Who Owns the AI Policy on Your Campus?

The policy exists. The ownership doesn’t.

At Notre Dame, the Mendoza College of Business has not written its own AI integrity policy. Dean Martijn Cremers says it doesn’t need to, because the university’s Honor Code already covers every Mendoza student and course, grounded in Catholic social teaching about human dignity in relation to machines, according to the Irish Rover. That is a defensible position. It is also, by the Rover’s own reporting, one of several different answers on the same campus, with other colleges setting their own terms.

Florida has gone the opposite direction. State colleges are now required to limit AI use to institutionally approved models and restrict student use on graded work unless an instructor authorizes it, with explicit protections against tools designed to simulate companionship or emotional relationships, per Florida Today and the Apopka Chief. That’s a top-down mandate with a single owner: the state.

New York K-12 sits at the other extreme. A review of roughly 480 school district websites found most districts have no AI policy at all, and the ones that exist range from outright bans to full classroom integration, with no statewide standard forcing convergence, according to the Press-Republican.

Three governance models, one unanswered question

State mandate, university honor code, and institutional silence are not variations on a theme. They are different answers to the same question: who owns AI policy, and who is accountable when enforcement is inconsistent across the same institution or the same state. The NIST AI RMF treats “Govern” as its own function precisely because risk management without a named accountable party is not management at all, it is documentation. ISO 42001, the management-system standard for AI, works from the same premise, requiring a defined ownership structure before an institution can even claim conformance. Measured against either framework, Notre Dame’s honor code and Florida’s state mandate both clear the bar. A campus with four different answers to the same question does not.

That gap has teeth beyond conduct codes. Student data protection law doesn’t pause for institutional ambiguity. FERPA and state statutes like New York’s Education Law §2-d govern how student data can be processed by any tool, AI or otherwise, and teacher preparation programs are already adopting AI tools at the individual faculty level without centralized review of data handling terms, according to Faculty Focus. When policy ownership is diffuse, so is the data processing agreement trail, and that is the gap general counsel actually has to close, not the honor code language.

The decision in front of provosts and general counsel

The fix isn’t another conduct policy. It’s a named owner, at the system or institution level, who approves tools, maintains the data processing agreements FERPA and state privacy law require, and reconciles college-level and course-level discretion into one enforceable chain of custody, the same accountability structure NIST and ISO already require for any AI management claim to hold up. Florida and Notre Dame both satisfy that test, each in its own idiom, because each has a single point of accountability. The institutions and districts without one, the majority by the New York survey’s count, are the ones that will discover their exposure during an audit, a breach notification, or a lawsuit, whichever arrives first.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The argument is coherent and the central claim—that policy ownership, not policy content, is the governance gap—is well-supported by the three contrasting cases and correctly grounded in NIST/ISO acco
Source & Claim Verification	Qwen · hosted fallback (qwen-2.5-72b-instruct)	cleared. Most factual claims are supported by citations, but a few lines lack specific references, such as the mention of ISO 42001 and the NIST AI RMF.
Regulatory & Framework Fidelity	Mistral · fallback (mistral-medium-3.1)	cleared. The briefing accurately aligns with NIST AI RMF and ISO 42001 on governance ownership but omits explicit ties to EU AI Act, HIPAA, and other sector-specific frameworks where relevant.
Technical Accuracy	Llama	cleared. The text correctly applies the NIST AI RMF ‘Govern’ function and ISO 42001 requirements to institutional accountability and data privacy frameworks.
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively avoids vendor hype and presents a balanced view by contrasting different approaches to AI policy ownership without endorsing one over the others, instead focusing on the impli
Novelty & Non-Duplication	Grok	held. Wire stories on ND/FL/NY AI rules are stitched into a NIST/ISO ownership frame that feels additive for a campus-governance briefing, though education-AI policy fragmentation itself is a crowded beat w
Validation	DeepSeek	cleared. The central claim that diffuse AI policy ownership creates compliance and enforcement gaps is strongly supported by cited examples of inconsistent policies and privacy law requirements.

Sources cited: 16. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.