Five-Tier GenAI Governance Framework
Each tier represents a qualitatively distinct institutional governance state. Select a tier to read its full definition, developed through comparative analysis of cross-regional institutional policy evidence.
Maturity Tiers
Select any tier to expand its full definition. Multiple tiers can be open simultaneously for comparison.
The institution has no settled position on generative AI. Responses are improvised by individual academics, schools, or committees as problems surface, typically an integrity incident or a tool that suddenly appears in classrooms. Guidance, where it exists, is informal, contradictory, and invisible to most staff and students. Across the six domains the dominant state is not in place. There is no named owner and no shared language; coherence is effectively absent. The institution is being acted upon by GenAI rather than governing it.
The institution has begun to respond deliberately, but in a concentrated and uneven way. Almost always the first movement is in Assessment and Academic Integrity, such as a disclosure rule or an updated misconduct procedure, while teaching, research, equity, privacy, and public trust remain largely untouched. Policies that exist tend to be statements of intent rather than embedded practice, and uptake varies widely by faculty. Ownership is partial or contested.
GenAI governance now reaches across multiple domains rather than sitting in one. Good work exists in several places but is not yet pulled together. Terminology drifts between documents, messaging to staff and students is not fully aligned, and a governance body may exist without clear authority. Coherence becomes the binding constraint on further progress, as the challenge shifts from writing policies to connecting them.
Coverage is comprehensive across all six domains, and the policies are integrated. There is a named senior accountable owner, an active governance committee with real remit, consistent terminology, aligned staff- and student-facing messaging, and a defined review cycle. GenAI governance is connected to broader institutional strategy. The institution is governing coherently, not merely complying.
Governance is whole-of-institution and self-renewing. Practices are embedded, reviewed on a defined cadence, audited, evidenced, and refreshed as tools and risks evolve. The institution co-designs with students, conducts equity and accessibility audits, reports publicly, and contributes to the wider sector. GenAI governance is treated as a living institutional capability rather than a finished document set.
Framework Overview
Visual overview of the five-tier GenAI governance maturity model, its six policy domains, and the relationships between tiers.
Policy Domains
Six governance domains assessed across all tiers, plus a cross-cutting Coherence Diagnostic that measures how well your policies work together.
Six domains, each with research-attributed indicators
Each indicator is scored 0–3 (Not in place / Partial / Substantially in place / Fully embedded). Attribution identifies the researcher and the source institution or country evidence base from which each indicator was developed.
- The institution has published principles governing GenAI use in teaching and learning
- Course outlines specify the scope of permitted GenAI use, including any restriction or risk classification levels
- Staff have access to professional development on GenAI pedagogy and are supported to experiment with AI-assisted teaching
- Curriculum design addresses GenAI's impact on learning outcomes; AI literacy is an explicit graduate attribute
- Students are trained to critically evaluate and verify AI-generated outputs rather than accept them passively
- Guidance clearly distinguishes appropriate AI-assisted learning from inappropriate reliance on AI-generated content
- Clear, published rules govern GenAI use in all assessed work, applied consistently across schools and faculties
- Students are required to disclose GenAI use in assignments and submissions via a defined declaration process
- Assessment design has been reviewed to incorporate GenAI-resilient approaches across programmes
- Academic misconduct procedures explicitly address GenAI, with a defined detection or verification approach
- Markers and examiners receive guidance on assessing work where GenAI may have been used
- Policies specify permissible AI-assisted activities and distinguish these from AI-generated replacement of student work
- Human research ethics processes explicitly address GenAI use in research design, data handling, and analysis
- Researchers are required to disclose AI-assisted drafting, literature review, data analysis, and content generation
- Institutional guidance covers authorship, attribution, accountability, and the limits of AI-generated research outputs
- Research integrity training includes GenAI-specific modules; discipline-specific guidance is available
- Compliance with external research funder requirements regarding AI use is explicitly addressed
- GenAI governance in research is integrated with broader responsible AI and research ethics principles
- Institutional decisions on GenAI explicitly consider equitable access across diverse student cohorts
- Guidance addresses disparities arising from paid versus free AI tool tiers and unequal prior digital competence
- AI literacy support is embedded in student services and treated as part of educational inclusion policy
- Assessment and grading guidance accounts for variations in student access to GenAI tools
- Students who choose not to use AI tools are provided equivalent alternatives and are not disadvantaged
- An equity audit of GenAI policies has been conducted, addressing EAL, international, and disadvantaged cohorts
- Privacy implications of GenAI use are documented; guidance covers GDPR or equivalent compliance requirements
- Staff and students are advised not to input confidential or sensitive institutional data into public AI systems
- Users are informed of risks related to data retention, third-party processing, and external AI service provider terms
- An approved and prohibited GenAI tools register is maintained; data classification covers what may be entered into AI tools
- Procurement prioritises contracted vendors or local sandboxes with data protection agreements over public AI accounts
- A cybersecurity review of AI tools in use has been undertaken; records management addresses AI-generated content
- The institution has published a substantive, publicly accessible statement on its GenAI governance position
- Decision-making processes around GenAI policy are documented; community and student consultation informs governance
- Transparency and disclosure principles are promoted when GenAI contributes to academic or institutional outputs
- Named individuals or bodies hold defined accountability for GenAI-related decisions and errors arising from AI use
- A formal recourse process exists for students or staff with grievances related to AI-assisted decisions
- Annual reporting on GenAI governance progress is published; mechanisms exist for stakeholders to raise concerns
- Policies in different domains cross-reference each other where relevant
- Teaching, assessment, research, privacy and integrity policies present a consistent institutional GenAI position
- GenAI governance is coordinated across multiple institutional functions rather than managed through isolated policies
- Institutional AI policies are aligned with national regulatory frameworks and HE quality assurance requirements
- AI governance documents demonstrate coherence between policy statements and operational educational practices
- AI governance committees are structured with multi-disciplinary clusters to oversee holistic policy alignment
- There is a named senior accountable owner for GenAI governance; a committee oversees GenAI institution-wide; messaging to staff and students is aligned
- A review and update cycle for GenAI policies is defined and active; policies are integrated with broader institutional strategy
Scoring & Coherence
How domain scores combine into an institutional maturity score (0–100), and how the Coherence Diagnostic anchors overall classification.
Each indicator is scored 0–3. Domain raw scores are aggregated and converted to a 0–100 institutional scale, then mapped to the five-tier classification. The Coherence Diagnostic is evaluated qualitatively alongside the numeric score.