WEBINAR @ 13th May, 2 PM (GMT+1)
What's Stopping Progress in Higher Education?
Register now
Artificial intelligence is already part of higher education. It is not waiting on a strategy paper or a committee decision. Students are using generative AI to structure essays, revise for exams and prepare for interviews. Staff are using it to draft communications, summarise documents and speed up routine administration. Vendors are embedding AI into the systems institutions already run. Admissions and marketing teams are experimenting with it. Academic teams are rethinking how assessment should work when a chatbot can produce a plausible first draft in seconds.
For most institutions, the question is no longer whether AI will affect higher education. It already does. The more useful question for leaders is narrower and more practical: how can an institution use AI where it genuinely adds value, while protecting students, staff, academic standards and institutional trust?
This is a practical guide for higher education leaders. It is written for the people who have to make AI work in the real world: vice-chancellors and principals, deans and directors, CIOs and IT directors, data protection officers, registrars, and the admissions, enrolment, student services, marketing and operations teams who sit at the centre of institutional life. It is not a hype piece, and it is not a warning about cheating. It is an attempt to describe what responsible, governed AI adoption actually looks like across recruitment, admissions, the student lifecycle, data governance and institutional systems.
The argument running through it is simple. The strongest AI strategies do not start with tools. They start with governance, data quality, clear use cases, honest risk assessment and human oversight. Tools come later, once you know what problem you are solving and who is accountable for the outcome.
The phrase gets used loosely, so it is worth defining.
Navigating AI in higher education means creating the policies, data foundations, workflows and human oversight that allow institutions to use AI where it adds value while protecting students, staff, academic standards and institutional trust.
In practice, that means moving from scattered experimentation to governed adoption. It means identifying use cases that are genuinely useful rather than merely novel. It means managing risk in proportion to impact, protecting student data, supporting staff and students with clear guidance, keeping humans accountable for decisions, aligning AI use with institutional strategy, and reviewing that use as the technology, the regulation and your own understanding all change.
None of that requires banning AI, and none of it requires adopting every new product on the market. It requires a considered position, applied consistently.
For a while, AI in universities was treated as either an academic integrity problem for exam boards or an infrastructure question for IT. That framing no longer holds. AI now touches almost every part of institutional activity, which is precisely why it has become a leadership issue rather than a departmental one.
The evidence points the same way. In the 2025 EDUCAUSE AI Landscape Study, based on responses from 788 higher education professionals, only around one in ten reported that their institution had no AI-related strategy at all, and the share of leaders described as cautious or very cautious about AI fell from roughly 23 per cent in 2024 to about 20 per cent in 2025 (EDUCAUSE, 2025). EDUCAUSE research into the impact of AI on work in higher education found that a large majority of respondents, around 81 per cent, expressed either enthusiasm or a mix of caution and enthusiasm toward AI (EDUCAUSE, 2026).
Attitudes are warming, in other words, but policy has not always kept pace. EDUCAUSE's 2026 research on the impact of AI on work in higher education, based on 1,960 qualifying responses, found that AI is now touching every area of institutional work, yet only around half of respondents said they were aware of the policies and guidelines meant to guide that use, even as institutions continued to focus on upskilling their existing staff and faculty (EDUCAUSE, 2026). That gap between widespread use and clear guidance is the practical risk most institutions now face.
Students feel it too. Jisc's latest student perceptions research, drawn from discussion forums with more than 200 students and learners across UK colleges and universities, found that although 86 per cent of universities and 49 per cent of colleges reported having student guidance in place, students still said they were unclear about what use of AI was and was not allowed (Jisc, 2025). Guidance that exists on paper is not the same as guidance students understand.
Put together, the picture is one of rapid adoption, growing acceptance, uneven governance and persistent uncertainty. That combination is why AI now belongs on the leadership agenda alongside data protection, regulation, reputation, equity of access and operational efficiency.
It helps to be concrete about where AI can add value, and equally concrete about the risks attached to each use. The pattern that recurs across every area is the same: AI is strongest as a support to human work and weakest, and riskiest, when it is asked to make consequential decisions on its own.
AI can help recruitment and marketing teams draft campaign variations, suggest audience segments, summarise enquiries, localise content for different markets, prioritise leads for follow-up, and analyse campaign performance. It can also support first-line responses to common applicant questions.
The risks are mostly about accuracy and fairness. AI can generate confident but incorrect claims about programmes, fees or entry requirements. Targeting can embed bias. Personalisation can tip into intrusiveness. Tone and brand can drift. And any system that ingests enquiry data raises data protection questions that need answering before, not after, launch.
In admissions and enrolment, AI can summarise applicant context, suggest next steps in a workflow, draft communications, flag missing documents, help route applications, and support offer-holder engagement. For busy teams, that can meaningfully reduce the manual work of pulling information together.
The central rule is that AI must not make admissions decisions on its own. Decisions about access, offers and enrolment affect people's futures, which is exactly why they demand fairness, transparency, auditability and human accountability. As the next sections explain, some of these uses may also fall into high-risk categories under the EU AI Act. Human oversight here is not a nice-to-have. It is the point.
Student services teams can use AI to triage common queries, summarise case histories, suggest relevant resources, and surface deadlines or next steps, often through staff-facing assistants that keep a person in the loop.
The risks are sharp because the data is sensitive. Support cases frequently involve special category data such as health or disability information. Incorrect advice can cause real harm, sensitive data can be exposed, and an automated system that fails to escalate a serious case is a serious failure. Support is an area to approach carefully, with clear boundaries on what AI does and does not handle.
In teaching and learning, AI can support feedback, formative practice, tutoring, accessibility, content drafting and curriculum or assessment redesign. Jisc's research suggests students increasingly want to use these tools as a coach for active learning rather than simply as an answer machine, and that they value genuinely AI-ready skills for their future careers (Jisc, 2025).
The risks are well known: academic integrity, unreliable outputs, inequitable access where some students can afford premium tools and others cannot, and the erosion of the learning that assessment is meant to measure. AI detection tools are not a reliable answer, since their accuracy is contested and false accusations carry real consequences. The more durable response is assessment redesign, a theme UNESCO's guidance also emphasises (UNESCO, 2023).
Across professional services, AI can summarise meetings, help look up policy, draft documents, assist with reporting, support internal knowledge search and power internal service desks.
The risks here are confidentiality and accountability. Confidential information should not be pasted into public tools. AI can hallucinate a policy interpretation that sounds authoritative and is simply wrong. Weak audit trails make it hard to know what happened, and unclear ownership means no one is accountable when it goes awry.
AI can let staff query governed data in natural language, explain a dashboard, summarise trends, support scenario planning, draft reports and flag anomalies. For leaders who currently wait days for a custom report, that can be a real gain.
The catch is that outputs are only as good as the underlying data. Poor data quality, inconsistent definitions and missing source traceability produce answers that are misleading precisely because they look authoritative. This is the area where data governance matters most, a point we return to below.
Reduced to essentials, the risks that recur across higher education AI use are: hallucinations and inaccuracy; bias and discrimination; data protection and GDPR exposure; mishandling of special category data; academic integrity; intellectual property; cyber security, including prompt injection and data leakage; confidential data being entered into public tools; vendor lock-in; shadow AI, where teams adopt tools with no oversight; over-automation of decisions that need human judgement; lack of transparency and auditability; inequitable access; staff deskilling; loss of student trust; and reputational damage.
The answer to this list is not to ban AI everywhere. Blanket bans tend to drive use underground rather than eliminate it, which is worse for governance, not better. The workable answer is to govern AI according to risk: light-touch where the stakes are low, rigorous where they are high, and always with a human accountable for consequential outcomes.
For European institutions in particular, AI intersects directly with data protection law. Student and applicant records are personal data. They routinely include special category data such as health, disability or, in some contexts, ethnicity. Feeding that data into AI systems engages the full set of GDPR obligations, and the fact that a tool is popular or convenient does not change that.
The core questions are the familiar ones, applied to a new context. What is the lawful basis for the processing? Is the use compatible with the purpose for which the data was originally collected? Are you minimising the data involved, or pouring entire records into a prompt because it is easier? Are people told, in a way they can understand, how their data is used? How long are prompts and outputs retained, and where? Who is the controller and who is the processor? Are sub-processors accounted for? Are there international transfers, and are they lawful? Can data subjects exercise their rights? And does the use amount to automated decision-making with legal or similarly significant effects, which carries specific protections?
Regulators are actively working through how these principles apply to AI. The European Data Protection Board's Opinion 28/2024, adopted in December 2024, addressed data protection in the context of AI models. It concluded that whether a model trained on personal data can be considered anonymous has to be assessed case by case rather than assumed, set out how controllers might rely on legitimate interest through a structured three-step assessment, and reiterated the importance of core principles such as data minimisation (EDPB, 2024). Notably, it flagged special category data, automated decision-making, profiling and data protection impact assessments as areas needing further attention, which is a useful signal of where scrutiny is heading.
Two practical points follow. First, this is a matter for your data protection officer and, where needed, legal advisers. A data protection impact assessment is often the right starting mechanism for any AI use involving student or applicant data. Second, no vendor and no article, including this one, can tell you that a given use is "GDPR compliant" in the abstract. Compliance depends on your data, your configuration, your lawful basis and your controls. Full Fabric's own approach to these questions is set out on its security and GDPR compliance page and its Trust Centre, but tooling supports institutional policy rather than replacing the institution's own responsibility for lawful use.
Alongside GDPR, European institutions now need to understand the EU AI Act, which classifies AI systems by risk and attaches stronger obligations to those it treats as high-risk.
Annex III of the Act lists education and vocational training as a high-risk area. According to the official AI Act Service Desk, the relevant education categories cover AI systems intended to determine access or admission, or to assign people to educational and vocational training institutions; to evaluate learning outcomes, including where those outcomes steer a person's learning; to assess the appropriate level of education a person should receive or can access; and to monitor and detect prohibited behaviour by students during tests (AI Act Service Desk, Annex III; EUR-Lex, Regulation 2024/1689).
Two clarifications matter for leaders. First, high-risk does not mean prohibited. It means an AI system in these categories carries stronger obligations, typically shared between the provider that builds it and the deployer that uses it. Those obligations span risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness and cyber security. Second, there is a narrow route under Article 6(3) by which a system that would otherwise be high-risk may be treated as not high-risk where it does not pose a significant risk to health, safety or fundamental rights, for example where it performs a purely preparatory task (AI Act Service Desk, Article 6). This is a conditional exception rather than a general exemption. The Act specifies that it does not apply where a system performs profiling of natural persons, and the European Commission's draft guidelines on the classification of high-risk AI systems set out the conditions in more detail (European Commission draft guidelines). Institutions should not treat it as an easy exemption, and this is not legal advice.
The practical implication is that if your institution deploys AI to help decide admissions, evaluate learning outcomes or monitor exams, you should assume those uses may be high-risk and involve your DPO and legal advisers early. This guide describes the landscape and does not constitute legal advice. Timelines and guidance under the Act continue to evolve, so official sources should be checked directly.
Governance is where good intentions become operational reality. The following framework is deliberately practical and can be adapted to institutions of different sizes and structures.
Bring together the people who actually carry the risk and the work: IT, data protection, academic leadership, admissions, student services, legal, procurement, security, operations, and students where appropriate. Cross-functional ownership is what prevents AI decisions being made in isolation by whoever happened to buy the tool.
You cannot govern what you cannot see. Maintain a register of AI tools in use, recording the vendor, the data processed, who uses it, its purpose, its risk level, its owner, retention arrangements, integrations, and whether students or applicants are affected. This surfaces shadow AI and gives you a factual basis for decisions.
A simple internal model works well: low risk for drafting, brainstorming and summarising non-sensitive content; medium risk for staff-facing decision support that draws on institutional data; and high risk for anything touching admissions, assessment, progression, support eligibility, or disciplinary and financial decisions. This is an internal working model, not a legal classification, though it should map sensibly onto the EU AI Act categories where those apply.
Write clear, role-specific guidance for students, academic staff, professional services staff, admissions teams and external vendors. Different groups face different situations, and one generic policy tends to be ignored by all of them. Jisc's finding that students remain unclear even where guidance exists is a reminder to make this specific and genuinely usable.
Be explicit about what data can go into public AI tools, what requires an approved institutional tool, and what must never be entered anywhere. Cover how prompts and outputs are handled, whether outputs are stored, and how activity is audited. Clarity here prevents the most common and most damaging incidents.
For any consequential use, define who reviews the output, who owns the decision, when escalation is required, and where AI must never be the final decision-maker. Human oversight is the single most important control for high-impact uses, and it needs to be named and resourced, not assumed.
Procurement and due diligence matter. Examine data processing terms, sub-processors, retention, whether the vendor trains models on your data, model-improvement settings, security controls, auditability, the integration approach, exit rights, support and incident management. "We assumed the vendor handled it" is not a governance position.
Invest in AI and prompt literacy, verification habits, awareness of bias, data protection basics, acceptable use and academic integrity, tailored to each role. The EDUCAUSE finding that institutions are prioritising upskilling of existing staff reflects where the practical need sits.
Start with contained use cases and measure them: usefulness, accuracy, time saved, risk, adoption, output quality and user feedback. A pilot without success metrics is just an unmanaged rollout with a friendlier name.
AI governance is continuous, not a one-off policy. Review new tools, regulatory change, incidents, user feedback, model changes and vendor changes on a regular cycle. The technology and the rules will keep moving, and your governance has to move with them.
When a new AI use case is proposed, a short structured review saves a great deal of trouble later. For each use case, ask:
If a proposed use cannot answer these questions comfortably, it is not ready to deploy.
There is a strong tendency to focus on which AI model is best. For institutional operations, that is usually the wrong emphasis. AI is only as useful as the data and context it can rely on, and higher education data is often fragmented.
Records are scattered across a CRM, a student information system, a finance system and a learning platform that were rarely designed to talk to each other. The same student appears as duplicate records. Student statuses are inconsistent. Permissions are unclear. Audit trails are thin. Reporting definitions vary between teams. When AI operates on top of that, it inherits every one of those weaknesses and presents the results with unearned confidence.
This is why data governance, a single connected learner record and clear permissions do more for the usefulness of institutional AI than any choice of model. It is also where a purpose-built platform becomes relevant, because AI that works inside a governed data model, with roles and permissions built in, starts from a far more coherent picture than a general-purpose tool bolted onto fragmented systems. That connection is the bridge to the next idea.
It is worth being precise about the difference between two kinds of AI, because they suit different jobs.
Generic AI tools, the public chatbots most people have used, are good for drafting, brainstorming and summarising public or non-sensitive content. They have little institutional context, they become risky the moment staff enter personal or confidential data, and their outputs always need verifying. They are useful, within limits.
Contextual AI is embedded inside approved institutional systems. It operates on governed data, respects roles and permissions, can understand applicant and student context, can support real workflows, and can preserve auditability so staff can see what it did. It is the difference between an assistant who has never seen your institution and a colleague who understands the screen you are on and the data you are allowed to use.
The important caveat is that contextual AI still needs governance and human oversight. Being embedded and permissioned reduces some risks; it does not remove the institution's responsibility for how the tool is configured and used.
This is where a platform such as Full Fabric becomes relevant, and it is worth positioning it carefully rather than as a cure-all.
Full Fabric brings contextual AI into the higher education platform that teams already use to run recruitment, admissions, enrolment, student records and engagement. Rather than sitting outside institutional systems, its contextual AI works against the platform's own data, inside its workflows, and within each user's permissions. The interface for this, the AI Console, is a side panel inside the platform where staff can ask natural-language questions, generate summaries and see suggested next steps, with the work streamed into view so users can see the steps taken.
Because Full Fabric runs on a single connected data model across CRM, admissions and enrolment, payments, the student information system and reporting, the AI works from one coherent learner record rather than fragmented data spread across separate CRM and SIS tools. In practice, that means an admissions user can ask for a summary of an applicant's context or a list of pending applications by programme, a marketing user can build a segment through conversation, and a leader can ask a question of institutional data without waiting for a custom report, each within the boundaries of what their role allows.
Crucially, the platform is explicit that this AI is designed to assist staff, not to replace institutional judgement. For sensitive decisions such as admissions outcomes or fee assessments, outputs are meant to be verified against the underlying data. The controls that make this workable, visible steps, respected permissions and audit logs, sit alongside the wider security and GDPR compliance framework and connect to existing institutional systems through the integrations ecosystem. This matters as much for IT and data teams who need a governed, auditable system as it does for the admissions teams using it day to day.
To be clear about the limits: Full Fabric's AI does not remove the need for institutional AI governance, it should not be used to automate high-impact decisions without human oversight, institutions remain responsible for policy, configuration and lawful use, and Full Fabric is not a replacement for every learning platform, ERP, finance, HCM, payroll, research or teaching system an institution runs. It is a purpose-built higher education platform where AI works inside the student lifecycle, not a generic chatbot and not the only valid approach to AI. Institutions evaluating options can compare approaches, including enterprise alternatives, in a more detailed analysis of Salesforce for European universities.
A phased approach turns all of the above into something an institution can actually execute.
Phase 1: Map current AI use. Find where students, staff and vendors already use AI. You will almost certainly find more than you expected, and that inventory becomes the foundation for everything else.
Phase 2: Establish baseline governance. Put policies, ownership, data rules and approval processes in place before scaling anything. This is the least glamorous phase and the one that pays off most.
Phase 3: Prioritise low-risk, high-value use cases. Staff drafting, summarising non-sensitive content, internal knowledge search, communications assistance and applicant query support with human review are good early candidates. They deliver value quickly with limited risk.
Phase 4: Pilot contextual AI in controlled workflows. Focus on admissions, student engagement, reporting, staff support and operational queries, where governed data and permissions can be applied and results measured.
Phase 5: Review high-impact use cases carefully. Admissions decisions, assessment, progression, support eligibility and financial decisions require stronger governance and legal review, and in the EU may fall under high-risk AI Act obligations. Move slowly and deliberately here.
Phase 6: Scale with measurement. As you expand, keep measuring usefulness, accuracy, adoption, risk, efficiency, and both staff and student experience. Scaling without measurement is how small problems become institutional ones.
The recurring errors are predictable, which makes them avoidable. They include treating AI as only an academic integrity issue; banning AI without addressing the real ways it is already used; letting every team choose tools independently; entering student data into unapproved public tools; assuming vendor AI is automatically compliant; confusing data residency with full compliance; automating decisions without human oversight; running pilots with no success metrics; neglecting staff training and student guidance; relying on AI detectors; underestimating bias and accessibility risks; skipping procurement and DPO review; treating governance as a one-off document; and failing to connect AI to the underlying data governance that determines whether it works at all.
Before committing to any AI use, leadership should be able to answer a consistent set of questions: What problem are we solving, and which students or staff are affected? What data is involved, and who owns the use case? What is the risk level, and what happens if the AI is wrong? Is the output advisory or decisive, and who reviews it? Can decisions be explained, and is there an audit trail? Does this require a DPIA, and could it be high-risk under the EU AI Act? Is the vendor approved, and does it train models on our data? Where is data processed, and what permissions apply? What is the fallback if the AI fails, how will we measure value, how will we monitor performance over time, and how will we communicate all of this to students and staff?
If these questions can be answered clearly, the institution is ready. If they cannot, that is useful information too.
AI in higher education is already here, but the institutions that benefit most will not be the ones that chase every new tool. They will be the ones that build clear policies, trusted data foundations, risk-based controls and workflows where AI genuinely helps staff and students. Governance, data quality, human oversight and well-chosen use cases matter far more than any single model or product.
For institutions exploring contextual AI across recruitment, admissions, enrolment and student records, Full Fabric provides a purpose-built higher education platform where AI works inside the student lifecycle, with institutional data, workflows and permissions as context. Whatever platform an institution chooses, the underlying principle holds: use AI where it adds value, keep humans accountable, and govern it as the technology and the regulation continue to evolve.
AI in higher education refers to the use of artificial intelligence, including generative AI, across teaching, learning, assessment, admissions, recruitment, student support, operations and reporting. In practice it ranges from students and staff using general tools to institutions embedding contextual AI inside their own systems. The defining challenge is not the technology itself but how institutions govern, apply and oversee it responsibly.
It is used to draft and summarise communications, support recruitment and marketing, summarise applicant context in admissions, triage student queries, assist teaching and assessment redesign, speed up administrative tasks, and help query institutional data. Sector research from EDUCAUSE and Jisc shows adoption is widespread and growing among both staff and students, though the value and the risk vary considerably by use case.
The main risks are inaccuracy and hallucination, bias and discrimination, data protection and GDPR exposure, mishandling of special category data, academic integrity concerns, cyber security threats such as prompt injection and data leakage, over-automation of decisions that need human judgement, inequitable access, and loss of trust. The appropriate response is to govern AI in proportion to risk rather than to ban it outright.
Effective governance usually involves a cross-functional AI governance group, an inventory of tools in use, risk classification of use cases, role-specific acceptable-use guidance, clear data rules, required human oversight for consequential decisions, vendor due diligence, staff and student training, piloting with measurement, and ongoing review. Governance is continuous rather than a one-off policy.
AI can support admissions by summarising applicant context, drafting communications, flagging missing documents and suggesting workflow steps. It should not make admissions decisions autonomously. Decisions affecting access and enrolment demand fairness, transparency, auditability and human accountability, and in the EU some admissions uses may fall under high-risk obligations in the AI Act.
Yes. The EU AI Act lists several education uses as high-risk, including systems that determine access or admission, evaluate learning outcomes, assess the appropriate level of education, or monitor prohibited behaviour during tests. High-risk does not mean prohibited; it means stronger obligations for providers and deployers. Institutions should consult official sources and involve legal advisers and their DPO.
Student and applicant records are personal data, often including special category data, so AI use engages GDPR obligations around lawful basis, purpose limitation, data minimisation, transparency, retention and data subject rights. The EDPB's Opinion 28/2024 confirms these principles apply to AI models and that anonymity must be assessed case by case. Institutions should involve their DPO and consider a data protection impact assessment.
Contextual AI is AI embedded inside approved institutional systems that operates on governed data, respects user roles and permissions, understands applicant and student context, and can support workflows while preserving auditability. It contrasts with generic public tools that have no institutional context and become risky when staff enter confidential data. Contextual AI still requires governance and human oversight.
Full Fabric embeds contextual AI into its higher education platform through the AI Console, a side panel that lets staff ask natural-language questions, generate summaries and see suggested next steps, working against the platform's connected data, workflows and each user's permissions. It is designed to assist staff rather than replace institutional judgement, with visible steps, respected permissions and audit logs, and it does not remove the need for institutional AI governance.
Start by mapping where AI is already used across the institution, then establish baseline governance: ownership, policies, data rules and approval processes. From there, prioritise low-risk, high-value use cases, pilot with clear success metrics, and treat high-impact uses such as admissions and assessment with stronger review. Connecting AI to sound data governance from the outset matters more than choosing a particular tool.
