Higher education AI registration process

Purpose

This job aid will describe how higher education institutions that do not use the Commonwealth technology portfolio (CTP) can submit Artificial intelligence (AI) technologies for oversight and governance and for Secretary of Education approval in accordance with executive order (EO) 30.

(see also Artificial Intelligence)

Last updated: May 22, 2024

Overview

AI technology includes capabilities such as machine learning, natural language processing, expert systems, speech recognition and more. As AI has become more prevalent in society and business it is important for standards and guidance to be put in place to ensure the responsible, ethical and transparent use of AI technology by Virginia’s state government. Executive Order 30 for AI was signed by Governor Glenn Youngkin on Jan. 18, 2024. In adherence to the order, any internal or external AI system which an agency seeks to develop, implement, employ or procure must be entered into a registry maintained by the Virginia Information Technologies Agency (VITA) and undergo VITA governance review.

Workflow

AI that is used or will be used shall be registered, receive a governance review and be approved by the Secretary of Education (the Secretary responsible for the using entity). Registration of AI uses should take place in Archer, the Commonwealth of Virginia (COV) risk management system. Access to Archer will be available for entities that require Artificial intelligence (AI) registration process for higher education registration. Those who need access to Archer should send an email to Commonwealth security and risk management.

The AI registration should then be submitted to VITA via an email with the Archer entry attached as a PDF to the information technology investment management division (ITIMD) mailbox to input the request into the Commonwealth technology portfolio (CTP).

The following steps will be performed during this review:

• VITA will provide an oversight and governance review.
• The Commonwealth chief information officer (CIO) will provide a recommendation and send a notification via an email to the Secretary of Education.
• The Secretary of Education will approve or disapprove with an email reply.
• The Secretary of Education’s approval status will be reflected in CTP
  • An email notification will be sent to the higher education institution and to the Commonwealth enterprise architecture (EA) team.
• VITA shall retain records of the specific AI use and approvals thereof.

Instructions for AI registration requests

Below are instructions on how to enter an AI registration request into Archer and how to send the request for reviews and approvals via email.

Step one: Register AI in Archer. This step will be performed by the higher education institution’s designated information security professional:

1. Open Archer.
2. Navigate to Agency Workspace, click the Agency Management drop down and select Artificial Intelligence.
   
3. From the ellipsis menu on the right, select New Record.
   
4. The AI registration form will display. Complete the below fields, then click SAVE AND CLOSE.
   1. Agency
   2. Application
   3. Year
   4. Form Submission Date
   5. Name
   6. Artificial Intelligence Type
   7. Purpose
   8. Sensitivity
   9. Public Safety
   10. Technology Used
   11. Model Architecture
   12. Model Input
   13. Model Output Data Type & Structure
   14. Model Algorithm
   15. Data Sets Used
   16. Operation
5. Obtain a portable document format (PDF) from Archer
   1. On the AI registration form, select the ellipsis and click Print.
      
   2. RSA Archer will navigate to a new tab with the AI entry and a link in the upper right that says Print.
      
   3. The print preview screen will open that will allow the user to save the entry as a PDF.
      

Step two: Submit AI for oversight and review via an email and PDF attachment

To submit your AI registry entry, send an email with the attached PDF AI registration entry to information technology investment management division (ITIMD). Include within the information below whether the AI technology is new or currently exists. If the AI technology currently exists, include the date it went into service.

By sending this email the entity is indicating their approval of the AI oversight request and is requesting for governance and secretary approval. The email should follow the below template:

If you have any questions, please contact your dedicated customer account manager.