Governance Before Acceleration

134

Managing AI risk in higher education means building ownership, risk tiers, and human accountability before the technology outruns the institution.

---

Artificial intelligence has moved into higher education faster than most institutions can govern it. Faculty use generative AI to design course materials, students use it to draft, revise, code, translate, and study, and vendors continue to embed AI features into learning platforms, advising tools, research systems, and administrative workflows. The problem is not that universities use AI. The problem is that many use it before they have defined ownership, accountability, data rules, academic integrity expectations, vendor controls, and risk oversight.

This article argues that higher education needs governance before acceleration. AI governance should not be treated as a barrier to innovation. It should be the structure that allows innovation to proceed with confidence, transparency, and institutional trust. Drawing from emerging global guidance, including UNESCO’s guidance on generative AI in education, the NIST AI Risk Management Framework, EDUCAUSE research on higher education AI readiness, and recent policy developments such as AI literacy obligations in the European Union, this article proposes a practical governance model for universities built on institutional ownership, risk classification, acceptable use, academic integrity, data protection, vendor oversight, human accountability, and AI literacy.

Arriving Without Permission

Artificial intelligence has entered higher education at an unusual pace. It did not wait for committee approval, curriculum redesign, faculty consensus, or policy maturity. It arrived through public tools, embedded software features, student experimentation, vendor upgrades, and workplace demand. In many institutions, AI is already part of academic experience, even in the absence of a formal AI strategy.

This creates a governance problem. Universities are not merely adopting a new software category. They are confronting a technology that can affect authorship, assessment, privacy, research integrity, accessibility, faculty work, student development, institutional reputation, and public trust. For this reason, higher education should avoid the temptation to accelerate AI adoption before it has built the governance capacity to manage it.

The central question is no longer whether AI belongs in higher education. It clearly does. The more important question is whether institutions can use AI in ways that preserve academic values while preparing students for a world where AI fluency will matter. UNESCO has urged education systems to develop policy, human capacity, and safeguards so generative AI can benefit teachers, learners, and researchers rather than displace human agency or weaken education itself (UNESCO, 2023).

The case for AI in higher education is easy to understand. AI tools can help students explore ideas, receive feedback, practice language, analyze data, write code, summarize complex material, and develop confidence. Faculty can use AI to draft examples, generate practice questions, adapt content, and reduce some administrative burden. Researchers can use AI to support literature review, coding, modeling, and data interpretation. Administrators can use AI to improve advising, enrollment support, accessibility services, and student success interventions.

But the case for governance is equally strong. AI can produce incorrect information with confidence. It can reflect bias from training data. It can expose sensitive institutional or student information if used carelessly. It can alter the meaning of academic authorship. It can create shortcuts that help students produce stronger work without a deeper understanding. The OECD’s 2026 Digital Education Outlook warns that generative AI can support learning when guided by clear pedagogical principles, but when used without such support, it may improve task performance without creating real learning gains (OECD, 2026).

That distinction matters. Higher education does not exist to produce polished submissions alone. It exists to develop judgment, discipline, intellectual honesty, professional capability, and the ability to reason through difficult problems. AI can assist that mission, but it can also obscure whether real learning has occurred. A student may submit a strong answer without having formed the underlying skill. A faculty member may receive work that appears sophisticated but reflects little student effort. An institution may celebrate innovation while academic standards erode quietly.

“Governance before acceleration is not a conservative slogan. It is a practical strategy for trust.”

Governing By Risk, Not By Rule

This is why AI governance should begin with a simple principle: universities must govern AI according to use, context, and impact. Not every use of AI deserves the same level of control. A student who uses AI to brainstorm possible paper topics creates a different risk profile from a student who submits an AI-written dissertation chapter. A faculty member who uses AI to draft a classroom example creates a different risk profile from a system that uses AI to advise students on degree progress. A chatbot that answers library questions creates a different risk profile from an AI tool that influences admissions, grading, discipline, scholarships, or student support.

A practical governance model should classify AI use into risk tiers, allowing institutions to support innovation without treating all AI use as either harmless or forbidden:

High risk — grading, admissions, financial aid, disability accommodations, student discipline, identity verification, proctoring, and any system that can affect a student’s academic standing or future opportunity.

Low risk — personal productivity, brainstorming, grammar support, or administrative drafting, where a human reviews the final result.

Moderate risk — classroom use, student-facing tutoring tools, faculty feedback tools, and AI-supported research assistance.

A Framework Borrowed and Adapted

The NIST AI Risk Management Framework provides a useful foundation because it treats trustworthy AI as a socio-technical matter, not just a technical matter. NIST identifies trustworthy AI characteristics such as validity, reliability, safety, security, resilience, accountability, transparency, explainability, privacy, and fairness, and organizes risk management around governance, mapping, measurement, and management (NIST, 2023). Higher education can adapt that structure to its own mission by asking four core questions: who owns the AI use, what academic or institutional decision it affects, what risks must be measured, and what controls must exist before the tool can be used.

Ownership is the first policy gap to close. Many AI initiatives fail governance review because no one can clearly say who is accountable. In universities, responsibility often spreads across academic affairs, information technology, legal, compliance, procurement, faculty committees, research offices, libraries, and student affairs. Shared responsibility is necessary, but vague responsibility is dangerous. Each AI use case should have a named business owner, a technical owner, a data owner, and a governance review path. Without that structure, AI becomes everyone’s interest and no one’s accountability.

The second governance requirement is an acceptable use policy that speaks to actual academic life. Students need to know when AI use is permitted, when it must be disclosed, when it is prohibited, and when faculty instructions control the answer. Faculty need to know whether they may use AI to grade, comment on student work, draft recommendation letters, analyze student data, or create exam content. Staff need to know whether they may upload institutional records into public tools. Researchers need to know how AI affects authorship, data handling, and reproducibility.

An effective policy should avoid two weak extremes. One extreme bans AI broadly and drives use underground. The other celebrates AI without meaningful boundaries. A better policy states that AI may be used where it supports learning, productivity, accessibility, and research, but only within defined academic, ethical, data, and security limits, and requires disclosure where AI materially contributes to submitted work or institutional output.

Rethinking What We Assess

Academic integrity deserves special attention. Higher education has long dealt with plagiarism, unauthorized collaboration, contract cheating, and misuse of sources. Generative AI changes the scale and ambiguity of those problems. The issue is not only whether a student cheated. The deeper issue is whether the assessment still measures what it claims to measure. If an assignment can be completed by a generic AI tool without the student having to demonstrate reasoning, process, reflection, or domain knowledge, the assignment itself may need redesign.

Governance should therefore include assessment reform. Faculty should be supported in creating assignments that ask students to show process, defend choices, apply judgment to local or discipline-specific cases, reflect on errors, use oral defense, build staged submissions, and explain where AI did or did not assist. This does not mean every course must abandon traditional writing. It means institutions should help faculty decide what kind of work best reveals student learning in an AI-rich environment.

“If an assignment can be completed by a generic AI tool without demonstrating reasoning, process, or domain knowledge, the assignment itself may need redesign.”

Data governance is another critical area. Universities must define which types of data may be entered into public AI tools, which require approved enterprise tools, and which may not be entered at all. This affects research ethics, student privacy, intellectual property, contractual obligations, and institutional reputation. Vendor oversight must also mature: procurement and contract review should require transparency about model use, data retention, training on institutional data, security controls, audit rights, bias testing, accessibility, incident response, and subcontractors.

Keeping Humans in the Loop

Human accountability must remain visible. The U.S. Department of Education has emphasized the importance of keeping humans in the loop and aligning AI use with educational goals, equity, and trust (U.S. Department of Education, 2023). Where AI supports decisions about students, faculty, or staff, the institution should preserve human review, appeal mechanisms, documentation, and the ability to explain the decision process.

AI literacy is the final pillar. Faculty, students, administrators, and technology staff need practical knowledge of AI capabilities and limitations, ethical use, data protection, bias, hallucination, citation weaknesses, prompt design, and verification. UNESCO’s AI competency frameworks emphasize human-centered values, ethics, AI foundations, pedagogy, and responsible use (UNESCO, 2024). The EU’s AI Act requires providers and deployers to ensure sufficient AI literacy among staff, with Article 4 in application since February 2025 and supervision rules due from August 2026 (European Commission, 2025).

A Committee With Teeth

AI governance in higher education must be interdisciplinary, including academic leadership, faculty, students, legal counsel, information security, privacy, procurement, research administration, accessibility services, and institutional risk management. A practical governance committee should maintain an inventory of AI use cases, classify risks, approve high-risk use cases, review vendor AI features, develop guidance templates, recommend training, monitor incidents, and report to senior leadership — with authority to pause or restrict use where risk exceeds institutional readiness.

The policy challenge is not to stop AI until all risks disappear. The challenge is to build enough governance maturity so that adoption is intentional, transparent, and aligned with institutional purpose — preparing students for the AI-enabled workplace without letting AI replace the very skills higher education exists to build.

AI will change higher education. What remains undecided is whether institutions will shape that change through governance or merely react after damage occurs. The universities that lead will not be the ones that adopt every tool first, but the ones that align technology with learning, accountability, human judgment, and public trust.

“Speed may attract attention. Governance will determine whether the change deserves confidence.”

References

• EDUCAUSE. (2024). 2024 AI landscape study. EDUCAUSE.
• European Commission. (2025). AI literacy: Questions and answers.
• NIST. (2023). AI Risk Management Framework: AI RMF 1.0. U.S. Dept. of Commerce.
• OECD. (2026). OECD Digital Education Outlook 2026. OECD Publishing.
• UNESCO. (2023). Guidance for generative AI in education and research.
• U.S. Dept. of Education. (2023). AI and the future of teaching and learning.

About the Author

Dr. John Giordani

Technology Risk Professional · AI Researcher · Author

Dr. John Giordani is a Technology Risk professional, professor of computer science and information assurance, published artificial intelligence researcher, and author of books on machine learning and emerging technology. His work focuses on AI governance, technology risk management, responsible innovation, information assurance, and the practical use of artificial intelligence in academic and organizational settings.