How to Govern AI in Your University: A Practical Guide

Why governance matters now

Students use AI to study. Lecturers use it to prepare. Administrators use it to draft letters. Researchers use it to analyse data. Much of this is useful. Some of it creates real risks: to academic integrity, to personal data and to trust in the university's awards.

Leaders cannot simply ban AI. Nor can they leave each department to decide alone. Students would face different rules in every module. Staff would not know what is safe. Nobody would know which tools hold the university's data.

Good governance sits between those extremes. It sets clear rules, helps people follow them and keeps a record that shows the university acted responsibly.

This guide sets out six practical steps. It uses Policy and AI Hub as examples, but the steps apply whatever tools you use.

Step 1: write a policy people can use

Start with a short, plain policy. Cover assessment, teaching, research, administration, personal data and buying new tools. Say what is allowed, what is not and who decides when it is unclear.

Avoid long lists of named tools. They date quickly. Focus on principles and on who approves what. Write for a first-year student and a busy lecturer, not for a lawyer.

Policy's builder walks through these areas and produces a draft. The draft is Ai enabled, so treat it as a starting point. A named policy owner should shape it to fit the university.

Involve students in drafting. Student representatives often know how AI is really being used and where the rules are unclear. A short consultation before the draft goes to Senate makes the policy more realistic and easier to accept.

Step 2: approve it properly

An AI policy should go through the same governance as any other major policy. That usually means Senate. Members should see a one-page summary and the full text, discuss it and approve it formally.

Proper approval gives the policy authority. It also gives the university a record of when the policy was approved and by whom. In Senate, the policy becomes an agenda item with a board paper, a vote and signed minutes.

Plan for review. AI changes fast. Set a review date, perhaps each year, and let the policy owner bring changes back to Senate in between if needed.

Senate members may not be experts in AI. A good board paper explains the main choices in plain terms, sets out the risks of each and recommends a position. The one-page summary helps members focus on the decisions they are asked to make.

Step 3: know what tools are in use

Keep a register of AI tools the university uses or allows. For each one, record its purpose, its owner, what data it handles and who approved it. Give staff a simple way to request a new tool.

The register protects the university. When a regulator or a journalist asks which tools hold student data, there is an answer. When a tool causes a problem, you know who owns it.

Decide also how AI is paid for. Oxonia lets universities use a shared AI credit wallet or their own AI keys, and either choice is recorded.

Make requests easy. If asking for approval is slow or unclear, staff will simply use tools without asking. A quick, fair process brings use into the open, where it can be managed.

Step 4: train staff and students

Rules only work if people understand them. Give staff short AI literacy training and keep proof of completion. Policy issues checkable certificates, so a head of department can see who has trained.

Give students short lessons too, built around real study tasks. Let them ask questions about the policy and get answers that cite the clause. AI Hub does this, answering only from the policy Senate approved.

• Short training for all staff, with certificates
• Practical lessons for students
• A place to ask questions and get cited answers
• Clear contacts for questions the policy does not cover

Step 5: set clear rules for assessment

Assessment is where AI raises the sharpest questions. For each assessment, the lecturer should state what AI use is allowed. Students should declare what they used when they submit. Declarations should be stored with the work.

Keep the options simple, such as none, planning only, or allowed with declaration. Make sure integrity concerns go to a person and follow the normal procedure. Tools that flag concerns, such as integrity flags in Mark, should never decide misconduct on their own.

Be consistent across a programme. If one module allows AI for planning and the next forbids it, explain why. Students accept different rules when they understand the reason for each one.

Step 6: measure, report and improve

Track progress with a few simple measures: policy approved, register complete, share of staff trained, declarations in use, incidents recorded and closed. Policy combines these into a readiness score.

Record incidents when things go wrong, and learn from them. Keep the evidence in one place, ready for auditors and regulators. Show leaders the picture in Compass, and add AI to the risk register if it belongs there.

Policy costs £9,500 a year for up to 5,000 students and includes AI Hub. It is part of Oxonia Lead. See pricing.

Report to Council at least once a year on AI governance. Show the readiness score, the main incidents, what was learned and what will change. Regular reporting keeps the topic on the leadership agenda and shows regulators that governance is active, not a one-off exercise.

Products in this article

Questions people ask