Writing a university AI policy: a guide and template for UK higher education

Most UK universities now have an AI policy of some kind. Far fewer have one that changes what staff do on a Tuesday afternoon. Writing an AI policy for higher education in the UK isn’t hard to start: the Russell Group’s principles, QAA advice, and ICO guidance give you plenty to work from¹. The hard part is writing something specific enough to follow, then making sure it reaches the people it’s for.

This guide covers why policies stall, a skeleton template you can adapt, and how training turns a policy document into everyday practice. It’s written for universities, but the same approach works for colleges, schools, and multi-academy trusts.

Why do university AI policies fail?

Most AI policies don’t fail because they’re wrong. They fail because they never reach daily work.

Jisc’s research points the same way. Its 2025 leadership survey found that AI policies in further education rose to around 65% of colleges, while staff development reached only around 43%². Its staff perceptions work found that most institutions now have policies in place, but far fewer have embedded them in everyday practice³. The policy exists. Staff are left to work out what it means.

The common causes are easy to spot:

• It’s written as principles, not decisions. “Use AI responsibly” doesn’t tell anyone whether they can paste a student email into Copilot.
• It lives in the wrong place. A PDF on the governance pages isn’t where staff look when they’re about to use a tool.
• It doesn’t name tools. Staff can’t follow an approved-tools rule if nobody has said which tools are approved.
• Nobody trains staff on it. A policy is announced once, then left to compete with every other email.
• It goes stale. The tools change every few months. A policy reviewed on a three-year cycle describes products that no longer exist.

The gap has a cost. Microsoft research with Censuswide found that 71% of UK employees had used unapproved consumer AI tools at work⁴. When the policy is vague, staff fill the gap with whatever’s open in their browser.

What should a university AI policy include?

Start from the sector guidance rather than a blank page. The Russell Group’s five principles cover AI literacy, staff support, teaching and assessment, academic integrity, and sharing practice¹. QAA’s advice focuses on assessment and quality standards⁵. The ICO’s guidance on AI and data protection sets out how UK GDPR applies to AI⁶. Colleges and trusts should also read the Department for Education’s guidance on generative AI in education, which recommends that personal data isn’t used in generative AI tools⁷. Jisc’s National Centre for AI has collected published policies from UK universities, which helps when you want to see how others have worded a section⁸.

Then turn those principles into decisions staff can act on. If you’re working on the wider rollout as well, our guide to implementing AI at your university shows where policy sits alongside strategy, tools, and training.

A university AI policy template

Use this skeleton as a starting point. Each heading needs a short section, written in plain English, with examples from real roles.

1. Purpose and scope. Who the policy covers (staff, students, contractors, researchers), which activities it applies to, and how it links to your data protection, information security, and academic integrity policies.
2. Approved tools. The AI tools staff may use, the account they must use them in, and how to ask for a new tool to be reviewed. Be specific about licensed and free versions: our article on Copilot licensing for universities explains why the account matters.
3. Data classification and what must never be entered. Map your existing data classes to AI use, then list the red lines plainly: personal data, student records, health information, unpublished research, and anything confidential.
4. Acceptable and unacceptable uses. Examples of suitable tasks, tasks that need a human check, and tasks that stay off AI entirely. A Green/Amber/Red Decision Matrix works well here.
5. Disclosure. When staff should say they’ve used AI, and a short standard wording for doing it.
6. Academic integrity and assessment. How AI rules are set for each assessment, how students are told, and which decisions, such as marking and misconduct outcomes, stay with people.
7. Accountability and review cycle. Who owns the policy, who approves new tools, how breaches are reported, and when the policy is reviewed. Once a year is the minimum.
8. Training. What training staff must complete, when, and how you’ll know it worked.

Keep the policy itself short. Put the detail, such as tool lists and examples, in guidance underneath it, so you can update those pages without sending the whole policy back through committee.

How to write an AI policy staff will follow

A few habits make the difference between a policy staff use and one they ignore.

Give it one owner. Policies drafted by large working groups tend to collect caveats. Name one person responsible for the text and its upkeep, with a small group to test it.

Write for the reader at the point of use. The test for every sentence is whether a member of staff could act on it while they’re deciding whether to use a tool. “Never enter student names into an AI tool” passes. “Exercise appropriate caution with personal data” doesn’t.

Test it with real tasks. Before approval, give the draft to a few people from different roles and ask them to classify ten real tasks against it. Where they disagree, the policy isn’t clear enough yet.

Publish it where staff work. Link the policy from the intranet pages staff use every day, from the sign-in page of each approved tool, and from staff induction. A one-page summary, with the red lines and the approved tools on it, gets read far more often than the full document. Ask managers to walk through it with their teams in a regular meeting, using one or two tasks from that team’s own work.

Separate staff and student rules. Staff and students need different guidance. Student rules belong in assessment briefs as well as the policy. Our article on AI for academic assessment covers setting AI rules for individual assessments.

Link the policy to the wider picture. Data protection, accessibility, bias, and honesty all sit behind an AI policy. Our guide to responsible AI in higher education covers what staff need to know in each area.

How training makes a policy real

A policy tells staff what the rules are. Training is how they learn to apply them. The two need to be built together, and most institutions treat them separately.

Generic AI training tells staff that data protection matters. It can’t tell them which tools your institution has approved, how your data classes map to AI use, or what your disclosure wording is. That’s the knowledge staff need at the moment they’re deciding what to paste into a prompt.

Good policy training does three things:

• Uses your own rules. Your approved tools, your red lines, and your examples, not a sector average.
• Practises decisions, not definitions. Scenario questions, such as spotting the red flags in a prompt or sorting tasks into green, amber, and red, show whether staff can apply the policy, not only recite it.
• Sits inside practical skills training. Staff take the rules more seriously when they learn them while doing real work with AI, rather than in a separate compliance module.

This is what our white-labelled courses are for. We build an asynchronous course in your institution’s branding around your own AI policy, incorporating up to ten of your policy and guidance documents, and deliver it as a SCORM or xAPI package for your own learning management system (LMS). It’s live within four weeks of us receiving your policy. Every course includes compliance scenario questions, so you can see whether staff can apply the policy as well as whether they’ve completed the training.

Review the policy and the training together

AI tools change faster than most governance cycles. A new feature can change what’s safe to do with a tool overnight. Set a fixed annual review date for the policy, and a lighter quarterly check of the approved tools list and guidance pages.

When the policy changes, the training should change with it. If the two drift apart, staff learn one set of rules and the policy states another. Tie the review dates together, and treat training content as part of the policy’s upkeep.

Use the review to learn from what’s happened. Which questions did staff ask most often? Which tools did they request? Were there any near misses with data? Each answer points to a section that needs to be clearer.

Check whether your policy is reaching staff

The quickest way to find out whether your AI policy has reached daily work is our free AI Capability Check. It’s a 30-minute call over Teams or Zoom, with no obligation. We’ll place your team on the AI Use Hierarchy, give you two or three prioritised next steps, and send you a written report to keep.

Book your free AI Capability Check

You can also explore the courses, including AI Foundations and Responsible Use, which we build around your own policy and tools.

Frequently asked questions

Do UK universities need an AI policy? There’s no specific legal requirement, but data protection law applies to AI use, and the Russell Group, QAA, and Jisc all encourage institutions to set clear guidance. Most UK universities now have one.

What should an AI policy for staff include? Purpose and scope, approved tools, data rules, acceptable and unacceptable uses, disclosure, academic integrity and assessment, accountability and review, and training.

How long should a university AI policy be? As short as possible. Keep the core policy to a few pages, and put tool lists and examples in guidance underneath it, so they can be updated quickly.

How often should an AI policy be reviewed? At least once a year, with a lighter check of the approved tools list every few months, because the tools change faster than most committee cycles.

How do we make sure staff follow the AI policy? Train staff on your own policy, using scenarios from their roles, and measure whether they can apply it. A free AI Capability Check shows where to start.