Work with Generative AI

You should not enter data classified as confidential (Level 2 and above, including non-public research data, finance, HR, student records, medical information, etc.) into publicly-available Generative AI tools, in accordance with the University’s Information Security Policy. Information shared with Generative AI tools using default settings is not private and could expose proprietary or sensitive information to unauthorized parties.

Level 2 and above confidential data must only be entered into Generative AI tools that have been assessed and approved for such use by Harvard’s Information Security and Data Privacy office.

AI-generated content can be inaccurate, misleading, or entirely fabricated (sometimes called “hallucinations”) or may contain copyrighted material. You are responsible for any content that you publish that includes AI-generated material.

Generative AI has made it easier for malicious actors to create sophisticated phishing emails and “deepfakes” (i.e., video or audio intended to convincingly mimic a person’s voice or physical appearance without their consent) at a far greater scale. Continue to follow security best practices and report suspicious messages to phishing@harvard.edu.

Additionally, the University is working to ensure that tools procured on behalf of Harvard have the appropriate privacy and security protections and provide the best use of Harvard funds.

• If you have procured or are considering procuring generative AI tools or have questions, contact HUIT at ithelp@harvard.edu or read more about tools currently available or coming soon.
• Vendor generative AI tools must be assessed for risk by Harvard’s Information Security and Data Privacy office prior to use.