Three ways universities govern AI
A working taxonomy distilled from the policies we've audited. Not a final theory — a pilot framework, published so it can be argued with.
What this is: a pilot classification based on the policy documents examined during our Global University AI Policy Audit 2026 (186 universities, 144 with published policies). What it isn't: a coded content analysis of every policy — full classification of all 144 documents is in progress. Archetypes describe dominant patterns, not pure types; most institutions blend two or all three. If a policy we cite contradicts its archetype, tell us — corrections are published with attribution per our independence charter.
Syllabus-Delegated
Instructor discretion + mandatory disclosure
The institution sets a floor — typically a disclosure requirement and an academic-integrity backstop — and delegates the actual rules to individual instructors via their syllabi. The university governs the principle; the classroom governs the practice.
- Central policy is short; syllabi carry the detail
- Disclosure of AI use is the non-negotiable core
- Faculty development resources accompany the delegation
+ Adapts fast to disciplinary differences; respects academic freedom; low administrative overhead.
− Wildly inconsistent student experience across courses; disclosure without guidance becomes box-ticking; adjunct faculty left to improvise.
- Stanford University — Publishes template syllabus statements (permit / restrict variants) and lets each instructor choose — the archetype in its purest form. POLICY↗
- University of British Columbia — Senate Policy V-130 requires every course syllabus to carry a GenAI statement; the centre provides the templates, instructors fill them in. POLICY↗
- Columbia University — Provost-level policy sets student rules and data-privacy lines, but explicitly expects faculty to write their own syllabus guidance. POLICY↗
// Cases drawn from the AI Policy Audit 2026 dataset (186 universities).
Traffic-Light
Tiered permitted-use matrix
The institution publishes an explicit red / amber / green matrix: green zone (brainstorming, language polish), amber zone (permitted with conditions — e.g. coding assistance with attribution), red zone (contract cheating, undeclared exam use). One document, legible to every student.
- Single authoritative matrix, often one page
- Tied directly to the academic-misconduct code
- Frequently translated into multiple languages
+ Maximum clarity for students; easy to communicate at orientation; enforceable because it is specific.
− Brittle — new AI capabilities obsolete the zones; tends to be written for text and ignore code, image, and agentic tools; can read as prohibition-first.
- University College Dublin — Red / amber / green per-assignment AI-use levels written directly into the Academic Integrity Policy — the matrix is the rule. POLICY↗
- Queen Mary, University of London — Three-tier traffic-light assessment badging across all modules, paired with an approved-tools list including QM Copilot. POLICY↗
- University College London — Departments apply a tiered model from restrictive to permissive; the library guidance standardises how GenAI use is acknowledged. POLICY↗
// Cases drawn from the AI Policy Audit 2026 dataset (186 universities).
Institutional Provisioning
Governance through provided tooling
The university doesn’t just regulate AI — it provides it: campus-wide licenses for privacy-preserving models (e.g. ASU + ChatGPT Edu), or self-hosted deployments (e.g. Michigan’s in-house tools). Policy follows the tool: because the institution controls the data boundary, it can permit more.
- Enterprise or self-hosted model deployment
- Data-privacy guarantees as the policy foundation
- Training and prompt libraries bundled with access
+ Solves the privacy objection structurally, not rhetorically; equity — every student gets the frontier model, not just subscribers; usage data informs future policy.
− Expensive and vendor-dependent; smaller institutions cannot replicate it (see Dispatch #01); single-vendor lock-in becomes a governance risk of its own.
- University of Michigan–Ann Arbor — Self-hosted U-M GPT and U-M Maizey since 2023 — the institution controls the data boundary, so its policy can permit more. POLICY↗
- MIT — IS&T maintains a licensed-tool matrix with data-risk rules: governance expressed as which tools are provisioned, not just what is forbidden. POLICY↗
- Princeton University — Formal Generative AI Tools Use Policy: only licensed tools may touch non-public university data — provisioning as the enforcement mechanism. POLICY↗
// Cases drawn from the AI Policy Audit 2026 dataset (186 universities).
Help refine it
This taxonomy gets better with counterexamples. If your institution's policy breaks these archetypes — or blends them in a way we haven't described — send it to [email protected]. The v1.0 release will include a coded classification of all 144 published policies.