FERPA and Artificial Intelligence (AI)

Approved Tools

Sharing sensitive, restricted, or otherwise protected institutional data, including that covered by FERPA, with generative AI tools is prohibited under UW–‍Madison policy unless the tool has undergone appropriate review.

Approved Meeting Summarization Tools

UW–‍Madison-provided AI meeting summarization tools are generally approved for use with FERPA data. At this time, those are the native tools in the Zoom and Webex platforms. This means that the university has determined that the tools are secure and that meeting data is not being shared with the meeting platform vendor for their own purposes. If you have any question about which tools are approved, contact your leadership before tools are used.

Just because the tool is generally approved does not mean that it should be used in all cases. Unit leadership decides whether the tools may be used, including restrictions on the types of meetings it can be used for. Unit leadership may use this template to aid in crafting their guidance.

Guidelines for Using AI Meeting Summarization Tools with FERPA-Protected Data

The guidelines in this section apply to anyone affiliated with UW–‍Madison who hosts virtual meetings in which:

  • A specifically identified student is present; and/or
  • Their FERPA-protected, non-directory information related to their role as a student, a graduate assistant, or a student-hourly employee is discussed.

If your unit’s leadership approves the tool for use in meetings where students are in attendance or in which restricted and FERPA-protected data may be discussed, then you must understand and follow the below FERPA-tailored guidelines advanced by the Office of the Registrar. These guidelines are a supplement to — not a replacement for — university or unit guidance and policy.

Record Classification

AI meeting summaries fall into one of two categories, depending on how they are used: a sole possession record or an education record. Education records, whether generated by AI or not, may be subject to record inspection requests and/or public records requests.

An illustration of one person

Sole Possession Records

An AI meeting summary where a specifically identified student is present or discussed is considered a sole possession record:

  • If viewed only by a single individual;
  • If used as a memory aid; and
  • If not shared with others.

An illustration of three people

Education Records

An AI meeting summary where a specifically identified student is present or discussed is considered an education record:

  • If viewed by more than one person, or shared with others by the host; or
  • If uploaded into Maxient, Advising Gateway or any other database, shared drive, or shared software application.

These records would likely be provided to the student upon request.

Distribution

In general, the meeting host is responsible for the handling of these summaries, and the meeting host’s use and distribution of these summaries will indicate whether they are a sole possession record or an education record.

AI meeting summarization tools are currently configured to send the summary only to the meeting host. Any record created by an AI tool must be reviewed, corrected and validated by a human before it is shared in any way, including by being uploaded into a shared space.

Since all participants will be aware that the tool is in use, be upfront about whether or not all participants will be provided a copy of the summary. A student may believe that they have a right to see the summary or may ask for it. Know how you will address this.

For example, if you intend for the summary to be a sole possession record, you may want to explain to the student that the summary is a personal note aid, and can’t be shared with anyone else.

Best Practices

Before using FERPA-protected data in AI tools and services, you should review UW–‍Madison policies and best practices, as well of those of your individual department(s), if applicable.

Meeting Summaries

Transparency and consent are part of the best practice etiquette around these tools. Meeting hosts should make sure that all participants are aware that an AI tool is being used at the meeting.

Specify if the tool is being used by the host solely for personal records, as a memory aid in place of written notes, etc. If a participant objects to use of the tool, consider whether it can be turned off so that the meeting can progress.

AI meeting summarization tools are trained on models that contain bias and so the output of these tools can contain bias as well. These tools also make errors in their summarizations. Even if technically accurate, the tool can lack context to the extent that it is not providing a true picture of the tone and content of the meeting. Therefore, any record created by an AI tool must be reviewed, corrected and validated by a human before it is shared in any way.

Even once validated, entire meeting summaries should not be directly copied-and-pasted into other systems or databases. The host should instead use the meeting summary to craft an appropriately high-level synopsis of the meeting when recording in other systems or databases is necessary.

Use caution and discuss any sensitive cases or scenarios with your supervisor when determining when using an AI meeting summarization tool is appropriate.

FAQs

This is an accordion element with a series of buttons that open and close related content panels.

What do I do if I have more questions?

For questions about complying with FERPA while using generative artificial intelligence tools and services, contact the Office of the Registrar by email at registrar@em.wisc.edu.

The Division of Information Technology’s website also contains a comprehensive list of available tools and policies surrounding their use.