AI Tools and Solutions

NC State has approved a range of AI products for use with Green or Yellow data without the need to submit an IT Purchase Compliance (ITPC) review request. Any use of Red or Purple data will still require an ITPC review request.

To learn more about the ITPC process, see About IT Purchase Compliance.

Review a comprehensive list of approved and rejected AI tools and solutions:

Data Sensitivity Classifications

When determining data classification levels, the university must factor in the following risk types: strategic, reputational, financial, operational, compliance and hazard.

• Not Sensitive or Green Data
  • Not Sensitive data includes data where unauthorized disclosure or loss poses a low risk or impact to the university or its affiliates. This information may be disclosed to individuals regardless of their university affiliation. Minimal security measures are needed to control the unauthorized modification, use or destruction of this data.
• Moderately Sensitive or Yellow Data
  • Moderately sensitive data includes data where unauthorized disclosure or loss poses a moderate to low risk or impact to the university or its affiliates. Examples include date of birth, race, gender and transcripts.
    • Data that is created or collected within the university’s data environment without having been classified by the data stewards must be controlled at a minimum as moderately sensitive/yellow until final classification is assigned.
• Highly Sensitive or Red Data
  • Highly sensitive data includes data where unauthorized disclosure or loss poses a high risk or impact to the university or its affiliates. Examples include driver’s license, mother’s maiden name, passport and immigration number.
• Ultra-sensitive or Purple Data
  • Ultra-sensitive data includes data where unauthorized disclosure or loss poses the highest risk or impact to the university or its affiliates or where specific data categories require special privileged access management. Examples include social security numbers, passwords, encryption keys and biometrics (such as fingerprints and iris scans).
    • Additional access and handling requirements are required for Ultra-sensitive data because it may be impossible to repair damage caused by unauthorized disclosure.