Guidelines for AI

• Use generic and/or anonymised data

  Always use generic and/or anonymised data as a starting point.
  
  Most generative AI solutions are built so that your input is delivered "out of SDU" when you use them. This means that the solution provider can use the data and that we can risk it being read by others.
  
  Data may be used to train the model or may be read by the provider's employees. Even if the provider promises not to do so, SDU does not always have the possibility to control it.
  

• Research and teaching

  • For researchers and administrative staff

    Systems that the department wishes to use for limited research projects or other local purposes that do not target students or process student data are called local systems/services.
    
    These can be used locally, provided that the individual academic staff/TAP and their management vouch for the legal use of the system. This also applies to the use of generative AI.
    
    In concrete terms, this means that the academic staff/TAP in question is able to assess whether the security of the service is commensurate with the input they intend to feed the service with.
    
    Processing of personal data, copyright and licence terms must still be complied with. This also applies in relation to SDU's data if the academic staff/TAP in question uses a service as a private person.

  • For lecturers

    If you want to use generative AI for teaching, make sure that the system/service (e.g. Copilot or ChatGPT) is centrally approved at SDU.
    
    If the service is not centrally approved, you as a lecturer cannot require students to use it as part of their teaching if they are required to create an account to use the service.
    
    However, this does not prevent you from using the services and their output in your teaching, as long as you comply with SDU's guidelines on the use of AI.
    
    Services that can be used without the use of a login can be used by students, but without the input of personal data or confidential business information.

    Rules for using AI in teaching and exams
• Authorisation of AI services

  The Information Security and Data Protection Committee (ISDC) has approved new guidelines for security authorisation of IT systems in IT procurement.
  
  The guideline is currently being implemented. According to the guideline, central systems purchased and licence-controlled by SDU IT, including systems that students at SDU are expected to use, must be approved centrally by SDU IT and possibly SDU RIO if personal data is processed in the system.
  
  

  Three levels of authorisation

  When the security organisation approves IT systems, there are three levels of approval.
  

   

  Authorised for use with personal data

  Approval of systems where SDU has entered into a data processing agreement with the supplier. All types of personal data can be processed in these systems, including confidential business information, unless otherwise stated.
  

   

  Authorised for use without personal data

  The authorisation covers systems where no data processing agreement has been entered into, which is why no personal data can be processed in the system - including confidential business information.
  

   

  Authorised for use with user data only

  The authorisation covers systems where only limited information about the user of the system is processed - e.g. username and email address. The system must not contain or process any kind of personal data in the content itself or confidential business information.
  This text has been machine translated

  Læs om godkendelse af it-systemer
• Business information

  Many generative AI systems are run by organisations other than SDU. Here, you are typically not allowed to use personal data in your input, and you need to be aware of the types of information you enter.

  If the AI system is assessed generically at SDU, you should follow the guidelines in the joint assessment. If not, it is possible to use the system locally.

  Examples of types of information

  • If the information is published, or is to be published, e.g. text for sdu.dk, you may use it as input.

  • If the information is internal SDU information, e.g. ordinary meeting minutes without closed items or personal names, you must assess whether it is safe to use it as input.

  • If the information is confidential, e.g. closed meeting points, information subject to confidentiality agreements, information about patentable inventions or similar, it should never be used as input in AI solutions that are not explicitly authorised for it.

  You need to consider whether there may be a risk in relation to the AI service you are using and the specific information you are sharing. There will be many situations where this won't be an issue, but be aware that there may be a risk of the information being shared with unauthorised parties.

  Læs mere om de forskellige typer af oplysninger
• Personal data

  Never use personal data, including sensitive or confidential personal data as input in generative AI unless the solution is authorised to do so.
  
  Personal data is information about a person if it says something about the person that is either identified, can be identified from the information, or can be identified by comparing the information you have about the person against other available information.
  

  Læs mere om de forskellige typer af oplysninger
• Licence terms and conditions

  Even the free AI solutions have requirements that the user must accept in order to use them. For example, ChatGPT's licence terms state that answers from ChatGPT may not be used for direct decisions that can have legal effect on natural persons. Similarly, you must declare that the text is written with the help of AI if it is used in a user-orientated manner.