Shadow AI in higher education is students, faculty, staff and researchers using AI tools the university has not approved, often on personal accounts. A practical plan: license and announce approved tools, say which data may go where, enforce on university-managed devices and institutional accounts, and assess staff pasting student records into personal AI accounts as a FERPA risk.
A campus is not a company with more people in it. Four groups with different rules share one identity system, many laptops belong to the people carrying them, and the AI tool the university pays for often sits one tab away from a free personal account on the same product.
Our companion piece on shadow IT vs shadow AI covers which classic controls carry over. This is the campus version.
Last verified: 2 November 2026, against the eCFR text of 34 CFR Part 99 (current to 29 October 2026), Department of Education guidance on studentprivacy.ed.gov, a National Cancer Institute notice, and Google's and Microsoft's own pages. OpenAI's and EDUCAUSE's pages did not load for us, so we cite neither and use no survey figures.
Why is shadow AI on campus different from shadow AI in a company?
In a company, nearly everyone is an employee on a company laptop under one acceptable use policy. A university has at least four populations, and each one sits under different rules:
- Students are the subjects of education records. Most use their own phones and laptops, and their use of AI for coursework is a teaching question before it is a security one.
- Faculty hold grades, advising notes and exam content. Academic freedom makes a blanket tool ban hard to defend.
- Staff in the registrar, financial aid, admissions and HR offices handle the densest personal data on campus, usually on machines the university manages.
- Researchers hold unpublished findings and data received under agreements with sponsors and data providers, often on lab machines a department administers, not central IT.
Then add the structure. Colleges often run their own IT, labs buy hardware on grants, and research computing is a separate shop. A free AI tier leaves no purchase record at all.
Personal accounts sit next to institutional licenses. Google says Gemini for Education is included in all Google Workspace for Education editions free of charge, and that the data "is not human-reviewed or used to train AI models." Microsoft's Copilot Chat privacy page says prompts and responses aren't used to train the underlying foundation models, and that its enterprise data protection commitments apply with Microsoft acting as a data processor (the product was formerly Microsoft 365 Copilot Chat). Those commitments describe the institutional offerings. The same advisor can open the same product in the next tab under a personal account, on whatever terms that account carries, and the two look alike unless you can see which account is signed in.
Academic freedom and personal devices set the limits of what IT can do. Plan around them from the start.
What does FERPA say about student records and AI tools?
FERPA's regulations sit at 34 CFR Part 99. Section 99.1(d) says that when an institution receives funds under a covered program, the rules apply to the recipient as a whole, "including each of its components (such as a department within a university)". For a decentralized campus, that sentence matters: a department that picks its own AI tool is still inside FERPA.
What counts as an education record?
Section 99.3 defines education records as records "directly related to a student" and "maintained by an educational agency or institution or by a party acting for the agency or institution." The Department's Protecting Student Privacy FAQ lists grades, transcripts, class lists, course schedules, student discipline files and, at the postsecondary level, student financial information, recorded in any way, email included.
Personally identifiable information is broader than a name. The definition lists "a personal identifier, such as the student's social security number, student number, or biometric record", indirect identifiers such as date of birth, and any information that, alone or in combination, would let a reasonable person in the school community identify the student "with reasonable certainty." Deleting the name from an advising note does not by itself make it anonymous; a small program or a distinctive grade dispute can be enough.
Exclusions include sole-possession memory aids, most records about employees as employees (student employees aside), and certain treatment records.
When may an outside provider receive education records?
Generally only with consent, unless an exception in section 99.31 applies. "Disclosure" in section 99.3 covers access, release or transfer "by any means, including oral, written, or electronic means", so the question for each AI tool is which exception, if any, covers the transfer.
For vendors, the usual answer is the school official exception. Under section 99.31(a)(1)(i)(B), a contractor or other party to whom the institution has outsourced a service may be treated as a school official if it performs a function the institution would otherwise use employees for, is "under the direct control of the agency or institution with respect to the use and maintenance of education records", and is subject to section 99.33(a). That section lets the recipient use the information "only for the purposes for which the disclosure was made" and bars redisclosure without consent. The institution must also have determined that the official has a legitimate educational interest, and under section 99.7(a)(3)(iii) its annual FERPA notice must set out the criteria for both.
How is direct control established in practice? The Department's 2014 guidance, Protecting Student Privacy While Using Online Educational Services, says the regulations do not require a written agreement, but direct control is usually established through a contract signed by both sides, and sometimes terms of service suffice. It treats clicking "accept" as entering a contract, warns about terms the provider can amend without notice, and says staff should not bypass internal approval for free services. It was written for schools and districts before generative AI, but the reasoning fits chatbots.
Why is a personal AI account a risk to assess?
Take an example. Rachel Torres, an academic advisor, pastes a student's advising history into her personal chatbot account to draft a probation letter. The university signed nothing with that provider, has not named it as a school official in its annual notice, and has no control over how the provider uses or keeps what she typed. The account's terms were accepted by Rachel as an individual, and they may let the provider use content in ways the university never authorized.
Set that against the conditions above and it is hard to see which one the transfer meets. That is not a ruling, since facts matter, but it is the kind of disclosure to assess with your FERPA compliance officer and counsel. It is also the best argument for giving Rachel a licensed tool. A license can fit the exception if the contract supplies the direct control and use limits the regulation asks for; whether yours does is a reading of your contract, not the product page.
Which other rules apply on campus?
Two, briefly. The 2019 FERPA and HIPAA joint guidance from the Department and HHS says records at a university-affiliated hospital are not typically education records, and assuming the hospital is a HIPAA covered entity, they are subject to the HIPAA Rules. Records a campus clinic keeps on students are education records or treatment records under FERPA, and outside HIPAA. A university with a medical center can have both regimes in play at once.
Research data often comes with its own terms. A May 2025 National Cancer Institute reminder on NIH controlled-access genomic data says approved users may not share that data with public generative AI tools through prompts, and treats doing so as a breach of the non-transferability provision of the Data Use Certification. Other data use agreements will say different things, so read each one.
This is not legal advice; how FERPA, HIPAA or a data use agreement applies to a given tool is a question for your counsel and compliance office.
