The Chief Digital Risk Office and University Payables have collaborated to address the need for risk awareness with the rapid emergence of generative artificial intelligence (AI). AI is an algorithm (such as ChatGPT) that can be used to create new content including audio, code, image, text simulations and videos.
Currently, Section 7.6 The University Purchasing Card (PCard), from the Business and Financial Policies and Procedures, identifies computer software and electronic services as restricted purchases. PCards can be used for these restricted purchases when corresponding requirements are met as outlined below:
Computer software and electronic services - are allowable if they meet the requirements of Restricted Items as outlined in 7.2 Purchase of Goods and Services. The term "electronic services" refers to software developed and hosted by a vendor which the end-user accesses over the Internet. Unlike traditional packaged applications that users install on their computers or servers, the vendor owns the software and runs it on computers in its data center. The customer effectively rents it, usually for a monthly fee. Prior to using a PCard to purchase allowable software or electronic services with contracts (including 'click-through' agreements), units submit a PCard Exception Request and the Software Purchased by PCard or the Electronic Services Purchased by PCard to Card Services. Once the PCard Exception is approved the purchase may be made.
AI is considered an electronic service. In addition to the exception requirements outlined below, any AI PCard purchases will now require the cardholder to complete the Generative AI Risk Awareness and Acknowledgement Form. The form is to ensure that users understand and acknowledge potential risks associated with AI technology along with appropriate use and compliance with applicable university policies and regulations.
To purchase Generative AI, the steps below should be followed:
- Units that anticipate a purchase as mentioned above should complete the Generative AI Risk Awareness and Acknowledgement Form. The form describes the software and the vendor name to identify the AI situation to Card Services. The Form is located on the Digital Risk Management website under Guidance Material > Generative AI Purchases.
Card Services will review the PCard Exception Request form. If the department responses are correct and considered allowable, the request will be sent to the respective Purchasing Offices for a review of any terms & conditions or contract issues.
If Purchasing accepts the terms and conditions, Card Services will send an approval email to the cardholder/unit and cc digitalrisk@uillinois.edu.
Contact
If you have questions about the PCard exception, please contact Card Services at cco@uillinois.edu or submit a Service Desk Ticket. Questions about the Generative AI Risk Awareness and Acknowledgement Form should be sent to Digital Risk at digitalrisk@uillinois.edu.
