TRU Guidelines and Policies

TRU and AI

Thompson Rivers University provides AI tools to support administrative efficiency while meeting the University’s obligations under:

Administrative staff work with highly sensitive employee, student, financial, contractual, and operational information. These guidelines ensure AI is used securely, legally, and ethically across TRU’s administrative environment.

Guidelines from Thompson Rivers University

Microsoft Copilot is the first AI model that has undergone a Privacy Impact Assessment (PIA) which meets TRU Administrative and regulatory requirements for use. Therefore, it is sanctioned for use (more approved AI models forthcoming).

Microsoft Copilot is approved for TRU administrative use because:

  • It operates inside TRU’s secure M365 tenant.
  • Data stays inside Canadian data centers.
  • Prompts and outputs are not used to train Microsoft’s public models.
  • Copilot respects all TRU permissions, file access settings, and MFA.
  • It aligns with FOIPPA and TRU’s internal security standards.

Copilot can be used for administrative scenario(s), such as:

  • HR onborading, policy summaries, SOP creation.
  • Finance workflows, reconciliation, budget narratives.
  • Procurement planning, contract summarization.
  • IT documentation, troubleshooting guides, ticket summaries.
  • Enrollment Services communications and process documents.
  • Departmental communications, meetings, and operational planning.

This aligns with TRU’s student and Faculty for AI guidance, which recommends institutionally managed AI tools over public systems.

Due to security and privacy concerns, TRU is blocking access to DeepSeek, a Chinese artificial intelligence (AI) company popular for its advanced generative AI models.

When connected to TRU’s network, users will be unable to access DeepSeek via mobile, desktop or web. However, if you have DeepSeek installed on a device, it could still work when connected to another network or using cellular data. IT Services strongly recommends removing the app to be safe on and off campus.

This move follows similar action taken recently by the federal government and other academic institutions after significant security risks were identified by cybersecurity researchers.

Third-party security assessments of DeepSeek found a wide range of data collection, including confidential and personal information, device data and keystrokes. All data collected is stored in the People’s Republic of China and there are concerns the data is accessed by Chinese state-owned entities, despite DeepSeek’s privacy policy. DeepSeek was also found to be extremely vulnerable to security exploits that could result in data leaks.

Exception – for those using the DeepSeek model locally (installed copy on their workstations/servers) this is an option as no information is transmitted to outside bodies. This option is viable for researchers using AI models for their experiments.   

Alternative to DeepSeek

As an alternative, Copilot by Microsoft is a default feature in the Edge browser and Windows 11, and available to TRU students and employees. 

Just like TRU’s guidance for students and educators, external AI tools:

  • Are not under TRU custody.
  • May store or use data for model training.
  • May store data outside Canada.
  • May disclose information to third parties.

Under Freedom of Information and Protection of Privacy Act (FIPPA):

External AI tools must NEVER receive:

  • Personal Information (information about an identifiable individual, other than business contact information, Identifiable means the individual can be identified, either from the information itself, or in combination with other available information). This includes:
    • Student Information.
    • Employee or HR information (except for employee contact information, which is not personal information).
    • Information about third parties.
    • Payroll, compensation, or benefits data.
    • Workplace investigation or disciplinary materials.
  • Vendor info, contracts, PO numbers, pricing.
  • Internal budgets, forecasts, audits.
  • IT system configuration, logs, credentials.
  • Confidential emails or memos.
  • Privileged information.

External AI tools may only be used for:

  • Fully anonymized content.

Definition from the BC Ministry of Citizens Services Guidance Document: Anonymization is a de-identification process that removes or transforms all direct and indirect identifiers in a record for which there is a reasonable expectation that the identifiers could be used, either alone or with other information, to identify an individual

Information that has been properly anonymized is not personal information for the purposes of Freedom of Information and Protection of Privacy Act (FIPPA).

For guidance on how to properly anonymize personal information, please contact the Privacy and Access Specialist at privacy@tru.ca

  • Generic brainstorming.
  • Non-TRU examples.
  • Template generation or wording help.

TRU’s academic pages emphasize:

  • Critical Evaluation.
  • Bias awareness.
  • Privacy protection.
  • Transparency.
  • Human responsibility.

Administrative staff must follow the same principles

Staff must:

  • Think critically about outputs.
  • Confirm accuracy and completeness.
  • Ensure fairness and avoid bias.
  • Use the minimum amount of data needed.
  • Maintain human decision-making authority.

AI supports your work, it does not replace professional judgement.

Even though Copilot is approved, TRU still expects data minimization, as reflected in academic guidance.

When possible:

  • Use only the parts of a document needed.
  • Remove identifiers not needed for context.
  • Summarize before sending into Copilot.
  • Avoid uploading full datasets unless necessary.
  • Use functional descriptions instead of specific names (e.g., “HR Advisor” instead of a person’s name).

This is consistent across all TRU AI guidance.

Artificial Intelligence cannot:

  • Make decisions affecting employees or students.
  • Replace HR, legal, or financial judgment.
  • Finalize contract interpretations.
  • Conduct workplace investigations.
  • Approve or deny requests.
  • Issue official statements.
  • Generate regulatory interpretations.

Copilot may draft the content — but staff make the decisions.

Administrative staff must ensure AI-generated content:

  • Is retained according to TRU retention schedules.
  • Is not forwarded outside TRU unless approved by PIA/ISA.

AI output is still a University Record

If Personal Information is entered into an unapproved AI systems, report Immediately to:

  • IT Security Office.
  • Privacy & Access Office.

Early reporting is required under the Freedom of Information and Protection of Privacy Act (FIPPA) and TRU policy.

  • Think critically.
  • Validate AI outputs.
  • Protect privacy.
  • Keep data in TRU systems.
  • Maintain human judgment.
  • Use only the minimum necessary data.

Summary

Status

Tools

Approved

Microsoft Copilot — any TRU data, any admin scenario.

Allowed with Restrictions

External AI tools — only anonymized content or general questions (e.g. brainstorming ideas).

Requires PIA

Any non-Copilot tool that uses, stores, or discloses personal information under the care of TRU.

Contact Us

Unsure about the usage of a specific tool or need your process reviewed? Contact privacy@tru.ca and/or InfoSecurity@tru.ca.