the data. Refer to the UW General Record Retention Schedule or your departments’ Departmental Records Retention Schedule for retention standards of substantive records.
This guidance aligns with our Third Party Software Best Practices as well as the newest information related to other AI features being used in platforms such as UW Zoom.
Contact our office with questions.