Software and AI Procurement Guidelines

The purpose of this guideline is to provide members of the Bryant University community with a simple, clear, and structured process for procuring all new and recurring software and artificial intelligence (AI) technology. The core objectives are to enhance administrative efficiency, ensure technical justification, institutionalize leadership approvals, guarantee information security compliance, and maximize the value of all software procurement contracts.

This guideline is applicable to:

• Any digital application that requires an operational license, contains or processes institutional data, is made available for university use, is installed locally on an institutional device, or is accessible via cloud architectures or web browsers.
• All software purchases, standard renewals, multi-year subscriptions, and free digital utilities.
• All artificial intelligence technologies, including Generative AI models (such as standalone chatbots and enterprise copilots), AI-enabled Software-as-a-Service (SaaS) platforms, machine learning toolsets, and embedded AI features within pre-existing enterprise applications.

To manage and govern technology investments, the university will establish the Software Procurement Committee (SPC). The SPC consists of:

• Business Systems Representative
• Information Security and Infrastructure Representative
• Academic Computing and Technology Representative
• Institutional Research Representative

For every software procurement request, a division/department head must be designated as the Project Sponsor. The Project Sponsor will be responsible for the implementation, provide leadership, training, and answer for the utilization and regulatory compliance of the tool. The SPC serves solely in an advisory capacity by recommending best practices and identifying training needs during the procurement review.

Any new software system integrated with a university core system will undergo a technical review from the University Business Systems and Information Services departments. This review assesses the architecture, technical compatibility, security controls, and long-term maintenance impact of the integration. University core enterprise data systems include, but are not limited to: Ellucian Banner, Canvas, Snowflake, Microsoft enterprise ecosystems, and Raiser's Edge.

All university software procurement requests will follow this process:

• Step 1: Intake Submission: The requesting department (sponsor) must complete and submit an online Software/AI Tool Procurement Form.
• Step 2: Division Head Support: The Division Head must “Support” the department’s request before the Software Procurement Committee initiates the review.
• Step 3: Technical Triage & Classification: the SPC reviews the intake request and routes the application into one of two processing tracks:
  • Track One (Simple Purchase Workflow): If the procurement is classified as a simple purchase (defined as a non-core system integration and no access to protected student, personnel or financial data), a quick review is conducted and the request together with SPC’s recommendation are routed to the Division Head for final approval.
  • Track Two (Complex Purchase Workflow): If the procurement is classified as a complex purchase (defined as platforms requiring data integration, hosting confidential data, or incorporating artificial intelligence features), SPC conducts detailed analysis and technical assessment. 
• Step 4: Software Procurement Committee (SPC) Evaluation: The SPC reviews the technical, data, university-wide integration, and security risk profiles. The committee may recommend approval, denial, or modifications to the procurement and integration plan.
• Step 5: Division Head: Following SPC recommendation, complex purchases are advanced to the Division Head for final approval. If the Division Head’s position is not aligned with an SPC recommendation—specifically when a Division Head wishes to approve a software purchase that the SPC has recommended for denial or modification due to security or integration risks—the request will be escalated to the Chief Information Officer and President for final decision. Procurement may proceed once the President approves the purchase, overruling the SPC recommendation. Conversely, if the President sustains the SPC recommendation for denial, the process concludes with no purchase.
• Step 6: Implementation and Monitoring: Upon approval, Information Services and the Project Sponsor deploy the software according to the approved implementation plan. The software is recorded in the Configuration Management Database (CMDB), including vendor details, support contact information, and the designated local system administrator.

To optimize software investments and mitigate risk, SPC recommends the integration of training into the post-approval implementation process:

• Approver Training: Training for divisional heads and budget managers regarding data risk recognition, total cost of ownership models, and procurement guideline compliance.
• User Training: Instructional modules for all operational staff and end-users regarding security, feature utilization, and proper artificial intelligence prompt uses.
• Succession Planning: The creation of technical and operational documentation by each department. Departments must train designated successors to ensure complete operational continuity when staff members transition out of the university.
• Cross-Departmental Training: Inter-departmental instructional workshops to leverage shared platform capabilities, break down administrative silos, and prevent redundant localized software configurations.

The SPC is not directly engaged in the development, delivery, administration, or funding of any training programs. Individual requesting departments and division heads are responsible for executing the training plans outlined below.