Universities ended up in an odd spot: AI showed up before any rules did. Students write term papers with a chatbot in the next tab, lecturers generate quizzes, and the administration is slowly catching up too. All of it runs on personal accounts and someone else's servers, and the institution has no idea where the data goes.
Banning it is no longer an option
The first instinct is easy to understand: ban it. It doesn't work, though. Generative features already live inside search engines, office suites and browsers, and you can't physically switch them off. So I'd frame the question differently. Not "let it in or not", but how to pull what's already happening into a space the university can at least partly control.
What follows are my thoughts on that. Some come from working on AI policy documents for a university, some from the perspective of someone more used to deploying models than drafting regulations.
Why one policy isn't enough
Almost every Ukrainian university now has (or is writing) its own "AI Use Policy". The good part is that there's something to build on. In April 2025 the Ministry of Education and Science and the Ministry of Digital Transformation published recommendations for higher education. They describe scenarios ranging from restricting AI to encouraging it, depending on the task and the lecturer's call, along with principles of human oversight, confidentiality and transparency. Most university policies I've seen are based on that document.
The bad part: a policy on its own changes almost nothing.
A lecturer grading a term paper doesn't open the policy. They check the academic integrity regulations, the assessment rules and their own syllabus. If none of those changed, the policy just sits on the website. So for me, adapting to AI means a package of documents:
- integrity regulations where unattributed AI use becomes a distinct violation, and a detector score is never the only evidence (detectors get it wrong, and accusing a student on that basis alone is a bad idea);
- an AI mode set per assignment in the syllabus: not allowed, allowed with disclosure, required;
- a clear list of data that must not go into external services;
- a procedure for how the university approves a given service in the first place.
Tool names and dates belong in appendices that are easy to update. The EU AI Act already moved its own deadlines two years after adoption (Digital Omnibus, 2026/1744). A regulation that has to pass the academic council will never keep up with that pace.
Infrastructure is where rules become real
This is my home turf, so I'm probably the most biased here. Still, I'll stand by it: a rule like "don't send personal data to external services" is worthless if the university offers no alternative. A student needs to analyze survey responses. What will they do? Open whatever chatbot is at hand.
Here's roughly the minimum setup I'd expect:
| Layer | Purpose | Minimum | With more resources |
|---|---|---|---|
| Sign-in | Know who has access to what | Institutional accounts, single sign-on | Roles: student, lecturer, researcher, administration |
| Models | The AI itself | Cloud service under contract, no training on your data | Own server with open-weight models for sensitive data |
| Gateway | Single entry point to the models | Logs, per-user limits | Personal data filtering, cloud/local routing |
| Integration | AI where people already work | Links to approved services in Moodle | AI modules inside the LMS |
| Institutional knowledge | Answers based on internal documents | – | RAG over regulations, timetables, study programs |
The most interesting debate is always about models. Cloud is cheaper to start with and needs no admin of your own. But sensitive data can't go there, and the terms of service can change any day. Running your own server solves the data question, yet it needs GPUs, people to maintain it and (welcome to Ukraine) a decent backup power supply. That's why a hybrid setup looks most realistic to me: cloud for general tasks, a small local node for whatever must stay inside the university network, and a gateway in between deciding where each request goes.
One thing people often forget. Gateway logs become sensitive data themselves, since they hold the text of student papers and maybe a few surnames. They need retention periods and a short list of people with access, or the control tool turns into one more source of leaks.
Polytechnic vs. teacher-training university
For a long time I wondered whether one model could fit both a technical university with a computer science department and a pedagogical one, where the main thing students produce is text. The answer surprised me a bit: they share more than you'd think. Same set of documents, same principles, same need to train staff.
The difference shows up in two places. What exactly AI replaces, and who will keep it all running.
At a technical university the risk is generated code and calculations. Checking whether work is original is relatively easy there: ask the student to explain the solution, give them new input data, hold a defense. And there are people who can spin up a local server on top of existing lab hardware. The danger is elsewhere. It's the illusion that having experts on staff means you don't need rules, when in fact the line between "helped me" and "did it for me" blurs fastest exactly where AI is used most.
At a humanities school it's the other way round. The main risk is text: essays, term papers, theses. Verifying that a text is the student's own is harder and costs more (oral defenses, staged drafts, assignments built on local material that isn't online). There are usually no ML engineers on staff, so the institution depends on external services and contractors.
Teacher-training universities add one more layer. Their graduates will bring AI into schools, which already have separate methodological recommendations from the Ministry (letter No. 1/20386-25 of 29 September 2025). So the rules at such a university do double duty. They govern how the student learns and also show them how this can be done at all. A badly written policy does harm twice here.
What gets in the way, honestly
Uncertainty first. Ukraine still has no AI law. A working group under the relevant parliamentary committee met for the first time only in June 2026. Back in 2024 the Ministry of Digital Transformation chose a soft bottom-up approach in its White Paper: voluntary tools first, then a law modeled on the AI Act. Meanwhile, the AI Act itself pushed the requirements for high-risk education systems back to December 2027. Universities are writing rules they already know they'll have to rewrite.
Money. Licenses are priced per user, hardware is expensive upfront and then needs upkeep. Budgets usually don't account for either, and public procurement doesn't get along with services whose pricing changes several times a year.
People. Lecturers' digital skills vary a lot, even within one department. A policy that says "set the AI mode for every assignment" silently assumes the lecturer knows what these tools can and can't do.
And box-ticking. The policy gets adopted, posted online, checked off. Syllabi stay the same. So does the misconduct procedure.
Where this could lead
If someone asked me where to start, I'd say administration. Paperwork, answers to routine student questions, search across hundreds of internal regulations. There's almost no integrity risk, the time saved shows up right away, and it's a good way to show staff that AI isn't only about cheating.
In teaching, I think the main shift will be in assessment rather than tools. If an essay takes a minute to generate, the value moves to the process: drafts, oral defenses, work with local material.
For institutions without technical resources, cooperation is the idea I like most. A shared compute node for several universities in a region, say hosted by a polytechnic, would give teacher-training and humanities schools access to local models without buying hardware or hiring admins. Yes, they'd have to agree on data handling between institutions. That's a legal task, though, not a technical wall.
One last point. Everything a university does now (a register of systems, staff training, human oversight of grading) closely matches what the AI Act will require from high-risk education systems. Given Ukraine's EU integration, that isn't just a cost. It's a head start.
Instead of a conclusion
I think universities are asking themselves the wrong question. Not "how do we protect ourselves from AI", but "how do we make the safe path the most convenient one". As long as an approved tool is harder to open than a personal chatbot, no policy will help.
I'd especially like to hear from humanities lecturers: what has actually changed for you over the past year?