Universities have moved quickly to publish principles and policies for artificial intelligence. These documents help establish boundaries and communicate institutional intent. They do not, on their own, demonstrate that AI is being used consistently, safely or effectively across teaching, assessment, research, student support and administration.

Institutional readiness becomes credible when leaders can trace policy commitments into decisions, controls, capability, evidence and improvement. The practical question is therefore not whether a university has an AI policy. It is whether the university can show what AI is used for, who is accountable, which risks were considered, how staff and students are supported, how outcomes are monitored and what happens when evidence indicates harm or underperformance.

Why policy alone is insufficient

A policy can be approved while practice remains fragmented. Different faculties may interpret the same rule differently. Staff may use unapproved tools because approved alternatives do not meet their needs. Students may receive conflicting instructions across modules. Procurement teams may assess contractual terms without examining educational validity, while academic teams may adopt a tool without understanding how student data are processed.

QAA research published in 2026 identified material variability in institutional policies, academic practice and student experience. QAA subsequently announced work on a sector-owned framework centred on a direct quality question: does assessment genuinely show what a student has learned?

SPECS perspective
A rule exists at one point in time. Readiness requires the institution to apply the rule, evaluate its effects and respond to change.

The emerging expectation is demonstrable governance

International guidance increasingly treats AI as an organisational governance issue rather than a standalone technology concern. UNESCO calls for human-centred regulation, protection of data privacy, ethical validation and pedagogically appropriate use. The NIST AI Risk Management Framework organises risk management around governance, context mapping, measurement and management across the system lifecycle. ISO/IEC 42001 specifies an organisational management system for establishing, implementing, maintaining and continually improving responsible AI use.

The European Commission also identifies AI literacy as an obligation under the EU AI Act for providers and deployers within scope. Higher education adds further requirements: AI use must be considered in relation to learning outcomes, assessment validity, academic judgement, research integrity, accessibility, student rights and the credibility of awards. A technically functional system may still be educationally inappropriate.

A practical definition of institutional AI readiness

SPECS defines institutional AI readiness as the institution's demonstrated capacity to select, govern, use, review and improve AI-enabled practices in ways that support its mission, protect academic standards and people, and remain accountable to evidence.

This definition has four important consequences:

  1. Readiness is institutional. Isolated pilots or expert individuals do not establish whole-university capability.
  2. Readiness is use-case specific. A low-risk writing assistant and an AI system influencing admissions, grading or progression require different controls.
  3. Readiness is evidenced. Policies, training, approvals and dashboards must show implementation and results, not only intention.
  4. Readiness is dynamic. Models, suppliers, regulation, user behaviour and educational practice change, so approval cannot be treated as permanent.

Five domains of demonstrable readiness

1. Governance

Readiness requires a clear institutional purpose, accountable owners, risk-based approval and defined decision rights. Evidence may include approved AI principles, a use-case inventory, committee records, risk classifications, named owners and incident-escalation routes.

2. Assessment integrity

Assessment must remain valid, inclusive and capable of supporting trustworthy judgements about student learning. Evidence may include programme assessment maps, AI-use statements, moderation records, student guidance, appeal routes and evaluated assessment reform.

3. Data and technology

Approved systems must protect data, security, intellectual property, accessibility and service continuity. Due-diligence records, data-flow maps, contracts, security testing, accessibility reviews, change controls and exit plans should support the institutional judgement.

4. People and capability

Governors, leaders, academics, professional staff and students need role-specific understanding of permitted uses, limitations, responsibilities and routes for support. Attendance records alone do not prove that people can apply the policy in real decisions.

5. Evidence and assurance

Leaders need reliable information on adoption, benefits, risks, incidents and outcomes, together with evidence that they act on it. Useful evidence includes performance measures, audit samples, incident analysis, equality monitoring, review decisions, action closure and verified impact.

Evidence that a policy is working

For each material AI use, a university should be able to demonstrate:

  • Purpose: the institutional or educational problem being addressed and why AI is appropriate.
  • Authority: who approved the use, owns the outcome and can pause or stop it.
  • Risk: the possible effects on students, staff, academic standards, equality, privacy, security and reputation.
  • Control: the safeguards operating before, during and after use, and who tests them.
  • Capability: whether the people involved understand the system's limits and their responsibility to exercise judgement.
  • Evidence: what demonstrates that the system works as intended in the institution's own context.
  • Response: what evidence would trigger modification, suspension or withdrawal.

Broad statements such as “human oversight is provided” are insufficient unless the institution identifies the responsible role, the information available to that person, the time and authority they have to intervene and evidence that intervention occurs when necessary.

Assessment is the most visible test

Assessment brings institutional claims about responsible AI into direct contact with academic standards and student rights. TEQSA guidance on assessment reform emphasises that institutions need multiple, inclusive and contextualised approaches to form trustworthy judgements about learning. QAA's current work similarly centres assessment validity and confidence in awards.

An institution should be able to show how programme teams have reconsidered assessment across the whole course, not simply added warnings about misconduct to individual modules. Where AI assists marking, feedback or moderation, qualified academic authority must remain meaningful, informed and capable of overriding the system.

Procurement must include academic and ethical due diligence

Standard procurement checks remain essential, but they do not establish educational fitness. Universities should examine intended users, data flows, model limitations, explainability, bias, accessibility, intellectual property, subcontractors, update practices and exit arrangements. Academic and student representatives should test whether the proposed system supports the approved educational purpose.

Approval should state the permitted use, prohibited use, accountable owner, review date and conditions requiring revalidation. A material change to the model, data source, supplier, prompt architecture or decision consequence should trigger review rather than pass unnoticed as a routine software update.

Capability must be role specific

AI literacy cannot be reduced to one awareness session. A governor needs to understand institutional exposure and assurance. A programme leader needs to understand assessment validity and curriculum implications. A procurement specialist needs to identify contractual, data and supplier risks. A lecturer needs practical guidance for teaching, feedback and academic integrity. Students need clear expectations, equitable access and the ability to question an AI-influenced decision.

A readiness maturity scale

  1. Unclear: AI use is largely informal. Ownership, permitted use and evidence are uncertain.
  2. Reactive: policies or restrictions respond to immediate concerns, but implementation differs across the institution.
  3. Defined: roles, processes and approved use cases are documented. Core training and controls are operating.
  4. Embedded: AI governance is integrated with quality, risk, assessment, data, procurement and staff development.
  5. Assured and improving: the institution tests effectiveness, learns from evidence, addresses unintended effects and scales only when justified.

The scale is a diagnostic aid rather than an accreditation decision. An institution may be mature in one domain and exposed in another. High-consequence use cases should not proceed merely because overall maturity appears strong.

A ninety-day route from policy to evidence

Days 1 to 30: establish control

Confirm executive ownership; inventory material AI uses; classify risk; and identify urgent gaps in assessment, data, procurement and student communication. Completion evidence should include the approved scope, use-case register, risk criteria, named owners and immediate corrective actions.

Days 31 to 60: align practice

Map policy to procedures; define approval and incident routes; issue role-specific guidance; and review high-risk assessment and student-facing uses. Completion evidence should include controlled procedures, training materials, completed priority reviews and recorded decisions.

Days 61 to 90: test assurance

Sample implementation across faculties and services; examine consistency; review metrics, incidents and feedback; and agree a twelve-month improvement roadmap. Completion evidence should include an assurance report, tested evidence, accepted actions, named owners and an executive or governing-body oversight record.

Questions for governing bodies and executive leaders

  • Can we identify every material AI use that could affect students, staff, academic decisions or institutional data?
  • Who is accountable for each use, and which authority approved it?
  • Can we show that our rules are applied consistently across faculties, programmes and services?
  • What evidence demonstrates educational benefit, acceptable reliability, fairness and accessibility in our context?
  • Can students and staff understand when AI is used and obtain effective human review of consequential decisions?
  • What information reaches the governing body or executive team, and what decisions has it changed?
  • Which conditions would cause us to suspend an AI use, and have we tested that process?

The SPECS approach

SPECS applies five connected stages to institutional AI readiness: Govern establishes purpose, accountability and risk appetite; Design defines approved uses, educational requirements and safeguards; Enable develops practical capability and communication; Verify tests implementation, consistency and outcomes; and Improve and Scale closes gaps and expands effective practice only when the evidence supports that decision.

The AI Quality Readiness Diagnostic examines governance, assessment integrity, data and technology, people and capability, and evidence and assurance. Typical outputs include a readiness scorecard, risk heat map, strengths and gaps, a ninety-day action plan and a twelve-month roadmap. Expert human judgement remains responsible for all material findings and recommendations.

Conclusion

The next stage of responsible AI in higher education is institutional proof. Policies remain important, but confidence depends on whether the university can demonstrate accountable decisions, consistent practice, capable people, protected data, valid assessment and continuing oversight.

A credible institution does not claim readiness because it has approved a document. It shows readiness by explaining what it does, why it does it, who is accountable, what evidence supports the practice and how it responds when the evidence changes.

Sources

This SPECS insight supports institutional quality assurance and improvement. It does not constitute legal advice, regulatory approval, accreditation or certification. Institutions should verify the requirements that apply in their jurisdiction and retain qualified human responsibility for material academic, employment, admissions and student decisions.