AI in Higher Education: Governance, Academic Integrity, and the EU AI Act

Higher education is absorbing two shocks simultaneously. The first is cultural: generative AI has made it trivial for a student to produce fluent prose, working code, or a passable essay in seconds, straining assessment models built on the assumption that written output reflects individual effort. The second is legal: the European Union has placed a wide range of educational AI in the highest-risk tier of its AI Act, with binding obligations that phase in before 2 August 2026.

These pressures are related but distinct. One is about how institutions maintain the meaning of a qualification; the other is about how they deploy AI systems lawfully and accountably. Both demand governance rather than gadgets. This brief describes the regulation and the integrity landscape as they stand, and what institutions are responsible for putting in place. It does not certify any product against the law — under the AI Act, conformity is a formal process, and responsibility rests with providers and the institutions that deploy their systems.

The EU AI Act sorts systems by risk. A narrow set of uses is banned outright; a broad middle tier is designated high-risk and subject to strict obligations; the rest face only light transparency duties. Education sits squarely in the high-risk tier. Annex III of the Regulation lists four categories of AI use in education and vocational training as high-risk:

• Systems used to determine access, admission, or assignment of people to institutions at any level.
• Systems used to evaluate learning outcomes, including where they steer a learner's process.
• Systems used to assess the appropriate level of education a person should receive or can access.
• Systems used to monitor and detect prohibited behaviour by students during tests, i.e. proctoring.

The logic is that these systems make or heavily influence decisions about a person's life chances — who gets in, what grade they earn, whether they are accused of cheating. That is precisely the terrain of admissions AI, automated assessment, and remote proctoring. Institutions should assume that these use cases fall in scope by default and treat any claim of exemption as something to document, not presume.

The AI Act does not switch on all at once. Its prohibitions and AI-literacy duties applied first, in early 2025. The obligations that matter most for educational AI — the full high-risk regime for the systems named in Annex III — become enforceable on 2 August 2026. That date is the practical planning horizon for any institution running or procuring admissions, assessment, or proctoring AI.

Roles matter here. The provider that develops or places a system on the market carries the bulk of the conformity obligations. The institution that uses it is a deployer, with its own duties: using the system according to instructions, ensuring meaningful human oversight, monitoring operation, and keeping the logs the system generates. A university cannot fully outsource its exposure by buying a compliant-looking tool; deployer obligations are independent, and due diligence on the provider is part of them.

Alongside the regulation runs the integrity question. Generative AI can complete much of the written work that has long served as a proxy for learning, which pushes institutions toward detection tools. Here the evidence is a caution rather than a solution. A 2023 Stanford study published in Patterns ran non-native English (TOEFL) essays through seven commercial AI detectors and found that, on average, more than 61 percent were misclassified as AI-generated, versus about 5 percent of essays by native speakers. The detectors were, in effect, penalising simpler vocabulary and sentence structure — a bias with direct fairness consequences for international and multilingual students.

Detection vendors themselves now caution against using a probability score as the sole basis for a penalty, and teaching centres warn that current tools are not reliable enough to accuse a student without corroboration. An AI-detection score is at best one weak signal in a human-led process — and, notably, an AI system used to flag prohibited behaviour in assessment may itself fall within the Act's high-risk scope, inheriting the documentation and oversight duties above.

The high-risk designation is tied to use, not to the technology in the abstract, and the distinction is practically important. A conversational AI tutor that helps a student work through a problem, offers explanations, or drafts practice questions is not, by that function alone, making a consequential decision about the student. Used purely as a study aid, it sits closer to the Act's lighter transparency tier — with the main duty being that users are told they are interacting with an AI.

The same underlying model becomes high-risk the moment its output is used to evaluate the learner — to assign a grade, gate progression, decide admission, or flag suspected misconduct. This is why governance has to attach to the workflow rather than the tool: the identical component can fall on either side of the line depending on whether a human decision or an automated one depends on it. Institutions should map each deployment by the decision it feeds, not by the label on the software.

The regulation and the integrity pressure converge on the same answer: institutions need process, not just tools. UNESCO's 2023 guidance for generative AI in education argues for a human-centred approach — appropriate age thresholds (it points to a classroom baseline of 13 for independent use), data-protection guardrails, and AI that augments rather than replaces human judgement. The EU framework operationalises much of that spirit through documentation, oversight and traceability.

For an institution, the durable building blocks look consistent regardless of which vendor is chosen:

• Maintain an inventory of AI systems touching admissions, assessment and proctoring, and classify each against Annex III.
• Keep documentation and logs for high-risk systems, and require them from providers as a procurement condition.
• Guarantee meaningful human oversight — a named person able to review, override or halt an automated decision, not a rubber stamp.
• Be transparent with students about where AI informs decisions about them, and provide a route to challenge.
• Redesign assessment toward tasks that are harder to outsource — oral defences, in-class work, process-visible submissions — rather than relying on detection.

The design principles that follow from the Act — transparency about where AI is used, human oversight over consequential decisions, documentation and logging, and data governance — are ones a platform can be built to support. That is the sense in which educational AI can be aligned by design: architected so that the controls the regulation expects are available rather than bolted on. It is not the same as being certified or compliant. Conformity under the AI Act is a formal responsibility that rests with providers and deployers, decided case by case against the system's actual use, not a badge a tool carries.

The practical posture for institutions before 2 August 2026 is therefore twofold. Treat the AI Act as a genuine compliance programme with named owners, an inventory, and documentation — not a marketing checkbox. And treat academic integrity as a design and assessment problem first, a detection problem a distant second. The technologies that hold up under both pressures will be the ones whose governance is deliberate, legible, and human-supervised by construction.