Acceptable Use and Data Categorization
AI tools can be a real help with everyday work, but what can be safely shared with them depends on the tool, the version, and the user account. This page lists some common AI tools and identifies which data categories may be used with each.
Data classification categories
| Category | Definition | Examples |
|---|---|---|
| Category I — Confidential | Data the university is legally required to protect. Exposing, changing, or losing it could violate state or federal law or UT System policy. | Employee date of birth, driver’s license numbers, passport and visa numbers, bank account numbers |
| Category II — Controlled |
Data that isn’t confidential but isn’t meant to be shared freely. Note: this classification likely encompasses the greatest volume of data within the university |
Internal emails and memos, draft budgets, internal procedures, internal presentations |
| Category III — Published | Data that is intended for anyone, inside or outside the university, to see. | Public web pages, news releases, course catalogs |
Some data, like HIPAA- or FERPA-related data, is considered Category I but may be subject to further restrictions; please check the relevant table column for the data and AI tool you want to use. Alongside the Data Categories Allowed column, the table shows whether a tool is approved for specific types of regulated data, including student records (FERPA), protected health information (HIPAA), Social Security numbers (SSNs), payment card data (PCI), export-controlled information (ITAR), and research data governed by an Institutional Review Board (IRB).
AI tools and allowed data
The AI tools table shows which data can be used with each tool, as defined by the Office of Information Security Data Classification Standard.
| Service Name | Data Categories Allowed | HIPAA | FERPA | SSNs | PCI | ITAR | IRB |
|---|---|---|---|---|---|---|---|
| Institutional Generative AI ToolsTools for which UT San Antonio has enterprise licenses with data protection clauses | |||||||
| Anthropic Claude Enterprise (UT San Antonio license) | CAT II, III | No | No | No | No | No | No |
| Microsoft 365 Copilot Chat (signed in with UT San Antonio account) | CAT II, III | No | No | No | No | No | No |
| Microsoft 365 Copilot Premium (paid UT San Antonio license) | CAT II, III | No | No | No | No | No | No |
| Other ToolsExamples of common generative AI tools used with personal or self-purchased accounts | |||||||
| Anthropic Claude, including Claude Code (Free, Pro, Max, self-purchased Team) | CAT III | No | No | No | No | No | No |
| Google Gemini, personal Google account (Free, Google AI Plus, AI Pro, AI Ultra) | CAT III | No | No | No | No | No | No |
| Microsoft Copilot (personal account, Free, M365 Personal/Family/Premium) | CAT III | No | No | No | No | No | No |
| OpenAI ChatGPT (Free, Go, Plus, Pro, self-purchased Business) | CAT III | No | No | No | No | No | No |
What about…
AI tools not mentioned in the table?
Unlisted tools may be used only with Category III data. Some AI tools, such as DeepSeek, are banned from state-owned devices and networks under Texas’s prohibited technologies list. View the state’s covered applications and prohibited technologies lists (opens in a new window).
AI features built into other software (e.g., Grammarly, Canva, etc.)?
AI features built into other software can be used with CAT III data only, unless listed in the table above.
Note: The account you're signed into matters. Always verify that you are signed in to the appropriate AI tool with your UT San Antonio-issued account.
To request a review of an AI tool or feature, please fill out a ticket(opens in a new window).