Guidance for use of Generative AI tools

Using Generative AI at MIT

Generative AI tools can support many types of work at MIT. However, using these tools requires care — especially when working with Institute data. MIT work should be conducted using MIT-licensed AI tools whenever Institute data is involved.

Generative AI tools licensed by MIT are acceptable for use with Institute low- and medium-risk data. High-risk data should never be used with generative AI tools.

Determine the Risk Level of Your Data Before Using AI Tools

The Institute's data classification framework is found on the Infoprotect website. Use the self-assessment tool and see the risk level definitions with examples to determine the risk level of your data.

	Publicly Available GenAI Tool	MIT-Licensed GenAI Tool
Low Risk Data	Not recommended*	Allowed
Medium Risk Data	Not allowed	Allowed
High Risk Data	Not allowed**	Not allowed**

*For MIT-related work, low-risk information should be used only in MIT-licensed generative AI tools. Public generative AI tools may use submitted data for model training or external sharing and are not governed by MIT agreements. MIT provides licensed tools, such as Parley, that are designed to support Institute work while protecting MIT data.

**Do not use high-risk information with Generative AI tools, including MIT enterprise Generative AI tools. If you have used high-risk data in a Generative AI tool, contact security@mit.edu immediately.

If you are unsure if an AI tool is right for your data’s risk level, contact ai-guidance@mit.edu.

Generative AI Tools Licensed by MIT

MIT enterprise agreements govern the safety and security of data entered into MIT-approved tools. A list of Generative AI tools currently licensed by IS&T can be found on the IS&T website.

If you are unsure of which tool to start with, use MIT’s Parley platform, which allows users to select from a variety of LLMs. All the models in Parley are protected by MIT data privacy agreements, which prevent use of MIT data for model training and external sharing by the third-party platforms.

If you wish to purchase new Generative AI tools, you must go through the VPF procurement process to ensure the vendor agreement has the appropriate terms. IS&T works closely with the MIT IT Governance Committee, Information Technology Policy Committee, and the Office of General Counsel to determine appropriate terms for vendor agreements relating to generative AI.

Generative AI Tools for MIT Education and Research

MIT's Chair of the Faculty has recommended the use of these resources on generative AI and teaching provided by the Teaching and Learning Laboratory. This guidance does not address all issues for consideration when using generative AI tools as part of MIT research, nor does this guidance focus on when MIT researchers are creating generative AI tools or publicly releasing datasets/information that could become ingestible data for use by MIT researchers or third parties for training generative AI tools. Please contact mitogc@mit.edu for further guidance on research-related applications or development of AI tools.

Researchers should also refer to the COUCHES Guidance on AI in Research and the MIT Libraries Guidance on Citing AI-Generated Content.

Generative AI Tools with Patent and Invention-Related Data (TLO Guidance)

Additional restrictions apply to patent-related materials and invention disclosures. See the TLO Statement on Using Public Generative AI Tools in Patent‑Related Activities for complete information.

Compliance with Federal and State Laws and Orders

As with any use of information technology at MIT, ensure that your use of generative AI tools and services complies with all applicable federal and state laws and orders (including, without limitation, FERPA, HIPAA, Massachusetts Data Protection Standards, export control laws, and Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence), Institute policies (including 10.1 Academic and Research Misconduct, 11.0 Privacy and Disclosure of Personal Information, and 13.0 Information Policies), follows all guidelines outlined on Information Protection, the Institute's Written Information Security Program (WISP), and complies with any additional policies established by your department, lab, center, or institute (DLCI).