AI Governance Framework

Prepared for: Office of the President · Marston University · R1 research university, ~25,000 students, ~$1.2B operating budget · illustrative scenario

1 · The brief, as we received it

Marston's President asked Cross Suite Advisory the question every research university is asking right now: "What is our institution's policy on AI — across the academic mission, the research enterprise, the student experience, and the administrative core — and who decides?"

This Framework answers all four. It establishes the principles, the decision rights, the risk taxonomy, and the oversight cadence the University will operate under for the next twenty-four months. It is written to be approved by the Board of Trustees and to live as the institution's standing AI governance instrument.

2 · Scope — the four domains

Domain	What is governed	Primary accountability
Academic	Use of AI in teaching, assessment, academic integrity, faculty AI policy, syllabus disclosure	Provost · Faculty Senate
Research	AI in sponsored research, research-integrity, IRB review of AI-using protocols, AI-generated authorship disclosure	VP for Research · IRB
Student-facing	Admissions, advising, financial aid modeling, mental-health chat, accommodation tooling	VP for Enrollment · Dean of Students
Administrative	HR, procurement, finance, communications, vendor AI tools, third-party data sharing	EVP & CFO · CIO

The cross-domain rule. Where a single AI use touches two or more domains (e.g., a chat tool that supports academic advising AND collects student data AND informs financial-aid awarding), the higher-stakes domain governs. The Office of the Provost arbitrates.

3 · The seven principles

The University adopts these principles as the test every AI use must pass.

1 · MISSION-FIRST

No AI use weakens the academic mission. If a use trades mission for efficiency, it is not approved.

2 · HUMAN AUTHORITY

Decisions that materially affect a student, employee, or community member — admission, grade, discipline, hiring, accommodation — remain with a named human. AI may inform; it does not decide.

3 · TRANSPARENCY

When AI materially shapes a decision or a communication, the affected party is told. This is institutional policy, not a courtesy.

4 · DATA STEWARDSHIP

Student, employee, research, and community data does not enter third-party AI systems without a written agreement reviewed by counsel and a documented privacy assessment.

5 · EQUITY-BY-DESIGN

Every AI use is reviewed for disparate impact. Bias audits are routine, not exceptional. Findings are acted upon, not filed.

6 · ACADEMIC FREEDOM

Faculty retain the authority to permit, regulate, or prohibit student use of AI in their courses. The University publishes a recommended framework; the faculty member is sovereign within it.

7 · DOCUMENTED OVERSIGHT

Every approved AI use lives in a public registry. The University can answer, on any day, who approved it and on what date.

4 · Decision rights — who decides what

Decision	Authority	Notification
Adoption of this framework	Board of Trustees, on Provost's recommendation	Public
An academic AI policy change	Provost & Faculty Senate, jointly	Faculty + students
A research-protocol AI use	IRB, under the framework	Sponsors + participants
A student-facing AI tool (live to students)	VP for Enrollment OR Dean of Students; CIO concurs on technical risk	Affected student population
An administrative AI tool over $50K, OR touching personnel data	EVP & CFO and CIO, jointly; counsel reviews data terms	Internal stakeholders
Any AI vendor procuring student or employee data	CIO with counsel; presented to the Audit & Risk Committee of the Board	Board committee on the record
A new third-party AI partner relationship of strategic significance	President, on recommendation of the AI Council; Board notified	Public

5 · The risk taxonomy — six categories

Risk	What it looks like	Reviewing body
Academic integrity	Student misuse; faculty workload around detection; assessment design erosion	Faculty Senate AI Committee
Research integrity	Undisclosed AI use in publications; AI-fabricated citations; data leakage to commercial AI	IRB · Research Integrity Office
Equity & disparate impact	Admissions / aid / advising tools that systematically disadvantage protected groups	Office of Institutional Equity
Privacy & data	FERPA exposure; HIPAA exposure for the health center; international data-transfer issues	General Counsel · Privacy Office
Financial & vendor	Sunk cost in tools no one uses; vendor lock-in; opaque pricing on AI services	Procurement · CFO
Reputational	An AI failure that becomes a news story; communications that read as AI-generated to constituents	VP Communications · President

6 · Oversight cadence — the standing structure

AI Council — the Provost (chair), VP for Research, VP for Enrollment, EVP & CFO, CIO, General Counsel, and one faculty member elected by the Senate. Meets monthly. Reviews the registry, approves new uses above the routine threshold, surfaces issues to the President.
Faculty Senate AI Committee — owns the academic-domain policy; meets quarterly; reports annually to the full Senate.
Audit & Risk Committee of the Board — receives a quarterly AI report; reviews any vendor data-sharing of strategic significance; reports to the full Board annually.
The public AI Registry — published on the University website; lists every approved AI use, its accountability owner, and the date of approval.

7 · Implementation — the first 12 months

Quarter	Milestone
Q1	Framework approved by the Board; AI Council convened; baseline registry built from current AI uses; faculty policy revision begun
Q2	Faculty AI policy adopted by the Senate; data-stewardship policy revised; first Audit Committee AI report
Q3	Equity audit of student-facing tools completed; vendor inventory and data-terms review concluded
Q4	Annual report to the Board; public AI Registry published; framework refresh planned for year two

8 · What this Framework is — and is not

This Framework is the institution's governance instrument for AI — the principles, decision rights, risk taxonomy, and oversight cadence the University commits to. It is not a technology choice, an enforcement mechanism, or a substitute for the disciplinary, faculty-governance, and legal processes already in place. Cross Suite Advisory provides senior-grade governance counsel; the University governs.

Reviewed and signed by Vernetta Kinchen

Chief Executive Officer & Principal · Cross Suite Advisory — N M E D LLC

This Framework is delivered as the firm's senior counsel to the Office of the President. The AI agent assembled the analysis, the principles, and the decision-rights matrix; my judgment shaped the framing, the cross-domain rule, and the academic-freedom protection. The Framework does not leave the firm until I sign it.

How this deliverable is produced. Cross Suite Advisory's agents are built on Anthropic's Claude AI, designed and trained around the Principal's three decades of practice across executive advisory, governance, and senior leadership development — including direct experience with university-sector institutional architecture. The firm's intellectual capital — frameworks, judgment, hard-won knowledge — sits inside the agents; Claude provides the reasoning engine. Every final report routes to the Principal for review and signature before it reaches a client.