University / LMS 7 min read · July 30, 2025

How to set up an AI policy for your university before your IT department does it wrong

Most university AI policies are written by committees that don't use AI tools day-to-day. The result is either a blanket ban that faculty ignore, or a vague "use responsibly" statement that provides no actual guidance. Here's what a practical policy looks like — and the infrastructure that makes it enforceable.

Universities are in a difficult position. Students are already using ChatGPT, Claude, and Gemini — with or without institutional approval. Faculty are split between enthusiastic adoption and deep concern about academic integrity. IT departments are worried about data privacy and vendor contracts. And administrators are trying to write policies for technology they don't fully understand.

The window to get ahead of this is closing. Here's how to build a policy that actually works.

The two failure modes to avoid

Most university AI policies fail in one of two ways:

The blanket ban: "Students may not use AI tools for any assessed work." This is unenforceable, drives usage underground, and puts your institution behind every peer institution that's teaching students to use AI effectively. It also ignores the reality that AI literacy is now a graduate employability skill.

The vague permission: "AI tools may be used responsibly with appropriate disclosure." This provides no guidance on what "responsibly" means, no infrastructure to support it, and no way to ensure equitable access — students who can afford ChatGPT Plus have a different experience than those who can't.

The right approach is a structured framework with clear rules, institutional infrastructure, and per-course flexibility for faculty.

The four-tier access model

A practical university AI policy defines four tiers of AI use, and faculty declare which tier applies to each assessment:

AI-free: No AI tools permitted. Used for foundational assessments where the learning objective is the process, not the output (e.g. first-year writing, core maths proofs).
AI-assisted research only: Students may use AI for literature search, summarisation, and background research — but not for drafting or editing submitted work. Must be disclosed.
AI-assisted with disclosure: AI may be used for any part of the work, but students must document how it was used and critically evaluate its outputs. The student is responsible for accuracy.
AI-native: The assessment is explicitly designed around AI use. Students are evaluated on their ability to prompt effectively, evaluate outputs, and iterate — not on producing AI-free work.

This framework gives faculty control without requiring a blanket institutional position. It also gives students clear expectations for each piece of work.

The data privacy problem you can't ignore

When students use consumer AI tools (ChatGPT, Claude.ai) for coursework, they're sending potentially sensitive data to third-party servers under terms of service that weren't designed for educational use. This creates real problems:

Student work submitted to commercial AI providers may be used for model training
Research data, unpublished findings, and confidential case studies can end up in training sets
FERPA compliance becomes murky when student data flows through third-party systems
Students in some jurisdictions may be violating GDPR by using US-based AI services for coursework

The solution is institutional AI infrastructure — a platform your university controls, running on your own cloud account, where data doesn't leave your environment. This isn't just a compliance checkbox; it's what allows you to give students access to frontier models without the privacy risk.

Equitable access is a policy requirement, not a nice-to-have

If your AI policy permits AI use but doesn't provide institutional access, you've created a two-tier system: students who pay for premium AI subscriptions and students who don't. This is an equity problem that will surface in grade distributions and student complaints.

Institutional AI access means every enrolled student gets the same tools, the same model quality, and the same usage limits — regardless of their personal financial situation. This is the same reason universities provide library access and computing labs rather than telling students to buy their own books and laptops.

What the infrastructure needs to support

A university AI platform needs to handle things that consumer tools don't:

SSO integration: Students log in with their university credentials. No separate account creation, no personal email required.
Per-student usage quotas: Fair allocation of compute resources. Heavy users don't crowd out everyone else.
Course-level access controls: Faculty can restrict which models are available for a specific course or assessment period.
Usage logging: For academic integrity investigations, you need to be able to show what a student queried and when — not the content of the queries, but the metadata.
Notebook environment: For STEM courses, students need a Jupyter environment alongside the AI playground — not two separate tools.
Data residency: The platform runs in your cloud account, in your chosen region. Student data doesn't leave your environment.

Getting faculty buy-in

The biggest implementation risk isn't technical — it's faculty adoption. A few things that help:

Involve faculty in the policy design, not just the rollout. The four-tier model above works because faculty have genuine control over how it applies to their courses.
Run a pilot with enthusiastic early adopters before the full rollout. Let them develop use cases and share them with colleagues.
Provide concrete examples of AI-native assessments for different disciplines. Abstract permission to use AI doesn't help a history professor redesign their essay prompts.
Address the academic integrity concern directly: the goal isn't to catch AI use, it's to design assessments where AI use is either permitted and disclosed, or genuinely impossible.

A department head at a mid-sized university told us: "We spent six months writing a policy and zero months building the infrastructure to support it. Students were using ChatGPT anyway, but now they were doing it in violation of policy rather than within a framework we controlled."

The timeline that works

Based on what we've seen work at similar institutions:

Month 1: Form a working group with faculty, IT, and student representatives. Draft the four-tier framework. Identify 3–5 pilot courses.
Month 2: Deploy institutional AI infrastructure. Run pilot courses. Gather feedback.
Month 3: Revise policy based on pilot learnings. Train faculty on the platform and the framework.
Semester 2: Full rollout. All students have access. All assessments declare their AI tier.

Lab Maneuver deploys in under a day — SSO integration, per-user quotas, JupyterHub, and the model playground — into your own AWS account. Your IT team owns the infrastructure; we handle the complexity of setting it up.

Building your university's AI infrastructure?

We'll set up a multi-user AI platform in your AWS account — JupyterHub, model playground, and cost controls — in under 4 hours.

Talk to Us →