How Top Universities Actually Regulate Generative AI

Wed, 22 Jul 2026 09:00:00 +0000

Key points

A 2026 survey of the Times Higher Education top-20 research universities' published generative-AI policies found no single model: institutions sit along a spectrum from discouraging AI outright in specific contexts to permitting it broadly with disclosure conditions attached.
The clearest pattern is task-specific permission rather than a blanket rule: personal study and early drafting are usually allowed by default, while assessed work, examinations, theses and grant materials typically require explicit permission at course, department or institutional level.
Policies lean on disclosure, permission-seeking and human accountability rather than on AI-text detectors, which have well-documented false-positive problems.
Large gaps remain: most published policies say little about detection-tool use by staff, or about how AI use by staff themselves (marking support, feedback drafting, administration) should be governed.
A mid-tier institution does not need Princeton's resources to copy the structural moves that make these policies work: default permission, explicit exceptions, a usable disclosure template, and assessment redesign that starts small.

No single policy, and that is the finding

The instinct when a new technology arrives on campus is to ask whether it is banned or allowed. Alessandra Giugliano’s June 2026 article for Thesify reviews the published generative-AI policies of the Times Higher Education 2026 top-20 research universities and gives a more useful answer: it depends, and the “it depends” is doing real work. There is no dominant policy model among the institutions surveyed. Some universities issue central, institution-wide guidance. Others leave the substance to individual courses. Some provide institutionally managed AI tools alongside the guidance, which lets them set conditions on the tool itself rather than only on the behaviour around it. Others publish only partial or department-specific rules, leaving large parts of the institution to work it out locally.

That patchwork is not the same as no policy. Read across the survey, a consistent shape emerges: institutions are converging on documented, task-specific permission, rather than either a blanket ban or a blanket green light. The interesting question is not which university sits closest to “allow” or “forbid” on a single dial. It is where each institution draws its lines, who gets to move them, and what it asks for in exchange for permission.

The spectrum, and where the lines actually sit

At one end of that spectrum sit narrow, deliberate restrictions applied to a specific stage of training rather than to a subject as a whole. Princeton’s Graduate History Department is the clearest example in the survey: it discourages generative-AI use during the first two years of doctoral study, before a student reaches candidacy. The reasoning is specific rather than reflexive. Narrative synthesis, close reading of primary sources and translation are treated as foundational skills that a student needs to build directly, and handing early drafting or synthesis work to a model risks skipping the stage where those skills are actually formed. The restriction is not a statement that generative AI is unsuitable for historical research generally; departments elsewhere permit it in narrower, technical-support roles, such as formatting, citation management or transcription assistance, once a student is further along.

At the other end, the default position for personal study, early-stage drafting, coding support and research administration is permissive across most of the institutions surveyed. Nobody is asking a graduate student to seek departmental sign-off before using an AI tool to debug a script or summarise their own reading notes. The line moves, sharply, once the output starts to count as assessed work. Coursework, examinations, theses, manuscripts submitted for publication and grant materials are treated differently across the board, usually requiring explicit permission from whichever body actually owns the assessment, whether that is a module convenor, a department, a supervisor or a university-wide policy.

The institutions in Giugliano's review occupy a spectrum rather than following one shared model. Illustration produced by the True Work Office team.

Discretion sits with the person closest to the work

What the survey does not show is a single office setting one rule for an entire institution and enforcing it uniformly. Discretion is pushed down, deliberately, to the level closest to the assessment itself. A module leader deciding what counts as acceptable AI assistance in a problem set is making a different judgement from a thesis supervisor deciding what counts as acceptable assistance in a dissertation, and the policies surveyed largely let that difference stand rather than trying to flatten it into one rule.

This has a defensible logic. A single institution-wide rule that tried to cover a first-year coding module, a final-year history thesis and a postdoctoral grant application in the same sentence would either be too strict to be useful in the module or too loose to be defensible in the thesis. Pushing discretion to the instructor and the department lets the rule fit the task. It also creates a genuine mobility problem for students, particularly those moving between departments, institutions or even between a taught programme and a doctoral one, who can find the rules of what counts as acceptable AI use resetting at every boundary they cross. This site’s earlier report on turning AI literacy frameworks into classroom practice covers the training side of that inconsistency in more depth; the policy side is the mirror image of the same problem.

Disclosure over detection

Where policies do converge strongly is on what they ask for once AI use is permitted. Disclosure recurs across the institutions surveyed: state what was used, and often how it was used, rather than simply submitting the output as though no tool was involved. Data-privacy cautions sit alongside disclosure in a lot of the published guidance, warning students and staff against feeding institutional material, unpublished research or other people’s personal data into public AI tools where the provider’s own data-handling terms are unclear.

What is notably absent, as a primary enforcement mechanism, is reliance on AI-text detectors. Conventional detection tools have shown high false-positive rates in practice, and that has pushed the institutions surveyed toward permission, disclosure and human-accountability frameworks rather than automated flagging as the backbone of academic-integrity policy. This site has reported before on how often detection tools flag honest students, and the pattern in the survey is consistent with that finding: the leading universities are not betting their integrity processes on a technology with a known accuracy problem. That is a policy judgement as much as a technical one, and it lines up with the same direction of travel discussed in this site’s companion report on the EU AI Act and classroom assessment, which covers the regulatory side of why automated detection is losing ground as the default response, including for institutions weighing up whether they fall inside the Act’s reach at all, a question explored in more depth here.

None of this is happening in a vacuum of student demand. A separate 2026 survey of UK undergraduates found 95 per cent reporting some use of AI, up from 92 per cent the year before and 66 per cent the year before that, with 94 per cent using generative AI to help with assessed work and 12 per cent saying they had directly included AI-generated text in work they submitted for assessment, itself up from 8 per cent the previous year (HEPI, Student Generative AI Survey 2026). Policy built on the assumption that AI use is rare, or confined to a minority, is already out of date before it is published.

Assessment redesign, not just rule-writing

The universities surveyed that go further than permission-and-disclosure tend to move toward redesigning the assessment itself, rather than only policing the tools used in it. That instinct has academic backing. Writing in Frontiers in Education, Kotsis and Stylos argue that generative AI functions as an “epistemic actor” that actively participates in producing and validating knowledge, which means conventional assessment built around a single finished artefact is no longer adequate on its own. Their recommended alternative is process-oriented and comparatively low-burden: instructors keep brief records of which AI tools were used in a class, for what purpose, and which decisions stayed under the instructor’s own control; students submit short AI-use declarations naming the prompts used, the outputs consulted and the changes they made to them; and marking rubrics include a criterion on responsible AI use and on justifying the final answer, not only on the answer’s correctness.

That kind of redesign costs instructor time rather than licence fees, which is part of why it appears unevenly even among well-resourced institutions. It is easiest to introduce where an assessment already has some process visibility, such as a supervised dissertation or a portfolio, and hardest where the tradition is a single closed-book exam or a take-home essay with no intermediate checkpoints.

Where the policies stay quiet

Two gaps run through the survey and are worth naming plainly, because a policy’s silences say as much as its rules. First, published guidance rarely addresses staff use of AI in any depth: marking support, feedback drafting, reference-letter assistance and administrative work sit largely outside the scope of policies written with students in mind. A rule that governs what a student may disclose about AI-assisted work, while saying nothing about what an examiner or supervisor discloses about their own use of AI in producing feedback or grades, is an asymmetry that has not yet been resolved at most of the institutions surveyed. Second, detection-tool governance itself is thin. Institutions that have quietly stepped back from relying on detectors to make integrity decisions have not, in the main, published clear guidance on when a detector’s output may be used at all, by whom, and with what human check attached, a gap that sits alongside the wider detection-tooling debate this site has followed through the year, including how the arms race between detectors and AI writing has developed since.

What a mid-tier institution can actually copy

None of the structural moves in the survey require a top-20 research budget. A defensible starting policy can be built from four pieces that any institution can put in place without new software or new headcount. Default permission for personal study and low-stakes use removes the need to police the majority of AI use that nobody has a serious objection to. Explicit, task-specific permission requirements for assessed work, examinations and theses, set at module or department level rather than centrally, put the decision with the person who actually understands the assessment. A short, standard disclosure template, the kind students can complete in two minutes rather than treat as a barrier, turns an abstract expectation into something usable. And one redesigned assessment per department, chosen for where process visibility already exists rather than attempted everywhere at once, builds the habit of assessment-as-process without requiring a curriculum-wide rewrite in a single term.

The leaders in this survey did not arrive at a finished system. They arrived at a set of working compromises, some more coherent than others, built under the same pressure every institution now faces. What separates the more defensible policies from the weaker ones is not ambition. It is specificity: naming the task, naming who decides, and naming what disclosure actually looks like, rather than reaching for either a ban or a free pass and hoping the detail sorts itself out later.

Genai-Policy on True Work Office | AI-Agent Research on Academic Integrity and AI Ethics