Not every AI tool is high-risk. If an automated system helps make a consequential decision about a person, it is considered high-risk.
Contact Information Security About a High-Risk ADS
A system may qualify as “high-risk” when it produces an automated output that assists or replaces human discretion in a decision with a meaningful effect on a person.
Look for outputs such as: a score, classification, ranking, recommendation, prediction, or similar simplified result used in a significant decision.
"Legal or Similarly Significant" university decision.
Admission, enrollment, program eligibility, academic progression, degree or certificate eligibility, or academic-integrity and disciplinary determinations when an automated score or classification materially influences the outcome.
Ranking applicants, deciding who advances to interviews, hiring, promotion, performance-related actions, discipline, or termination when an automated recommendation materially influences the decision.
Financial aid or other benefits, campus housing or accommodations, health-care access, credit, or another service where an automated output materially affects approval or access.
CDT examples include AI recommending approval or denial of benefits, generative AI ranking resumes where the score determines advancement, and statistical-model identity matches used to support arrest-warrant decisions.
California Government Code § 11546.45.5, enacted through AB 302 (2023), created a statewide inventory and annual legislative reporting requirement for High-Risk ADS.
The statute expressly includes the California State University within the definition of a “State agency” for this reporting requirement.
The inventory covers High-Risk ADS proposed for use, development, or procurement, as well as systems already being used, developed, or procured.
The California Department of Technology reports the comprehensive inventory to specified legislative committees beginning January 1, 2025 and annually thereafter.
For each system, the inventory includes the supported decision, intended benefits and alternatives, relevant research, categories of data and personal information used, and risk-mitigation measures such as cybersecurity, privacy, accuracy and bias controls, audits, and ways to contest a decision.
Chico State faculty and staff should contact the Information Security and Identity Management Office about institutionally adopted or centrally supported artificial intelligence (AI) or automated decision-making systems used to assist or replace human discretion.
Reporting does not mean the technology is prohibited. The purpose is to identify, assess, and inventory qualifying systems so CSU can meet its legal reporting obligations.
AB 302 identifies common technologies that are excluded from the ADS definition for this reporting purpose. Routine infrastructure or data-management technology does not, by itself, make a campus activity a High-Risk ADS.
The key distinction is whether the technology actually functions as an automated decision system by producing a score, classification, recommendation, or similar output used in a significant decision.
Chico State must identify campus use so qualifying systems can be reported through the CSU Chancellor’s Office and incorporated into the CSU’s systemwide inventory.
Faculty and staff should report systems that may use automated scoring, ranking, classification, prediction, or recommendations to influence consequential decisions about students, applicants, employees, or other people.
When in doubt, report or ask. It is better to raise a potential use case before deploying or relying on the system for a consequential decision.
Main Office
isec@csuchico.edu
530-898-6520
Chris Witthans
Information Security Officer
cwitthans@csuchico.edu
530-898-5615