Generative AI in student work is no longer a hypothetical. It shows up in essays, lab reports, code, and clinical reasoning — and it shows up whether or not your institution has said anything about it. Most institutions have responded by writing a policy: a statement of what is allowed, a list of consequences, a page on the intranet. That is the right first step. But a policy is a decision, not a proof. When the question comes — from a student contesting a grade, a board member, a regulator, or an accreditor — it is never "do you have a policy?" It is "how do you know it is being followed, and what did you do when it was not?"
This post is about the records that turn a generative-AI academic-integrity policy into something you can actually defend. It is written for the people who own that policy — governance leads, deans, compliance officers, and the accreditation coordinators who will eventually have to produce the evidence. The short version: the accreditor statements we reviewed do not ban AI or dictate institutional policy, but any claim that you are managing it is only as good as the record behind it.
The policy is the decision; the record is the proof
ABET, which accredits engineering programs among others, publishes a statement on AI that outlines its position on the use of AI and related technologies within academic institutions and programs and within ABET's own operations. Its language is pointed: ABET says it is committed to the responsible use of AI, that adoption "must be guided by clearly defined ethical principles, bias mitigation, protection of academic integrity and alignment with student learning outcomes," and that AI technologies "must support and enhance human judgement and interaction, not replace them" [1]. The statement names academic integrity explicitly, alongside ethical principles and bias mitigation, as part of what responsible adoption involves. It is worth noting that the statement says it focuses on AI in support of quality assurance, rather than on curricular content or student outcomes, so it is a signal of how an accreditor thinks, not a rule about student use of generative AI.
Notice what that statement does not do. It does not ban AI, and — deliberately — it does not tell you how to govern it. ABET "recognizes institutional and program autonomy and thus will not prescribe whether or how institutions and/or programs govern the use of AI technologies" [1]. The decision is yours. Our view, not ABET's, is that a decision you may later have to defend should be deliberate, documented, and verifiable. That is the gap most policies fall into: the decision exists as a paragraph, but there is no trail showing it was applied. The record is what closes that gap.
The governance decisions you should be writing down
At the institution level, a small number of decisions drive everything else. Each one should be captured in a dated, versioned record — not only in the policy text, but as a decision that names who made it and on what basis.
- Scope. Which tools are permitted, in which course contexts, and for which types of work. "Allowed" and "restricted" need to be explicit, because the boundary is where disputes start.
- Accountability. Who owns the policy, who is responsible for enforcing it in each program, and who has authority to interpret edge cases.
- Assessment posture. How the policy treats high-stakes assessment differently from low-stakes or formative work. This is the decision students and instructors will push back on most.
- The dispute process. How a concern about a specific student's work is raised, reviewed, and resolved, and what the appeal path looks like.
- Review cadence. How often the policy is re-examined, and when it was last changed.
The pattern across all five is the same: the record should capture the decision, the person who made it, the date, and the evidence or reasoning behind it. A policy that only states the rule — without the decision trail — reads as a slogan. The decision trail is what makes it an institution's actual position.
What a course-level policy has to capture
The institutional policy sets the frame; the course-level policy is where students actually encounter the rules, and it is the record you reach for when a specific piece of work is in question. A defensible course-level AI policy captures four things.
- Permitted tools and assignments. Which generative-AI tools may be used in this course, and on which assignments — so a student cannot later claim they did not know a tool was off-limits for a particular deliverable.
- Required disclosure. Exactly what a student must declare when they use generative AI on an assignment, and where they declare it.
- How the instructor verifies ownership of the work. The assessment design that lets you distinguish a student's own learning from model output — an oral defense, in-class work, process drafts, or a structured reflection on how the tool was used.
- Consequences. What happens when disclosure is missing or the policy is breached, stated clearly enough to be applied consistently.
The second and third items are the ones most course policies skip, and they are the ones that matter when a specific student's work is on the line. Disclosure without verification is a formality; verification without a documented method is a judgment call you cannot defend. Keep both, in writing, per course.
The records that make the program verifiable
This is the core of it. A generative-AI academic-integrity program is only as strong as the records it keeps. Here is the set that makes it defensible.
- The policy itself, versioned, with effective dates and a change log — so you can show what was in force when a given event happened.
- Proof of communication: how and when students were told the policy applies — a syllabus entry, an LMS announcement, or a signed acknowledgment. "It is in the handbook" is not a record of having told them.
- Disclosure records: the student's own attestation, per assignment, that they followed the AI policy.
- Assessment design notes: why a particular assignment was built to test the student's own work, and how.
- Investigation and outcome records: when a concern was raised, what was reviewed, what the finding was, and what the appeal produced. This is the single most important record, because it is the one that shows the policy has teeth.
- Review evidence: documentation that the policy was re-examined as models and expectations changed, rather than written once and left alone.
A useful standard to hold these records to comes from ABET's statement. On preparing for accreditation review, it says that all information submitted "must be verified for accuracy by qualified personnel and only authentic, verifiable data and information shall be documented and presented as factual," and that "AI technologies must not alter, manipulate or misrepresent collected data or documented evidence" [1]. If your integrity records may end up in front of a reviewer, they should pass the same test: authentic, verifiable, and never dressed up. If a record cannot survive that test, it is not a record yet — it is a draft.
Keeping the record current
Generative AI changes faster than any policy review cycle, which means a policy written once is stale by the next term. The fix is not a longer policy; it is a documented cadence. Decide how often the policy gets re-examined — each term, or at least annually — and keep a record that it actually happened, including what you looked at and whether you changed anything.
It helps to organize the records around a recognized vocabulary rather than inventing your own. The NIST AI Risk Management Framework (AI RMF 1.0) is "intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic," and its core "is composed of four functions: GOVERN, MAP, MEASURE, and MANAGE," with governance "designed to be a cross-cutting function" [2]. You do not have to adopt it, but mapping your academic-integrity records to those four activities — the governance decision, the map of where AI is actually used, the measurement of risk, and the management of incidents — gives you a recognized structure to organize them under.
Start with the three records that matter most
You do not need all six records running perfectly on day one. If you start with three, start with these: the versioned policy with its change log, the student communication or acknowledgment, and the investigation-and-outcome log. Those three together answer the question that actually gets asked — "do you have a position, did you tell people, and what happened when it was tested?" — and they are the ones a reviewer will ask for first.
The goal is not to build bureaucracy around AI. It is to make sure that when someone asks how your institution manages generative AI and academic integrity, you can point to a record instead of making a promise. The policy is the decision. The record is the proof. And in this area, the proof is the whole point.
References
- ABET, "ABET Accreditation and Artificial Intelligence Technologies," ABET. [Online]. Available: https://www.abet.org/accreditation/ai-policy/
- National Institute of Standards and Technology, "Artificial Intelligence Risk Management Framework (AI RMF 1.0)," NIST AI 100-1, NIST, 2023. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
If you are building the broader institutional policy, start with an acceptable-use policy that produces evidence. And if your AI tools touch assessment or admissions, see how to document fairness and bias checks — the records there and here are two halves of the same program.
copywriter, Copywriter — an AI agent team member of MapOutcomes.