Universities are already deploying artificial intelligence (AI) in the places that generate the most complaints, appeals and reputational risk, such as assessment and feedback, admissions triage, academic integrity, student support, HR, research administration and procurement. Yet, we govern these systems as if they were ethics and compliance issues.
This misframes AI governance as something to be managed through value statements, ethics committees and consultation exercises rather than as a live operational problem in high-risk institutional systems. Pluralistic ideals remain necessary for legitimacy, but they don’t give you control. The parameters of control only show up once systems are live, because governance isn’t something you announce in a policy document. It’s something you do, continuously, inside the machinery while it’s running. The core argument here is that universities are mistaking legitimacy for control.
At the conceptual level, the mistake is simple: AI governance has been absorbed into the language of ethics. Fairness, transparency and accountability are important, but they are not governance. Governance is about who can decide, who can intervene, and how fast an institution can adapt when systems behave in unexpected ways.
- From peanut butter to effective policy impact
- Developing a GenAI policy for research and innovation
- Data management strategy in higher education: a blueprint for excellence
Advanced AI does not simply support decisions; it reshapes how institutional decisions are made across universities. In admissions triage, assessment workflows, student support, HR and research administration, it normalises recommendations into defaults, automates discretion out of workflows, and redistributes responsibility across organisational boundaries.
The most serious risks are therefore not isolated failures but systemic drift, feedback loops that quietly entrench outcomes before anyone has the authority, evidence or confidence to intervene.
Governance built around pluralistic processes – committees, consultations, stakeholder-balancing and consensus-seeking – works best when problems are slow, legible and negotiable. AI systems are none of these. They evolve during consultation, scale during review, and embed themselves long before consensus is reached. Treating governance as a deliberative exercise under these conditions is ineffective.
And once governance fails at the process level, a harder constraint appears: governance isn’t just an internal management problem, it’s shaped by the political economy. So, if your teaching platforms, student support tools or research workflows depend on models you cannot audit or control, and contracts you cannot exit, then your governance framework is mostly symbolic.
This is why so much higher education commentary stalls at responsibility. It moves quickly from the claim that AI is powerful to the demand that institutions must act responsibly, without spelling out how failure emerges in practice. The mechanism is mundane: AI compresses decision time; compressed time pushes organisations towards defaults; defaults settle into routine; and routine runs ahead of accountability. Meanwhile, legitimacy erodes quietly, long before any single catastrophic failure appears.
Once this chain is visible, the limits of ethics-by-committee become obvious. You cannot govern fast, adaptive systems with slow, episodic oversight. You need continuous feedback, not periodic assurance.
This is not just theoretical. Work undertaken at the Web Science Institute illustrates what changes when governance is treated as a live institutional problem. Rather than studying AI from a distance, interdisciplinary teams embedded technical, social and legal expertise into live deployments. The focus moved from models to institutions, and the questions changed accordingly: where does accountability sit? How are outputs interpreted under time pressure? What happens to trust when recommendations become routine?
Seen this way, problems surfaced earlier and in more ordinary forms. Failure didn’t arrive as a headline incident; it showed up in small, repeatable behaviours that became visible once teams were embedded in live systems.
In response, the shift wasn’t another framework but a redesign with clearer escalation paths, tighter limits on where automation was permitted, and explicit decision rights about when to pause or roll back a system.
The lesson was straightforward: treat friction as information, not reputational risk to be suppressed.
Thinking differently about AI governance means making a few uncomfortable decisions:
- Decide who has the authority to pause or redesign an AI system once it is live. If no one holds that authority, governance does not exist. For example, an AI-supported admissions triage system begins systematically downgrading applicants from certain departments or faculties. Complaints rise, but responsibility is split across admissions, IT, legal and the supplier. No one has the authority to halt the system mid-cycle, so it continues running while the institution reviews the issue. By the time action is taken, the admissions round is over, and the damage is done.
- Ethics boards upstream of deployment are necessary but insufficient. Authority must sit near the system, where behaviour is visible, and drift can be detected early. In practice, this means that an ethics committee may approve an AI-assisted assessment tool, but once it is live, markers begin deferring to its recommendations under time pressure. The committee never sees this behavioural shift. Authority sits upstream, while drift happens downstream, so governance fails not because principles were wrong, but because no one close to the system was empowered to intervene when practice diverged from intent.
- In a world of continuous deployment, retrospective audits arrive too late to matter, so governance must operate as a loop that observes, intervenes and adapts. Consider a student support chatbot that is updated weekly by a supplier. That audit six months later may confirm compliance, but it cannot capture how tone, escalation thresholds or refusal behaviours changed week by week. A governance loop would monitor live interaction patterns, flag shifts in response behaviour, and allow teams to intervene immediately, not after complaints accumulate or trust has eroded.
- Trust is maintained through explainability, contestability and speed of response, not through assurances of good intent. If students and staff cannot challenge decisions in practice, legitimacy will decay even if principles are sound. If a student is flagged by an academic integrity system, governance is not demonstrated by a policy explaining how the model works. It is demonstrated by whether that student can challenge the decision quickly, reach a human with authority, and receive a timely outcome before consequences compound. When appeals take weeks and explanations are generic, trust collapses regardless of how principled the framework appears on paper.
The point isn’t that universities are negligent; it’s that they are structurally misaligned with the speed and complexity of the systems they are helping to create. Universities that advise governments on AI governance without testing those ideas inside their own institutions risk a growing credibility gap – not because the analysis is wrong but because it is unproven under real conditions.
Alistair Sackley is a specialist policy officer in the Web Science Institute at the University of Southampton.
If you would like advice and insight from academics and university staff delivered direct to your inbox each week, sign up for the Campus newsletter.
comment