AI Policies & Guidelines

The idea

Policies and guidelines are the point at which principles become enforceable. The word “policy” actually covers a family of instruments that are frequently conflated but carry very different binding force, from binding policies and measurable standards, through advisory guidelines, to enabling and governance mechanisms (the page below lays them out). Selecting the wrong instrument is itself a failure: a rigid policy where guidance is appropriate constrains practice unnecessarily, while guidance where a binding rule is required leaves a gap. The task is to match the instrument to the decision, and to let each move at its own speed.

A common error at this stage is to write policy around a specific current product. This pillar is operationalized through audience-specific acceptable-use guidance keyed to the institution's data-classification levels; a campus-wide course-expectations framework so that every syllabus states its AI rules; and lifecycle mechanisms (review cycles, exception paths, and version control) that allow rules to remain valid as products are discontinued and replaced. Rules written at the level of behavior, data, and risk remain applicable longer than the products they govern.

Critically, most institutions are not starting from a blank page, and the right response depends on what kind of question AI raises. Where AI is simply a new input to a process that already has rules, procurement and vendor review, data classification and handling, records retention, information security, the move is to amend and extend those existing policies rather than write a separate AI version that duplicates and eventually contradicts them. Where AI raises genuinely new questions that no current policy answers, disclosure of AI-generated work, academic-integrity expectations, when a human must stay in the loop on an AI-assisted decision, accountability when one goes wrong, the institution does need new, AI-specific guidance, because there is no existing document to fold it into. The discipline is matching the response to the question: extend what already governs the operational and risk side, and author only what is genuinely new. Done this way, the rules inherit the authority and the owners of the policies people already follow, and the institution avoids both the contradictions of a parallel rulebook and the silence of having no answer at all.

How you can tell

This is where the pillar stops being a principle and becomes work. Each practice below is something you can build, assign, and evidence, with a concrete first move, an owner, and what proof looks like. Move one practice up one level at a time.

In practice

Watch for

• Tool-specific rules that rot at the speed of the vendor market.
• Publishing one long legal document instead of short, audience-specific versions people will actually read.
• No exception path, so the policy is either ignored or routed around.
• Building a freestanding AI policy that ignores the security, privacy, and procurement rules already on the books, creating overlap, contradiction, and an orphaned document no office owns.

Principles for durable policy

Before drafting anything, adopt the stance that keeps AI rules useful as the technology shifts. Two moves matter most: build on the policy you already have, and govern technology-neutrally so the rules outlive any single tool.

Policies and guidelines are not the same thing

“Policy” is shorthand for five different instruments, and they carry different levels of compliance. A binding, enforced policy is not the same as an advisory guideline, and treating them alike either over-controls low-risk use or under-protects high-risk use. Naming the type sets the right expectation, and lets each move at its own speed: binding policy changes slowly through shared governance, while guidelines and enablement adapt quickly as the technology does.

These five instruments run across all nine AI governance domains, from teaching to procurement, so the same vocabulary describes a syllabus rule and a vendor standard. Two tests decide whether any instrument is actually working: is it calibrated to risk (an AI writing assistant should not face the same scrutiny as an algorithm that affects financial aid), and can the people it governs find it? A policy no one can locate in five minutes is not governing, it is only documented.

Acceptable-use grid

A starting Red / Yellow / Green map of common AI uses by audience. It turns the policy into an at-a-glance answer to “am I allowed to do this?” Adapt every cell to your own institutional rules before publishing.

Syllabus statement bank

Ready-to-adapt syllabus language so every course can state its AI expectations in aligned terms. Pick the stance that matches the assignment, then tailor it.

Apply this pillar