How to Run an AI Governance Gap Analysis for a University in 30 Days

Why Universities Need a Structured Gap Analysis

Universities are adopting AI tools and agents across research, administration, and student services faster than governance structures can track them. Unlike a single enterprise IT environment, higher education institutions typically operate with central IT, department-level IT, and independently funded research computing groups, each capable of procuring or building AI systems without a shared system of record. This structural decentralization, documented by EDUCAUSE as a distinguishing challenge for higher-education AI governance, means written AI use policies frequently do not reflect what is actually running in production. A gap analysis closes that visibility distance: it establishes what AI systems and agents exist, evaluates whether governance controls match an accepted risk framework, and separates documented policy from actual runtime enforcement.

Because most institutions cannot restructure an entire AI governance function within a single budget cycle, the value of a 30-day gap analysis is not a completed governance program. It is a defensible, prioritized picture of where AI-related privacy, compliance, and operational risk is concentrated, structured to enter the university's existing decision-making cycles.

A 30-Day Methodology

1. Week 1: Scope and Inventory. Identify stakeholders across central IT, research computing, compliance/legal, and academic departments. Combine structured interviews with technical discovery, such as procurement records and API-level scans, to inventory AI tools, embedded vendor AI features, and autonomous agents, including where MCP or similar protocols connect agents to external tools and data.
2. Week 2: Governance Maturity Assessment. Score each inventoried system against an established framework, such as NIST AI RMF's Govern, Map, Measure, and Manage functions, rather than an ad hoc rubric. Apply scoring consistently across departments, accounting for differences in funding, oversight, and compliance obligations between research computing and central IT.
3. Week 3: Enforcement and Technical Gap Analysis. Distinguish documented policy from technical enforcement at runtime. Verify whether access controls, logging, monitoring, and policy checks exist at the point of AI system execution rather than only in procurement or policy documentation, with particular attention to agent-to-tool integrations.
4. Week 4: Roadmap and Prioritization. Prioritize findings by data sensitivity, starting with systems processing FERPA-covered student records, and by deployment scope. Sequence remediation actions against the university's existing budget approval and governance committee cycles.

Scoping AI Systems and Agents Across a Decentralized Institution

Scoping is the most consequential phase because an incomplete inventory undermines every subsequent step. University AI environments typically include three overlapping categories: AI features embedded within existing vendor platforms such as learning management or admissions software, standalone generative AI tools adopted by departments or individual researchers, and AI agents with direct tool or API access that can act autonomously within a workflow. No single system of record captures all three, and shadow AI usage, meaning tools adopted outside formal procurement, is a recognized visibility gap in decentralized institutions per EDUCAUSE materials.

Effective scoping treats research computing as a distinct domain rather than folding it into a single inventory pass. Research systems are often funded through external grants and governed by data-handling requirements tied to that funding, which can differ materially from institutional IT policy. Data flows involving FERPA-protected student education records should be mapped separately from research or operational data, since privacy obligations attach specifically to that category regardless of which department operates the system.

Where AI agents connect to external tools or data sources using protocols such as the Model Context Protocol, published by Anthropic in November 2024, scoping should explicitly capture these integration points. Agent-to-tool connections expand system access beyond conventional application boundaries and are less likely to appear in traditional procurement or network inventories.

Assessing Governance Maturity Against an Established Framework

Once systems are scoped, each should be evaluated against a defined maturity criteria set rather than a subjective checklist. NIST's AI Risk Management Framework, organized around the Govern, Map, Measure, and Manage functions, provides a general-purpose baseline that applies to higher education without modification, and its companion Generative AI Profile addresses risks specific to generative AI systems that make up a large share of university deployments. Using an established framework, rather than an internally constructed rubric, supports defensibility if findings are later reviewed by a governance committee, general counsel, or an external auditor.

Maturity scoring should be applied consistently across departments so comparisons remain meaningful. This is where decentralized ownership introduces friction: a maturity score for a centrally managed administrative system is not directly comparable to a grant-funded research tool unless the assessment accounts for differences in funding, oversight, and compliance obligations. Institutions with international students, staff, or research partnerships should also note where EU AI Act obligations may apply depending on the location and scope of data processed, since that Act establishes risk-tiered obligations with phased compliance timelines that can extend beyond U.S. federal frameworks such as OMB M-24-10.

Structuring a Prioritized Remediation Roadmap

Findings from a 30-day gap analysis should be organized into a roadmap sequenced by risk and by the institution's ability to act, not by department size or political visibility. Data sensitivity is the first sorting criterion: systems processing FERPA-covered student records or other regulated data should be addressed ahead of lower-sensitivity pilot deployments. Deployment scope is the second criterion: an institution-wide administrative system carries different remediation urgency than a single-lab research tool, independent of which department raised it.

Because most universities cannot approve funding or policy changes outside standard governance committee and budget cycles, the roadmap should map each remediation item to the next applicable approval window rather than treating all findings as immediately actionable. This typically separates recommendations into three categories: policy clarifications that can be issued administratively, technical enforcement gaps that require budget or IT resourcing, and structural gaps, such as unclear escalation paths between departmental and central authority, that require governance committee action.

Where the analysis identifies written policy without corresponding runtime enforcement, particularly around agent-to-tool connections and permissioning, the remediation plan should specify runtime controls as a distinct category of work. Runtime governance capabilities such as agent identity, least-privilege permissioning, tool approval workflows, and audit logging at the point of execution address this specific category of gap. Where such tooling is introduced, it should be scoped as one component of the broader remediation plan, not a substitute for the governance and policy work identified earlier in the assessment.