Deep Research (AI) into GenAI Use in Higher Education

Who are the top authorities in GenAI use in higher education and which standards dominate the space? - Deep Research ChatGPT Plus (high)

Top Authorities and Dominant Standards for Generative AI in Higher Education

Executive summary

The authority landscape for generative AI in higher education is not controlled by a single field leader or a single standard. It is a layered ecosystem. At the scholarly and pedagogical layer, the most authoritative figures are those whose work directly addresses teaching, assessment, academic integrity, and institutional adoption in universities. On that evidence base, the strongest current individual authorities are Mike Sharples, Wayne Holmes, Rose Luckin, Phillip Dawson, Ethan Mollick, Helen Crompton, Mike Perkins, Maha Bali, Sarah Elaine Eaton, and Leon Furze. They matter for different reasons: Sharples, Holmes, and Luckin are unusually strong at the intersection of scholarship and policy; Dawson and Perkins have become central in assessment reform; Mollick is the most visible public-facing university voice on day-to-day GenAI use; Crompton anchors the “state of the field” literature; Bali, Eaton, and Furze shape critical literacies, ethics, and practitioner uptake. 1(https://scholar.google.com/citations?hl=en&user=0KzFF40AAAAJ&utm_source=chatgpt.com)

The standards landscape is also layered. The standards that most visibly dominate university practice are not only ethical guidelines. They include legal and privacy baselines, procurement instruments, interoperability specifications, and evaluation practices. The strongest evidence of real operational dominance points to a stack that includes UNESCO’s guidance for GenAI in education and research, NIST’s AI RMF and GenAI Profile, FERPA and GDPR, the EU AI Act for European institutions, HECVAT for vendor review, and 1EdTech’s LTI 1.3 and related TrustEd Apps frameworks for LMS integration and edtech procurement. In assessment, the most influential sector frameworks are TEQSA’s assessment reform resources in Australia, the Russell Group principles in the UK, and the AI Assessment Scale as a practical implementation framework. 2(https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research)

The most mature, de facto technical standards in university operations are HECVAT and LTI 1.3. HECVAT is repeatedly embedded in real university procurement and security review workflows across U.S. campuses, while LTI 1.3 is supported across major LMS platforms and is the default direction of travel for integrations. That makes them more concretely “dominant” in day-to-day higher-ed operations than many broader AI ethics documents. 3(https://www.montclair.edu/information-technology/security/hecvat/?utm_source=chatgpt.com)

The biggest weakness in the current higher-ed GenAI standards environment is that governance is moving faster than validated practice. Universities now have many AI guidelines, but internal capability for model evaluation, red-teaming, privacy risk assessment, and post-deployment monitoring remains uneven. The strongest university-facing evaluation references are NIST’s red-teaming guidance, Stanford’s HELM transparency benchmark, and OWASP’s GenAI application security guidance, but these are still emerging as campus operational practice rather than universally embedded university standards. 4(https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf)

A university that wants best practice should not start with a generic “AI policy” alone. It should build a governance stack: approved enterprise tools and data rules, procurement review using HECVAT and AI-specific rubrics, a risk-management layer aligned to NIST and privacy law, LMS and identity integration through 1EdTech standards, assessment redesign at program level instead of detector-driven enforcement, and continuous evaluation using red-teaming, privacy impact assessment, and human oversight. 5(https://policy.usc.edu/generative-ai-general-policy/)

Scope and method

Because the geographic scope was unspecified, this report uses a global but English-language evidence base, emphasizing authorities and standards with visible influence across UNESCO-linked global policy, the U.S., the U.K., the EU, and Australia. The report prioritizes primary and official sources: university profiles, regulator guidance, standard-setting bodies, official framework documents, and original papers. Where citation counts are included, they come from public Google Scholar profile snippets surfaced by search results and should be read as approximate, time-sensitive indicators rather than fixed audit values. 6(https://scholar.google.com/citations?hl=en&user=0KzFF40AAAAJ&utm_source=chatgpt.com)

The ranking of individuals below is an analytical synthesis, not a universal league table. I weighted four factors: relevance of output to GenAI in higher education, scholarly impact, direct role in shaping standards or policy, and visible institutional or public uptake. This method matters because the GenAI higher-ed field is unusually hybrid: a highly cited scholar without institutional uptake is less authoritative in practice than someone whose work directly shaped regulator guidance, procurement practice, or assessment design. That is why the report treats policy roles and adoption evidence as seriously as citations. 7(https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research?utm_source=chatgpt.com)

Ranked individual authorities

The table below ranks the strongest current individual authorities specifically for GenAI use in higher education.

Rank	Authority	Affiliation	Signature contributions	Influence signals	Why authoritative	Primary sources
1	Mike Sharples	Emeritus Professor, Institute of Educational Technology, The Open University	Early and continuing leadership on AI in education; contributor to UNESCO’s higher-ed ChatGPT guide; widely cited work linking pedagogy, assessment, and AI use in universities	~33,311 Google Scholar citations; contributor acknowledged in UNESCO AI policy work; long-standing editorial and disciplinary leadership	Strongest combination of higher-ed specificity, long-run scholarly influence, and practical pedagogical framing of GenAI for universities	8(https://scholar.google.com/citations?hl=en&user=0KzFF40AAAAJ&utm_source=chatgpt.com)
2	Wayne Holmes	Professor of Critical Studies of AI and Education, UCL; UNESCO Chair in the Ethics of AI and Education	Co-author of UNESCO’s GenAI guidance; major work on ethics, human rights, and social justice in AI and education	~34,157 Google Scholar citations; UNESCO Chair; consultant to multiple UNESCO units; co-drafter of UNESCO guidance	The field’s strongest ethics-and-policy authority with direct higher-ed relevance and unusually high global policy legitimacy	9(https://scholar.google.com/citations?hl=en&user=yrDsXRAAAAAJ&utm_source=chatgpt.com)
3	Rose Luckin	Professor Emerita, UCL; Founder/CEO, Educate Ventures Research	Landmark AI-in-education scholarship; policy advising; institutional and industry bridge-building around ethical AI in education	~26,063 Google Scholar citations; advisor to policymakers, governments, and industry; co-founder of the Institute for Ethical AI in Education	Particularly authoritative where universities need translational leadership between research, ethics, product adoption, and policy	10(https://scholar.google.com/citations?hl=en&user=Jos0vkQAAAAJ&utm_source=chatgpt.com)
4	Phillip Dawson	Professor and Co-Director, CRADLE, Deakin University	Assessment security, cheating, authentic assessment, and AI-era assessment reform; key expert collaborator in Australia’s assessment reform work	~15,914 Google Scholar citations; Co-Director of a globally recognized assessment center; prominently linked to TEQSA’s assessment reform project	The most authoritative specialist on how GenAI changes assessment validity, security, and redesign in higher education	11(https://scholar.google.com/citations?hl=en&user=0LcJrnsAAAAJ&utm_source=chatgpt.com)
5	Ethan Mollick	Associate Professor, Wharton; Co-Director, Wharton Generative AI Labs	Applied GenAI experimentation in teaching and work; classroom use cases; high-visibility public translation of AI practice for faculty and students	~19,172 Google Scholar citations; Co-Director of Wharton GAIL; exceptionally strong media and practitioner reach	Less narrowly “education research” focused than Sharples or Dawson, but arguably the most influential public-facing university practitioner voice on GenAI use	12(https://scholar.google.com/citations?hl=en&user=_13RevgAAAAJ&utm_source=chatgpt.com)
6	Helen Crompton	Professor and Executive Director, RIDIL, Old Dominion University	State-of-the-field reviews of AI in higher education; governance Delphi study; practical white papers for universities	~15,435 Google Scholar citations; 2023 state-of-field review cited 3,470 times; executive director of RIDIL	Authoritative because she combines high-volume synthesis scholarship with direct institutional guidance for higher-ed adoption	13(https://scholar.google.com/citations?hl=en&user=Idtxi9oAAAAJ&utm_source=chatgpt.com)
7	Mike Perkins	Associate Professor and Head of Centre for Research & Innovation, British University Vietnam	Co-author of the AI Assessment Scale; research on GenAI, detectors, integrity, and ethical assessment integration	~4,461 Google Scholar citations; AIAS framework described by his institution as adopted globally across schools and universities	One of the clearest authorities on operationalizing GenAI in assessment policy and task design	14(https://scholar.google.com/citations?hl=en&user=8nBHC24AAAAJ&utm_source=chatgpt.com)
8	Maha Bali	Professor of Practice, Center for Learning and Teaching, American University in Cairo	Critical AI literacy, social-justice-oriented GenAI pedagogy, AI Pedagogy Project contributions, co-authorship of the GenAI teaching manifesto	Strong practitioner-intellectual reach; major presence in critical pedagogy communities; visible role in the AI Pedagogy Project and manifesto discourse	Especially authoritative on critical, humane, and equity-centered uses of GenAI in university teaching	15(https://www.aucegypt.edu/fac/maha-bali)
9	Sarah Elaine Eaton	Professor and Research Chair, University of Calgary	Postplagiarism framework; academic integrity in the age of AI; ethics-centered reframing of authorship and misconduct	~6,023 Google Scholar citations; research leadership on integrity and AI; broad professional speaking footprint	A leading authority where institutions are moving from “detection and punishment” toward new integrity frameworks suited to GenAI	16(https://scholar.google.com/citations?hl=en&user=EmD2JcoAAAAJ&utm_source=chatgpt.com)
10	Leon Furze	Author, consultant, doctoral researcher in GenAI and writing instruction	Practical AI strategies for educators; AI Assessment Scale co-author; extensive professional learning and curriculum guidance	~1,044 Google Scholar citations; best-selling practitioner author; strong educator uptake and consulting reach	A practitioner authority with outsized influence on implementation, staff development, and AI literacy compared with his formal citation profile	17(https://scholar.google.com/citations?hl=en&user=sHH91roAAAAJ&utm_source=chatgpt.com)

A few names sit just below the top tier but remain influential in practice. Marc Watkins has become a prominent faculty-development and AI-literacy voice through the University of Mississippi and the AI Pedagogy Project, especially for instructors seeking practical classroom implementation. His scholarly citation profile is smaller, but his practitioner influence is real. 18(https://scholar.google.com/citations?hl=en&user=RhfdjFsAAAAJ&utm_source=chatgpt.com)

The strongest analytical pattern across this ranking is that “authority” now comes in three forms. First, there are policy-intellectual authorities such as Holmes and Luckin. Second, there are assessment authorities such as Dawson and Perkins. Third, there are implementation and public-translation authorities such as Mollick, Furze, and Watkins. Universities that treat only one of those groups as authoritative usually end up with policies that are either too abstract, too punitive, or too tool-driven. 19(https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research?utm_source=chatgpt.com)

Leading institutions and research centers

The institutional landscape is similarly differentiated. Some centers lead in research and theory, some in policy, and some in applied adoption.

Institution or center	Main focus in GenAI and higher education	Notable outputs and signals	Why it matters	Primary sources
The Open University, Institute of Educational Technology	Institutional AI assistants, curriculum production, LLM use in HE, long-run pedagogical innovation	LLM use in higher education reports; institutional course-writing assistant Scribe; AI futures and innovation reports	One of the clearest examples of a university both studying and operationalizing GenAI internally	20(https://oro.open.ac.uk/103272/1/D2.1_Use%20of%20LLM%20tools%20within%20higher%20education.%20Report1.pdf?utm_source=chatgpt.com)
UCL Knowledge Lab and AIED@UCL	AI and education, multimodal learning, testbeds, teacher-AI complementarity, policy influence	Dedicated AI-and-education theme; AIED@UCL as interdisciplinary hub; extensive policy and public-engagement work	A globally visible research center that combines theory, ethics, and design-oriented research	21(https://www.ucl.ac.uk/ioe/departments-and-centres/ucl-knowledge-lab)
Deakin University, CRADLE	Assessment, digital learning, feedback, cheating, GenAI-era assessment reform	“Assessment in a time of genAI”; globally networked research center; strong international partnerships	Probably the strongest single center on university assessment reform in the GenAI era	22(https://www.deakin.edu.au/about-deakin/why-deakin/education-excellence/cradle?utm_source=chatgpt.com)
Stanford HAI with the Stanford Accelerator for Learning	Human-centered AI for education, policy, summits, benchmarks, public agenda-setting	Annual AI+Education Summit; HELM benchmark ecosystem; strong research-policy convening power	Sets agenda for evaluation, policy framing, and human-centered educational AI discourse	23(https://hai.stanford.edu/about?utm_source=chatgpt.com)
Wharton Generative AI Labs	Applied GenAI for teaching and learning, prompt libraries, educational prototyping	The Primer Initiative; prompt libraries; technical reports and classroom implementation resources	Highly influential in translating frontier GenAI into reusable university teaching practice	24(https://gail.wharton.upenn.edu/?utm_source=chatgpt.com)
Old Dominion University, RIDIL	Systematic reviews, institutional guidance, faculty-facing AI research and white papers	State-of-field synthesis; governance Delphi study; GenAI policy and guidelines events	Strong bridge between scholarly synthesis and institutional practice	25(https://online.odu.edu/ridil?utm_source=chatgpt.com)
University of Melbourne, CSHE and Assessment/AI/Academic Integrity work	Assessment, learning quality, integrity, and GenAI implementation in HE	Dedicated AI-and-academic-integrity resources; HE projects on GenAI policy in low-resource contexts	Particularly important in the Australian sector, where assessment and quality assurance questions are advanced and public	26(https://melbourne-cshe.unimelb.edu.au/ai-aai?utm_source=chatgpt.com)

Two institutional patterns stand out. First, the most influential centers are not merely “AI labs.” They are places with an existing higher-education mission in pedagogy, assessment, quality, or digital learning, and they have added GenAI as a strategic domain. Second, the most credible institutions are producing both conceptual outputs and operational artifacts: reports, summits, procurement guides, institutional assistants, prompt libraries, case studies, and implementation frameworks. That is why centers such as IET, CRADLE, Stanford HAI, and Wharton GAIL matter more than generic AI institutes for this specific question. 27(https://iet.open.ac.uk/research?utm_source=chatgpt.com)

Organizations and consortia shaping standards

The organizations with the most real standard-setting power fall into five roles: global norm-setters, national or regional regulators, technical standards bodies, higher-ed infrastructure consortia, and sector coordination groups.

Organization or group	Role in the ecosystem	Most important contribution for universities	Why it shapes standards	Primary sources
UNESCO	Global norm-setter	Human-centered ethical guidance for GenAI in education and research	It supplies the broadest accepted global language for rights, ethics, and capacity-building in education-focused AI policy	28(https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research)
NIST	U.S. standards and risk framework authority	AI RMF 1.0 and GenAI Profile	It provides the most widely cited cross-sector governance model that universities can operationalize in procurement and risk management	29(https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf?utm_source=chatgpt.com)
ISO/IEC JTC 1/SC 42	Formal international technical standards body	ISO/IEC 42001, 23894, 22989, 42006	It defines management-system and risk language that universities and vendors increasingly use for assurance and certification	30(https://www.iso.org/standard/42001)
1EdTech	Interoperability and edtech trust body	LTI 1.3, TrustEd Apps, Generative AI Data Rubric	It has the strongest direct influence on how AI-enabled tools are integrated into LMS and procurement workflows	31(https://www.1edtech.org/standards/lti)
EDUCAUSE, Internet2, and REN-ISAC	Higher-ed infrastructure and security consortium	HECVAT and NET+ evaluation processes	This consortium has created the most widely visible procurement-security standard used by U.S. campuses	32(https://www.educause.edu/higher-education-community-vendor-assessment-toolkit)
Jisc	U.K. tertiary-sector coordination body	AI maturity toolkit; sector guidance and communities of practice	Jisc is shaping how colleges and universities talk about AI readiness, governance maturity, and responsible adoption	33(https://www.jisc.ac.uk/reports/artificial-intelligence-in-tertiary-education)
Russell Group	Elite U.K. university consortium	Shared principles on GenAI in education	Its principles are not technical standards, but they have become a de facto policy template in the U.K. university sector	34(https://www.russellgroup.ac.uk/sites/default/files/2025-01/Russell%20Group%20principles%20on%20generative%20AI%20in%20education.pdf)
TEQSA	Australian quality regulator	Assessment reform resources and sector coordination	TEQSA has had unusually direct influence because its guidance is tied to quality assurance and provider action plans	35(https://www.teqsa.gov.au/guides-resources/higher-education-good-practice-hub/gen-ai-knowledge-hub/gen-ai-academic-integrity-and-assessment-reform)
European Commission and EDPB	EU regulatory and privacy authorities	AI Act obligations; GDPR interpretation for AI and LLMs	These bodies are shaping the compliance baseline for universities operating in Europe or handling EU personal data	36(https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng?utm_source=chatgpt.com)

The most important analytical distinction here is between standards that universities must follow and standards they choose to follow. FERPA, GDPR, and the AI Act are legal obligations in their jurisdictions. NIST, ISO, UNESCO, Jisc, Russell Group, and TEQSA are governance and policy frameworks. HECVAT and 1EdTech standards become dominant because they sit in the middle: formally voluntary, but practically necessary once a university is procuring tools or integrating them into learning platforms. 37(https://studentprivacy.ed.gov/ferpa)

Dominant standards and university adoption

The clearest way to understand today’s standards environment is as a layered governance stack.

HigherEd GenAI Standards
HigherEd GenAI Standards - Notes

38(https://internet2.edu/wp-content/uploads/2020/03/D0C-SEC-Hevcat20170425.pdf)

Layer	Dominant standard or framework	What universities use it for	Evidence of adoption or operationalization	Analytical assessment
Ethical and policy baseline	UNESCO Guidance for Generative AI in Education and Research	Framing ethical, human-centered, and capacity-building policy	UNESCO presents it as its first global GenAI guidance for education and research	Highly influential as a global reference point, but less operational than HECVAT or LTI in campus workflows
Institutional maturity and governance	Jisc AI maturity toolkit	Assessing institutional AI readiness, progression, and governance maturity	Jisc designed it specifically for tertiary education and describes sector-wide experimentation and adoption across U.K. tertiary institutions	Strong in the U.K.; one of the best operational maturity frameworks for universities
Risk-management baseline	NIST AI RMF 1.0 plus GenAI Profile	Governance, risk mapping, measurement, vendor review, lifecycle controls, procurement questions	University of California’s AI Council asks suppliers whether assessments were based on the NIST AI RMF; Columbia explicitly aligns its AI framework with NIST AI RMF 1.0	The most important cross-sector AI governance spine now entering higher-ed operations
Formal management-system baseline	ISO/IEC 42001 with related ISO/IEC 23894, 22989, 42006	Enterprise AI governance, certification language, audit and assurance	ISO defines 42001 as the first AI management-system standard and links it to related AI risk and terminology standards	Important and rising, but university adoption remains less visible than vendor-side adoption
Legal/privacy baseline	FERPA, GDPR, AI Act, and DPIA-style privacy review	Student-record protection, lawful processing, privacy by design, AI literacy and transparency duties in Europe	USC’s policy restricts data categories and distinguishes enterprise AI tools from personal subscriptions; Clemson ties AI use to FERPA and data-classification rules; EDPB provides LLM privacy-risk guidance that complements GDPR DPIAs	This is the non-negotiable baseline. Every university policy ends up resting here sooner or later
Vendor/procurement standard	HECVAT	Third-party risk review, privacy/security/accessibility documentation, vendor comparison	Montclair, Duke, Trinity, FIU, Northwestern, Buffalo, and others embed HECVAT into procurement and security review processes	The clearest de facto procurement standard in U.S. higher education
Interoperability and LMS integration	1EdTech LTI 1.3 / LTI Advantage	Secure launch, single sign-on, grade return, roster provisioning, deep linking	1EdTech positions LTI 1.3 as the current version; Canvas, Moodle, Brightspace, and Blackboard all support LTI 1.3 workflows	This is the dominant integration standard for AI-enabled learning tools entering university LMS ecosystems
Edtech AI transparency	1EdTech TrustEd Apps Generative AI Data Rubric	RFP requirements, transparency on AI use, opt-in/opt-out, training data disclosure, third-party models	1EdTech provides sample RFP language and positions the rubric as a common framework for evaluating AI data practices	Not yet universal, but one of the few higher-ed-specific AI procurement rubrics with concrete implementation language
Assessment-policy layer	TEQSA assessment reform resources, Russell Group principles, AI Assessment Scale	Setting expectations for permitted AI use, redesigning assessments, balancing integrity with authentic practice	TEQSA says all Australian higher-education providers submitted institutional action plans in July 2024; Russell Group developed common principles across member universities; AIAS is described by BUV as adopted globally across schools and universities	This is the most influential practical layer for teaching and assessment policy, but it is more plural and less standardized than procurement or LMS integration
Evaluation, validation, and security	NIST red-teaming guidance, Stanford HELM, OWASP Top 10 for LLM/GenAI	Testing harms, transparency, benchmarking, application security	NIST frames red-teaming as structured testing for harmful outputs; HELM defines a living benchmark for transparency; OWASP provides widely used vulnerability taxonomies	Important, but still emerging inside universities as operational requirements rather than mature sector-wide practice

One useful way to read this table is to separate dominance by visibility from dominance by operational necessity. UNESCO, NIST, and TEQSA dominate the discourse. HECVAT and LTI 1.3 dominate operations. FERPA, GDPR, and the AI Act dominate compliance. The AI Assessment Scale, Russell Group principles, and Jisc’s toolkit dominate faculty-development and policy translation. The mistake many universities make is choosing only one layer, usually ethics language, and neglecting procurement, interoperability, or assessment redesign. 40(https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research)

Gaps, contested areas, and emerging standards

The most contested area is assessment. The field now broadly agrees that traditional written take-home tasks are vulnerable, but there is no universal standard for how much GenAI assistance should be allowed, how use should be disclosed, or how evidence of learning should be collected. TEQSA’s 2025 resource is especially important because it explicitly says institutions now cluster around three approaches: program-wide reform, unit-level assurance of learning, or combinations of both. That is a sign of convergence around principles, but not yet a settled technical or policy standard. 41(https://www.teqsa.gov.au/sites/default/files/2025-09/enacting-assessment-reform-in-a-time-of-artificial-intelligence.pdf)

A second contested area is AI detection. TEQSA’s 2025 guidance states that detecting GenAI use with certainty in assessments is, for now, “all but impossible,” which is one of the most consequential official acknowledgments in the sector. This pushes universities away from detector-centric enforcement and toward assessment redesign, supervised performance, and transparent use policies. In practice, that is why postplagiarism frameworks and authentic-assessment models are gaining traction. 42(https://www.teqsa.gov.au/sites/default/files/2025-09/enacting-assessment-reform-in-a-time-of-artificial-intelligence.pdf)

A third gap is privacy and data governance for LLM deployment. Universities increasingly distinguish between public consumer AI tools and contract-protected enterprise tools. USC, for example, explicitly permits some categories of internal data only in university enterprise AI tools, while restricting confidential and regulated data unless additional approval exists; Clemson similarly directs users to prefer university-approved, contract-protected services and to ground decisions in data classification. This is emerging as a cross-institutional norm, but the exact controls differ from campus to campus. 43(https://policy.usc.edu/generative-ai-general-policy/)

A fourth gap is higher-ed-specific evaluation capability. NIST, EDPB, HELM, and OWASP all provide pieces of the validation puzzle: red-teaming, privacy-risk assessment, transparency benchmarking, and application security. But few universities have translated those into stable internal operating procedures for teaching tools, student-facing assistants, or agentic systems. Many institutions are still relying on vendor claims, generic cybersecurity reviews, or ad hoc faculty experimentation rather than a repeatable TEVV process. 44(https://ai-challenges.nist.gov/uassets/6)

A final emerging area is AI literacy as an enforceable governance expectation. The EU AI Act introduced AI literacy obligations, and these are now active ahead of full application of the broader framework. That matters for universities because staff and students are not only users of AI; in many cases universities are also deployers, procurers, or co-developers. AI literacy therefore stops being just a curricular aspiration and becomes part of institutional compliance and operational readiness. 45(https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng?utm_source=chatgpt.com)

Recommendations for a university seeking best practice

A university seeking best practice should adopt a layered governance model rather than a single stand-alone AI policy. The first step is to distinguish public tools, enterprise-approved tools, and restricted-use cases. USC and Clemson already provide strong, practical examples of this approach: use data classification to decide what can enter a model; prefer institutionally reviewed services for university work; route exceptions through privacy, legal, cybersecurity, and procurement review. That approach is more sustainable than trying to write a single rule for every classroom and department. 43(https://policy.usc.edu/generative-ai-general-policy/)

The second step is to hardwire procurement and vendor review. For U.S.-style procurement, HECVAT should be the default baseline, supplemented by AI-specific requirements drawn from the 1EdTech Generative AI Data Rubric and NIST-style risk questions. The University of California AI Council guide is especially useful because it translates abstract AI governance into concrete supplier questions about governance, third-party assessments, bias testing, transparency, retention, and ongoing monitoring. 46(https://www.educause.edu/higher-education-community-vendor-assessment-toolkit)

The third step is to standardize integration around the existing edtech stack. If an AI-enabled product will touch teaching and learning, it should, wherever possible, enter the ecosystem through 1EdTech-compatible channels, particularly LTI 1.3 and the associated grade, roster, and deep-linking services. That reduces security drift, simplifies account provisioning, and makes governance enforceable through known LMS workflows rather than uncontrolled browser-based copy-paste behavior. 47(https://www.1edtech.org/standards/lti)

The fourth step is to redesign assessment at program level. TEQSA’s work strongly supports moving beyond detector-based integrity models toward a mix of permitted AI use, AI-irrelevant assessments, and supervised demonstrations of learning. The AI Assessment Scale can be used as a practical task-level taxonomy, but it works best inside a larger program-level assessment strategy rather than as a one-off classroom label. Russell Group principles are useful as an institutional values statement, but they need to be connected to redesigned assessment evidence trails, disclosure expectations, and moderation practices. 48(https://www.teqsa.gov.au/sites/default/files/2025-09/enacting-assessment-reform-in-a-time-of-artificial-intelligence.pdf)

The fifth step is to establish an evaluation and monitoring protocol for GenAI systems already in use. At minimum, that protocol should include: privacy-risk assessment; red-teaming for harmful, biased, or unsafe outputs; human review of domain accuracy; documentation of approved use cases; and periodic re-evaluation when models or vendor terms change. NIST, EDPB, and OWASP together provide a strong starting point. HELM is especially useful when the university needs a vocabulary for transparency and benchmark coverage, even if it is not directly deployed as a campus-wide tool. 49(https://www.edpb.europa.eu/system/files/2025-04/ai-privacy-risks-and-mitigations-in-llms.pdf)

The sixth step is to treat AI literacy as both curricular and operational. The most mature institutions now train faculty, academic support staff, legal and procurement teams, and students differently, because they face different risks and different responsibilities. Jisc’s maturity model is a helpful organizing framework here: it pushes institutions to move from experimentation to operationalization and then to embedded lifecycle management. 39(https://www.jisc.ac.uk/ai-maturity-toolkit-for-tertiary-education)

A workable implementation sequence looks like this:

Implementation Sequence
Implementation Sequence - Notes

50(https://www.educause.edu/higher-education-community-vendor-assessment-toolkit)

The practical recommendation, in one sentence, is this: build your university’s GenAI governance around the standards that already dominate real higher-ed operations, then layer ethics and pedagogy on top of that operational base. In 2026, that means using legal/privacy controls as the floor, HECVAT and LTI as the operational spine, NIST as the governance logic, TEQSA/Russell Group/AIAS-style frameworks for assessment, and UNESCO/Jisc for the broader institutional values and capability agenda. 51(https://studentprivacy.ed.gov/ferpa)

1(https://scholar.google.com/citations?hl=en&user=0KzFF40AAAAJ&utm_source=chatgpt.com) 6(https://scholar.google.com/citations?hl=en&user=0KzFF40AAAAJ&utm_source=chatgpt.com) 8(https://scholar.google.com/citations?hl=en&user=0KzFF40AAAAJ&utm_source=chatgpt.com) Mike Sharples

https://scholar.google.com/citations?hl=en&user=0KzFF40AAAAJ&utm_source=chatgpt.com

2(https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research) 28(https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research) 40(https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research) Guidance for generative AI in education and research | UNESCO

https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research

3(https://www.montclair.edu/information-technology/security/hecvat/?utm_source=chatgpt.com) Vendor Assessment (HECVAT)

https://www.montclair.edu/information-technology/security/hecvat/?utm_source=chatgpt.com

4(https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf) Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile

5(https://policy.usc.edu/generative-ai-general-policy/) 43(https://policy.usc.edu/generative-ai-general-policy/) Generative AI General Policy - Policies and Policy Governance

https://policy.usc.edu/generative-ai-general-policy/

7(https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research?utm_source=chatgpt.com) 19(https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research?utm_source=chatgpt.com) Guidance for generative AI in education and research

https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research?utm_source=chatgpt.com

9(https://scholar.google.com/citations?hl=en&user=yrDsXRAAAAAJ&utm_source=chatgpt.com) Wayne Holmes

https://scholar.google.com/citations?hl=en&user=yrDsXRAAAAAJ&utm_source=chatgpt.com

10(https://scholar.google.com/citations?hl=en&user=Jos0vkQAAAAJ&utm_source=chatgpt.com) rose luckin

https://scholar.google.com/citations?hl=en&user=Jos0vkQAAAAJ&utm_source=chatgpt.com

11(https://scholar.google.com/citations?hl=en&user=0LcJrnsAAAAJ&utm_source=chatgpt.com) Phillip Dawson

https://scholar.google.com/citations?hl=en&user=0LcJrnsAAAAJ&utm_source=chatgpt.com

12(https://scholar.google.com/citations?hl=en&user=_13RevgAAAAJ&utm_source=chatgpt.com) Ethan Mollick

https://scholar.google.com/citations?hl=en&user=_13RevgAAAAJ&utm_source=chatgpt.com