An AI assistant can answer many of the routine questions students ask from pages your university already publishes. Before one answers your students, check five things: what it reads, what it is allowed to do, what it hands to your staff, how its mistakes show, and what happens to the data in the conversation.

1. What it reads

An assistant that answers from the open web will answer with whatever it finds. One that answers from a set of sources your staff approve can be held to them: the pages, systems and guides you choose, each of which you can switch off. Ask the supplier whether every answer shows the sources it used, so a student can check the original.

2. What it is allowed to do

Answering a question is one thing; booking a room, reporting a fault or setting a reminder is another. Ask whether the assistant can act at all, and if it can, whether it asks the student to confirm before it does. A confirmation step keeps the student in charge of anything done in their name.

3. What it hands to your staff

Some subjects belong with people. Decide before launch which topics the assistant should refer to your staff and point to the right service, for example:

  • marks and grades;
  • attendance, including attendance that affects a student visa;
  • payments and debts;
  • anything about a student’s personal circumstances.

Wellbeing and harassment need particular care. In England, condition E6 expects a single published source that sets out how to report harassment, so an assistant should send students to your official route rather than take a report itself. Our post on condition E6 covers what the route must include.

4. How mistakes show

AI can make mistakes, and no supplier can promise otherwise. What you can ask for is that mistakes are visible and correctable: sources shown with each answer, a record of the questions asked so your staff can spot gaps and errors, and a way to fix the source page when the answer was wrong because the page was.

5. What happens to the data

  • A DPIA. The ICO says a data protection impact assessment is required where processing uses “innovative technologies, or the novel application of existing technologies (including AI)” combined with at least one other high-risk criterion from the European guidelines, and recommends one “if in any doubt”. Plan for one.
  • Telling students. The ICO’s guidance on AI says that where you collect data from people directly, they should get privacy information “at the time you collect it, before you use it to train a model or apply that model on those individuals”. Put it in the app before the assistant is used.
  • Training. Ask whether conversations or other student data are used to train any model, the supplier’s or a third party’s, and get the answer in the contract. The ICO’s response on generative AI says reusing personal data to train a generative AI model raises the question of whether that purpose “is compatible with their original purpose of collecting that data”.

Questions for the supplier

  1. What does the assistant answer from, and can we switch each source on and off?
  2. Does each answer show its sources?
  3. Can it act, and does it ask the student to confirm first?
  4. Which topics does it refer to staff, and can we change the list?
  5. Can our staff see what students ask?
  6. Is any student data used to train a model, and where does the contract say so?
  7. Where is the conversation data processed and stored, and for how long?

How the Varsio assistant works

Varsio’s assistant, which a university’s pilot launches with, answers from the pages and systems you approve, shows the sources it used, and asks the student to confirm before it books or reports anything. It is set up to refer marks, attendance, visa attendance, payments and anything personal to your staff, and “Never trained on student data.” is a term in our data processing agreement. The pilot’s DPIA pack will name the model the assistant runs on and where it is processed. How the assistant works has the detail.