By Maria Carrasco, NASFAA Staff Reporter

As more institutions begin to adapt artificial intelligence (AI) tools for their work, NASFAA has set out to review institutions' AI policies, finding that while institutions have AI policies intact, many don’t have specific guidance on how financial aid offices should use the technology for their work, which often involves complex processes and sensitive information. 

As part of a member survey from NASFAA’s Use of AI in the Financial Aid Office Task Force, respondents were able to upload their own institutional AI policies and guidelines, in which NASFAA received 54 documents from 43 institutions. This report is the second in a series of reports, specifically focused on the institutions’ policies and guidelines regarding AI use when the information was collected, in January and February 2026 .  

As this report notes, this study is best understood in light of what institutional AI policies typically are and do, which by design are broad in scope. These institutional policies are not written for individual offices, and rarely name specific roles below broad employee categories such as “staff” or “faculty.”

“The question this scan examines, then, is not whether institutions have tailored their AI policies to financial aid — they have not, and we would not expect them to — but what those broad policies do and do not address, and what that means for financial aid practitioners trying to apply general guidance to a highly specific regulatory context,” the report reads. 

This new report offers eight key takeaways from the submitted documents. 

1. The first is that most of the documents submitted cover practitioners but through broad institutional language rather than role-specific guidance.
   
   For this report, coverage in institutions’ AI policies were coded in three categories: explicit (the AI policy names specific non-faculty roles or employee categories named), implicit (the AI policy names practitioners covered under broad “all employees” or “all community members” language, but not named specifically), and not addressed (the AI policy excludes staff entirely).
   
   Across the 54 submitted documents, 89% of institutions’ policies cover practitioners in some way, the analysis found. However, only 26% of the policies do it explicitly by naming specific roles, and those roles often reflected the broad categories such as “staff,” “employees,” or “administrative staff.”
   
   The report noted that this finding is consistent with how higher education policies generally function.
   
   “The practical implication for financial aid practitioners is that they must interpret and apply general institutional guidance to a work context — federal aid compliance, FERPA, Federal Tax Information requirements, high-stakes student decisions — that the policy was not written to address,” the report notes. 

2. Formal policies are stronger — but make up fewer than half of submitted documents.
   
   Only 22 of the 54 submitted documents, or 41%, are formal, governance-adopted policies, the analysis found.
   
   Notably, among the formal policies, coverage of key provisions is notably stronger: all 22 address disclosure and transparency requirements, 95% address data privacy, 95% name specific approved or prohibited tools, 82% address staff training, and 77% require human oversight of AI outputs. 

3. Internal staff use of AI is more commonly addressed than student-facing applications — though the collection method likely shapes this finding.
   
   The analysis found that 70% of the 54 documents address how staff should use AI in their own administrative work. However, only 52% of policies address AI use in student-facing contexts.
   
   “It is worth noting, however, that because this document set was collected through a survey of financial aid professionals, respondents likely uploaded the policies most relevant to their own administrative work,” the report notes.
   
   So, it is possible that academic integrity frameworks or student-facing AI guidelines exist and were just not submitted for this survey.

4. Data privacy and disclosure are the most consistently addressed provisions; human oversight is less universal.
   
   Among the 54 submitted documents, the most common provisions were data privacy, at 83%, and disclosure requirements, at 80%. Additionally, approved or prohibited tools (61%), staff training (61%), and student data protection (61%) appear in roughly 3 in 5 documents.
   
   However, human oversight – meaning requirements for a human to review AI-generated outputs before use or distribution – is addressed in 57% of documents overall and in 77% of formal policies. 

5. Most documents are restriction-focused, which reflects the nature of institutional policy rather than institutional reluctance.
   
   The analysis found that a majority, 57%, of documents are primarily risk- or restriction-focused, which the report notes is not surprising. These policies are usually created to establish compliance expectations and define the boundaries of acceptable use.
   
   What is notable, the analysis found, is that 15% of submitted documents were balanced in their attention to both risk and use guidance. Very few of the submitted policies offer affirmative and operational direction on how to use AI well.

6.  In this sample, larger institutions were less likely to have submitted formal policies.
   
   The report noted that for institutions with enrollment over 10,000 full-time students in this survey, only 13% submitted a formal AI policy. 

7. How most of these policies were developed is unknown.
   
   This analysis found that 59% of the documents submitted contain no information about how they were created or who approved them within an institution.
   
   However, among the 41% that do have information about how they were created, 20% of them were issued by executive or administrative authority and 17% were issued through a hybrid process involving a working group and executive approval. Only 4% originated from committee or shared governance processes. 

8. Institution-wide AI policies, by design, do not address the specific regulatory context of financial aid work.
   
   Again, the report noted that institutions' AI policies reflect institution-wide governance frameworks that were not designed for any specific office or functional area. So, as a result, these policies do not cover the sensitive and complex information financial aid offices must handle.
   
   "The translation of general institutional guidance into operational practice for financial aid offices is work that, in almost every case, has not yet been done,” the report reads. 

As a reminder, the report notes that the AI landscape is rapidly changing, and these findings are best understood as a snapshot of a moment in time, and the field will continue to develop in the months following publication. 

Already, NASFAA published its first report outlining key findings from its membership survey of 1,233 financial aid professionals at 834 institutions earlier in April, which found that only 54% of financial aid professionals are using this technology in their offices for financial aid work.

Following this report, NASFAA will issue a third report focused on key takeaways about AI use from member listening sessions. From there, the Use of AI in the Financial Aid Office Task Force will use the information gathered across these three reports to inform their final report, which will be submitted to the NASFAA Board of Directors. The final report will be published after it has been reviewed and approved by the NASFAA Board in the summer of 2026.

Publication Date: 5/14/2026

Comments Disclaimer: NASFAA welcomes and encourages readers to comment and engage in respectful conversation about the content posted here. We value thoughtful, polite, and concise comments that reflect a variety of views. Comments are not moderated by NASFAA but are reviewed periodically by staff. Users should not expect real-time responses from NASFAA. To learn more, please view NASFAA’s complete Comments Policy.