Generative AI guidelines

Generative AI offers new opportunities in research, education, and productivity, but it must be used thoughtfully.

This page builds on Initial guidelines for the use of Generative AI tools at Harvard to outline HMS recommendations and approved tools to help you use AI responsibly, in line with policies and data security requirements. It covers compliance standards and how to protect confidential information.

The HMS Artificial Intelligence Acceptable Use Policy sets the requirements for using AI tools for HMS work. This page lists the approved tools and the highest data level each one is approved for.

Responsible use

Responsible AI use at HMS includes ethical, transparent practices:

• Verify outputs. AI-generated content may be incorrect or fabricated. Always fact-check before using or publishing results.
• Uphold academic integrity. Follow faculty or student handbook policies. Be transparent with students and colleagues about acceptable use.
• Cite AI contributions appropriately in research and academic work. Refer to guidance from COPE and WAME for citation standards.

Data and security

Before using any generative AI tools, ensure you're complying with Harvard's data and security policies:

• Use only approved AI tools for HMS work. Publicly available and personal AI tools aren't covered by Harvard agreements, so don't use them for HMS work, even with public data.
• Classify your data appropriately. Most approved AI tools are approved for Level 3 and below. Before you use AI with Level 4 or Level 5 data, consult HMS Risk Management at RiskManagement@hms.harvard.edu. The same data levels apply to data you use to build or train an AI model. To request HMS Azure AI, contact hms-it-ai@hms.harvard.edu.
• Submit a Vendor Assessment Request before you use any other AI tool for HMS work, including one you already use. If an AI feature is added to software you already use, email HMS Risk Management. For other help with data security, contact HMS IT.
• Comply with regulations such as HIPAA, FERPA, and sponsor-specific data requirements.
• Legal and funding agency compliance is essential. Align AI use with NIH, COPE, and other relevant bodies.
• Beware of phishing. Generative AI can be used for malicious purposes such as phishing. Stay alert and report suspicious messages to phishing@harvard.edu.
• Procurement support for licensing terms or contracts is available by sending an email message to procurement@hms.harvard.edu.
• Consult the Office of Research Administration (ORA) before using data under a DUA. Even if an AI tool is approved for your data’s security level, a Data Use Agreement (DUA) may separately restrict a dataset’s use or require the data provider’s permission for use with AI. Contact the Research Data Compliance team in the Office of Research Administration (ORA) at Data_ORA@hms.harvard.edu with questions about whether data covered by a DUA may have relevant restrictions.

Maximum data level by AI tool

Different AI tools are approved for different data levels. Confirm a tool’s approved level before you enter data:

• Level 2 – HMS automated meeting assistants, such as Zoom Companion and Copilot Premium used during meetings.
• Level 3 – The Harvard AI Sandbox and premium HMS AI tools, such as Claude, ChatGPT Edu, and Copilot used outside meetings.
• Level 4 – Special-request tools, such as the Longwood cluster and HMS Azure AI.
• Level 5 – No AI tool is approved for Level 5 data.

Supported tools

HMS provides one AI tool — Claude, ChatGPT Edu, or Microsoft Copilot Premium — per eligible person. The following table compares the generative AI tools available at HMS:

For more detail on some of these tools, see AI tools at Harvard.