Professor Sam Illingworth’s new HEPI Policy Note, What UK university AI policies actually do, is an uncomfortable read in the best sense. He analysed AI policies at 96 UK institutions and found a now-familiar pattern, that the emphasis was on learning but on compliance (’detection and discipline’) frameworks. Policies that promise critical thinking but build audit trails. Documents that name ‘support’ but operate as surveillance. The gap between what these policies say and what they structurally do, he argues, is the central finding, and it matters because the location, structure and vocabulary of a policy quietly determine what an institution actually authorises.

He is right (although I think critical thinking and audit trails can coexist peacefully, (insert smiley emoji). The structural critique is important, and the four exemplars he holds up, including Durham, Stirling, Canterbury Christ Church and Arts University Plymouth, give the sector something concrete to learn from.

However, I want to add something to this conversation, because the policy page is not where the work actually happens, but our classrooms, and it is in these spaces that the questions get harder.

The gap is also a paradigm gap

When Illingworth describes the gap between what policies say and what they do, the framing is largely structural, where the policy sits on the institutional website, whether it is housed in misconduct or in teaching and learning, whether it explicitly extends trust. These are necessary diagnoses.

What the paper points to but does not fully name is that this is also a paradigm gap. Many institutions (or should this be educators?) have not yet decided where they stand on AI. Is it a learning tool we are supporting students to use well? Is it an integrity threat we are containing? It cannot be both with equal weight, and you can hear the indecision in the documents themselves, with confident sentences about “critical literacy” which are followed a few paragraphs later by penalty matrices borrowed wholesale from the essay-mill era.

Is this because policy writers are unsure? Or is it because the sector itself has not yet worked out what AI is for in education? No policy document will be coherent if the underlying paradigm is not. The AI conversation can be messy because it’s rarely about AI, and it’s rarely about what we are doing or how we are doing it, but about why.

Feet on the ground, hands in motion

A more coherent stance, for me, has two parts, and my thinking is inspired by Somayeh Aghnia’s HEPI post on the tempo conflict at the heart of AI.

The first is rooted. There are things about good teaching that AI does not change. Students still need to develop judgment, fluency, voice, and the ability to think their way through a problem they have not seen before. The purpose of higher education is not altered by a more capable autocomplete. A policy that makes sense has to be anchored in what we believe an educated person still needs to do.

The second is mobile. The tools, the techniques, the appropriate use cases, these are moving faster than any policy document can keep up with. A policy that names a specific tool or fixes a specific permitted-prohibited list will be out of date by the next academic year. Policy 4.2.1.1.1, anyone?

The work is to keep our feet on the ground, where we are clear about what we want students to know and be able to do (learn), why we want it, and what assessment is for, while keeping our hands in motion, remaining flexible about the tools and methods through which those outcomes can be achieved.

That posture is harder than either pure restriction or pure encouragement. It requires us to admit, structurally, that we are all still learning, and that learning is iteration. Treating policy as fixed is treating learning as fixed. Neither is true.

Whose voice, and who is heard

Illingworth’s call for student voice in AI policy development is right, and the gap he identifies is striking. Most institutions in his sample showed little evidence of student involvement.

However, ‘student voice’ is itself a phrase that can do compliance work. As an educator, I know there is a difference between voices that speak and voices that are heard. The student who agrees to be in a focus group is speaking. The students who do not turn up because the time clashes with their shift are not in the room. The international student who comes from a culture where disagreement with a tutor is taboo may be speaking, but not in the way the policy designers expected. The disabled student whose use of AI is the difference between a good degree and not having one is rarely the example anyone asks about. What about the students who don’t want to use AI at all?

The same logic applies above the student line. Whose voices, insights, and expertise feed in at the design stage vs the validation stage? When we say ‘stakeholder engagement’, we often mean the people whose presence is expected as a matter of procedure. A policy genuinely shaped by voice has to ask, every time, who is not in this room and why.

Compliance training is not the opposite of education

There is one place in Illingworth’s paper where I do not fully agree.

He writes: “Teaching students how to use ChatGPT correctly is compliance training. Asking students to interrogate the assumptions, biases and power structures embedded in AI systems is education. The difference between these approaches is the difference between producing compliant users and producing critical thinkers.”

I understand the rhetorical force of this, and I share the worry it addresses. However, I do not think the binary holds up, and presenting it as one makes the educator’s task harder, not easier.

Teaching a student to use an AI tool well is education, if it is taught with diligence, which includes a sense of responsibility for the work, an awareness of what the tool is and is not doing, and a willingness to verify, correct and own the result.

A good analogy is learning to drive. We do not separate learning to drive from learning to drive safely. Driving safely is learning to drive. A driver who can operate the controls but cannot judge a junction, anticipate a hazard or stop in time has not been taught to drive; they have been taught to move a car. We would not call that a complete education, nor would we put them on the road.

I have found the 4D Framework for AI Fluency (Delegation, Description, Discernment, Diligence) really helpful in thinking about AI in my practice, and it also makes this point explicit. Deciding whether to use AI is a literacy; communicating with AI is a literacy; evaluating its outputs is a literacy; and taking responsibility for AI-assisted work is a literacy.

A student who can interrogate the assumptions of a large language model but cannot decide when not to use one has not been educated to use AI critically. A student who can write a beautiful prompt but cannot evaluate whether the answer is true has not been educated to use AI critically. Both of those students are at risk, and so are the graduates we send into clinical, research and professional settings where the consequences of non-diligent AI use are not only academic but ethical.

Critical literacy and competent use are not in opposition. They are two parts of the same education. The binary that separates them lets institutions choose one and call it sufficient. We need both.

Some of this work is happening already. The RSB Bioscience Awarding Gap Network has put together a free, open-access AI Literacy Equity Toolkit that includes frameworks, templates, design canvases, and ready-to-use activities for educators who want to address AI literacy in their teaching but are unsure where to begin. It is not an argument that more AI is better. It is a starting point for the building work that the policy page cannot do on its own. Pick one element, use it, and tell us what worked or not.

What the policy page should be

If I had to summarise what I am taking away from this study, it would be this. An AI policy is not a document. It is a position. It tells a student what the institution thinks they are capable of, what it thinks AI is for, who it consulted before making its decision, and whether it is willing to keep changing its mind as it learns.

A policy that does that work, one that sits in teaching and learning, that extends trust by default, that includes the voices that actually carry the weight of teaching and learning, and that treats itself as version 4.2.1.1 of a thing still being figured out can be a piece of pedagogy in its own right.

The policy page is not where the work happens. However, it is where the institution makes a promise about the kind of work it intends to do. This study has given us a sharper way to read those promises. The harder question, especially for those of us who teach, is what we are willing to build underneath them.