The University of Chicago developed a GenAI platform for academic, operational, and research workflows involving sensitive data including research health information. As the platform prepared for broader institutional adoption, the university needed independent validation of its internal security and compliance assessment — benchmarked against ISO 42001, NIST AI RMF, and NIST 800-171.
Propelex conducted an independent validation of the university's internal GenAI security review — deepening the evaluation with multi-framework gap analysis across AI governance, lifecycle management, cloud shared responsibility, DLP, trustworthiness monitoring, and AI-specific penetration testing requirements not addressed by traditional cybersecurity frameworks.
Generative AI is entering academic institutions faster than the governance frameworks needed to manage it responsibly. Universities face a distinctive challenge: they are simultaneously deploying AI to support sensitive research involving protected health information, navigating HIPAA and federal compliance obligations, and operating in an environment where AI adoption is driven by faculty and research teams rather than top-down IT governance. Traditional cybersecurity frameworks were not designed for this reality.
The University of Chicago engaged Propelex to independently validate its internal GenAI platform security and compliance assessment — broadening the evaluation beyond HIPAA-aligned controls to benchmark the platform against ISO/IEC 42001, NIST AI RMF 1.0, and NIST SP 800-171, and identify the AI-specific governance gaps that traditional frameworks consistently miss.
The University of Chicago’s Information Assurance team conducted a structured internal assessment of their GenAI platform before broader institutional rollout — a three-pass review combining documentation review and hands-on validation, focused primarily on HIPAA safeguards, institutional software security requirements, and NIST SP 800-66 considerations.
Rather than duplicating that work, Propelex was engaged to do something more valuable: independently validate its completeness, benchmark it against frameworks the internal team had not evaluated, and identify the AI-specific risks that traditional security assessments are structurally unable to see. The platform handles research health information and is being deployed across academic, operational, and research workflows — making both the compliance obligations and the reputational stakes significant.
Propelex’s independent review confirmed that the University had built a genuinely strong security foundation — not a checkbox compliance exercise, but a substantive assessment with real methodology:
These strengths are not trivial. Many institutions deploying AI have neither the internal security capability nor the commitment to responsible deployment that the University of Chicago demonstrated. The gaps Propelex identified were not failures of effort — they were the predictable result of applying frameworks designed for traditional IT systems to a technology category that requires fundamentally different governance.
Propelex’s multi-framework analysis identified seven high-risk gaps not addressed by the internal assessment:
HIPAA, NIST SP 800-66, and traditional cybersecurity frameworks address data confidentiality, integrity, and availability — the classic security triad. GenAI introduces additional risk categories that these frameworks were not designed to address: model drift, prompt injection, sensitive data leakage through inference, bias and inappropriate outputs, and the operational implications of AI behavior changes that are not analogous to traditional software updates.
Traditional cloud shared responsibility models are well-understood: the provider secures the infrastructure, the customer secures what they build on top of it. AI-as-a-service complicates this significantly — data submitted to a cloud AI service may be retained, used for training, encrypted with provider-managed keys, or processed in ways that the standard enterprise cloud security framework does not address. Every institution deploying cloud AI needs an explicit, documented understanding of where the shared responsibility boundary sits for their specific use case.
The GenAI platform was evaluated against HIPAA, NIST SP 800-66, ISO/IEC 42001, NIST AI RMF 1.0, and NIST SP 800-171 in a single integrated assessment — producing a unified gap analysis rather than five separate compliance exercises.
Every identified gap was connected to a specific risk consequence and prioritized against the platform’s deployment timeline — giving the University a clear, actionable remediation sequence rather than an undifferentiated list of findings.
With the identified gaps addressed, the GenAI platform will have the governance structures, observability tools, and lifecycle controls needed to support sensitive academic and research workloads responsibly — giving the University confidence in broader institutional rollout.
Propelex’s engagement positions the University of Chicago’s GenAI platform as a model for secure and responsible AI adoption in higher education — demonstrating that institutional AI deployment can be both academically enabling and rigorously governed.
Generative AI in research universities is not a future consideration — it is an immediate operational reality. Researchers are using it now, often ahead of governance frameworks that can manage the associated risks. The question for institutions is not whether to deploy GenAI but how to deploy it in a way that protects sensitive research data, satisfies compliance obligations, and maintains the institutional trust that academic credibility depends on.
The University of Chicago’s approach — strong internal assessment followed by independent expert validation against AI-specific frameworks — is the right model. It acknowledges that traditional security expertise, however strong, needs to be supplemented by AI governance expertise that addresses the novel risk categories that generative AI introduces. Propelex will continue partnering with the University to mature their AI governance program, enhance lifecycle and testing rigor, and prepare for the evolving regulatory requirements that will govern AI in research and education.
Propelex confirmed strong foundational security controls while identifying seven high-risk gaps in AI governance, SDLC, DLP, cloud responsibility boundaries, and trustworthiness monitoring — producing a prioritized roadmap that positions the GenAI platform as a model for secure and responsible AI adoption in the education sector.
Penetration Testing
A major metropolitan transit authority had no unified visibility across its OT environment — legacy firmware,…
Managed Firewall Services
A rapidly scaling SaaS startup had fragmented firewall rules, wide-open cloud policies, and no centralized governance…
Privacy & Compliance
A drone technology startup collecting sensitive operational and customer data needed Privacy by Design embedded into…
