Non-institutional technologies include external or third-party technologies that are not officially sanctioned or supported by higher education institutions (HEIs) but may be used by staff for educational purposes. These include free, open-source and open-access technologies such as social media sites, apps and online services. The literature identifies a number of risks and ethical considerations when using digital technologies, such as security, safety, privacy and legal compliance (Common Sense n.d.). This study analyses institutional artefacts, including policy and guidance documents, to explore how institutions are addressing the risks of educational technologies identified throughout the literature. Critical discourse analysis was conducted on nine artefacts, obtained from seven UK HEIs. The study found that institutional policies and guidance documents do not sufficiently address some of the key risks identified in the literature (e.g. security risks), nor consider the ethical issues emerging from the use of profit-making educational products. Users of these technologies (including teaching staff) are assigned a broad range of complex and potentially time-consuming responsibilities concerning the evaluation, selection and operation of these technologies. For example, to ensure compliance with data protection legislation, however, no artefact stated how this should be achieved. The study therefore identifies significant inadequacies in institutional policies and guidelines, and questions whether appropriate quality assurance processes and safeguards are in place when non-institutional technologies are used for higher education.