Write an Institutional AI Policy People Follow

Institutional AI policies fail in two recognisable ways. The blanket ban is ignored within a month, teaches concealment, and leaves staff with no guidance for the cases that matter. The forty-page document with a governance framework is never read past the summary, and the teacher facing a student's question at eleven at night is exactly as unsupported as before.

A policy that works is short, answers real questions, and pushes the task-level decisions to the people who understand the task.

Scope it around the questions people ask

Write the policy against the questions that actually arrive, not around a topic taxonomy.

"Can students use AI for this assignment?" — answered per assignment by the instructor, within a framework the policy provides.

"What must be disclosed?" — answered centrally, because consistency matters and students should not track five conventions.

"What can staff use it for?" — grading, feedback, reference writing, and admissions each need an explicit position, and staff use is where the highest-stakes decisions live.

"Which tools are approved?" — answered centrally, because it depends on contracts and data review that individuals cannot do.

"What happens when someone breaches the policy?" — a process, with proportion and an appeal.

"Who decides the unclear cases?" — a named role, because unanswered questions default to whoever is least equipped to answer them.

Two pages covering these beats forty pages covering everything.

Put each decision where the knowledge is

Centrally: tool approval and data agreements, the disclosure standard, staff use of AI in consequential decisions, the breach process, and the position on detection tools. These require contracts, legal input, and consistency.

At department level: what AI use is appropriate for this discipline. The answer differs genuinely between a programming course, a creative writing course, and a clinical placement, and pretending otherwise produces a policy that is wrong for most of them.

At instructor level: the per-assignment rule, because only the instructor knows which skill is being assessed. This is the decision that must be delegated — a central rule cannot know whether drafting is the target skill or a shortcut around it.

With the student: disclosing what they used, within the standard.

Give instructors a short menu rather than a blank page. Three or four named levels — no AI use; AI permitted for specified support tasks with disclosure; AI permitted throughout with disclosure and a defence of the work; AI use required and evaluated — let an instructor pick a level per assignment and paste one line into the brief. Adoption of a menu is far higher than adoption of a principle.

Make enforcement proportionate and appealable

Two commitments belong in the policy in writing.

Detector output is not evidence. State it explicitly. These tools are unreliable, their false positives fall disproportionately on non-native writers, and a student cannot disprove a probability. A policy that permits acting on a score will produce an injustice, and it will be one the institution cannot defend.

The process is graduated. A first ambiguous case is a conversation, not a disciplinary matter. Escalation should require evidence of the kind the policy names — inconsistency with prior work, inability to discuss the submission, admission — and every stage should be appealable.

Also state what happens to a student who discloses use that turned out to be outside the rule. If disclosure is punished as severely as concealment, the policy has just taught concealment.

Set a review cadence and name an owner

A policy written this year will be wrong next year: capabilities move, regulation moves, and the practices students arrive with move.

Name an owner, set a review interval short enough to matter — annually at minimum, with a lighter check each term — and define the triggers that force an early review: a new regulatory obligation, a significant capability shift, a vendor incident, or a pattern of cases the policy did not anticipate.

Track a small number of signals rather than assuming compliance: how many instructors are using each level of the menu, how many breach cases arose and how they resolved, and what questions keep escalating. Repeated escalations of the same question are a gap in the policy, not a failure of the people asking.

Publish the version and the date on the document itself. An undated policy is one nobody can tell whether to trust.

Practice

Write the two-page version first, before any consultation. Constrain yourself to the six questions above.

Then test it: give it to three people — an instructor, a student, and someone in a support role — and ask each to answer a realistic scenario using only the document. Where they cannot, or where they disagree, the policy is incomplete at exactly that point.

Fix those points and only then circulate more widely. A policy tested against real scenarios by three people is better than one reviewed by thirty.

Common mistakes

The blanket ban. Ignored, teaches concealment, and useless as guidance.

Centralising the per-assignment decision. Only the instructor knows which skill is being assessed.

Permitting action on detector scores. It produces indefensible outcomes and damages trust everywhere else.

No owner and no review date. The policy silently becomes wrong, and nobody is responsible for noticing.