The university aims to ensure that all AI tools used at WashU meet the highest privacy and security standards. Before purchasing a new AI tool, please follow the steps below to determine what applies to your situation.
Step 1: Check if the AI tool already exists
Before using or purchasing and AI Tool, check the AI Tools @ WashU list to see whether the tool is already approved use.
- If your tool is listed:
- No Office of Information Security (OIS) Vendor Security Required: You do not need to fill out an OIS Vendor Security Review form if your needs align with the criteria for which the tool was originally approved (ex not approved for PHI/confidential data).
- If you plan to request reimbursement or purchase, simply note on your form that you’ve confirmed it’s an approved tool.
- If you plan to request reimbursement or purchase, simply note on your form that you’ve confirmed it’s an approved tool.
- OIS Vendor Security Required: You do need to fill out an OIS Vendor Security Review form if your needs differ from the criteria for which the tool was originally approved.
- If you are uncertain whether the tool meets your specific needs or data requirements, please email ithelp@wustl.edu for guidance before proceeding.
- If your tool is not listed or includes new AI features, it is strongly suggested to email ithelp@wustl.edu to confirm next steps before proceeding.
- No Office of Information Security (OIS) Vendor Security Required: You do not need to fill out an OIS Vendor Security Review form if your needs align with the criteria for which the tool was originally approved (ex not approved for PHI/confidential data).
Why this matters: Many requests are delayed or denied because the tool already exists in another university license. Checking first ensures faster access and avoids duplicate purchases.
Step 2: Still exploring or comparing AI tools?
- Review the AI Tools Policy and Guidance for approved uses and data protection expectations.
- Contact ithelp@wustl.edu if you’re unsure whether a tool is appropriate or approved.
Step 3: Ready to use or purchase a vendor AI tool?
- If the AI tool has not yet been approved and you intend to use or purchase it, an OIS Vendor Security Review is required. This review evaluates privacy, security, compliance, and AI-specific risks, including how university data is accessed, processed, stored, or used for model training-regardless of whether the tool is free or paid.
- Important: This form is when an OIS Vendor Security Review is required only. Requests for procurement, purchasing, or vendor onboarding must be submitted through Supply Chain Management: https://universityservices.washu.edu/our-services/supply-chain-management/
- Note: Supply Chain Management requests will initiate an Information Security Review if one is required. For questions, contact supplychain@wustl.edu.