The next university crisis will not be about students using AI

This blog was kindly authored by Dr Ismini Vasileiou, Associate Professor at De Montfort University.

Higher education has spent the past few years asking what artificial intelligence means for students. It is time we started asking what it means for universities as organisations. The debate has understandably focused on teaching and assessment. Can students use ChatGPT? How should its use be acknowledged? Can we still trust written assessment? What does academic integrity look like when generative AI is available to almost everyone? These remain important questions. But they are no longer the only ones universities should be asking.

AI is moving beyond the classroom and into the infrastructure of the university itself. It is increasingly supporting recruitment, marketing, student services, research, administration, cyber security, data analysis and decision-making. The risk is that universities become increasingly AI-enabled without becoming AI-resilient.

The scale of student adoption is undeniable. HEPI and Kortext’s 2026 Student Generative AI Survey found that 95% of students use AI in at least one way, while 94% use generative AI to support assessed work. Universities have responded with policies, redesigned assessment and staff development. But our field of vision risks becoming too narrow. Imagine asking a university executive team a different set of questions:

• Where is AI currently being used across the institution?
• Which AI systems have access to institutional data?
• Which decisions are being informed by AI?
• Who is accountable when an AI-supported process causes harm?
• And, perhaps most importantly, would the university know quickly enough if something had gone wrong?

These are not simply questions for IT departments. They are questions of institutional governance. There is a temptation to equate AI maturity with adoption. How many staff have licences? How many pilots are underway? How many processes have been automated? Those measures tell us something about adoption. They tell us much less about whether an institution is capable of using AI responsibly.

A university could be an enthusiastic adopter while remaining organisationally immature. Staff may use AI tools with information that should never have been entered into them. AI-generated outputs may enter decision-making without meaningful verification. Procurement, cyber security, data protection, academic governance and executive leadership may each own fragments of the problem without anyone owning the whole.

The question therefore cannot simply be: How quickly are we adopting AI? It must become: How safely and intelligently are we becoming dependent upon it? That is where the idea of AI resilience matters.

An AI-resilient university is not one that resists AI. Nor is it one that creates so much governance that innovation becomes impossible. It is an institution able to adopt AI ambitiously while understanding where it is being used, what it is being trusted to do, who is accountable for it and what happens when it fails.

I would suggest five dimensions matter.

1. Visibility. Universities need to know where meaningful AI use and dependency exist. This is becoming harder because AI will not arrive only through explicitly branded tools. It will increasingly be embedded within software for productivity, recruitment, analytics, research, learning and administration. An institution cannot govern what it cannot see.
2. Accountability. When AI influences a decision, who owns the outcome? AI-enabled processes may involve IT, procurement, legal services, data protection, HR, academic quality and individual faculties. Yet if a significant decision is wrong, discriminatory or insecure, accountability cannot simply disappear into the system. Universities need clear ownership of AI-related risk and defined escalation routes.
3. Assurance. Universities need to move from asking whether AI can perform a task to asking when it should. Efficiency is attractive, particularly in a financially constrained sector, but plausibility should not be confused with reliability. The greater the consequence of a decision, the stronger the requirement should be for human scrutiny and verification.
4. Capability. AI literacy is not enough. Knowing how to prompt a system is useful; knowing when not to trust the response is more important. Staff need to recognise unreliable outputs. Managers need to understand automation risk. Researchers need to understand provenance and integrity. Leaders need enough technical understanding to challenge the assurances they are given. The goal should not simply be an AI-literate university. It should be an institution capable of exercising judgement in an AI-enabled environment.
5. Resilience. Finally, what happens when AI fails? What happens if a supplier changes the underlying model? If incorrect information is produced at scale? If sensitive data are exposed? If staff act on fabricated but convincing outputs? Or if AI-enabled cyber attacks target institutions whose own dependence on automation is increasing?

Universities already undertake business continuity planning for physical infrastructure, cyber incidents and critical digital services. AI dependency needs to become part of that thinking too. This is ultimately a leadership issue. One of the difficulties universities face is that AI cuts horizontally across organisations that are largely structured vertically. Teaching and learning may own one part of the conversation, IT another, research another, HR and procurement others still. The danger is not necessarily that universities have no AI governance. It is that they have fragmented AI governance.

That is why executive teams and governing bodies need enough visibility to understand where significant AI dependencies are forming and enough confidence to challenge them. The first phase of higher education’s response to generative AI was uncertainty. The second was experimentation. We are now entering a third phase: institutionalisation.

AI will gradually cease to feel like a separate technology and simply become part of how universities operate. That is precisely when the risk increases. The next stage of the debate should therefore move beyond adoption and ask whether universities can demonstrate five things: visibility, accountability, assurance, capability and resilience.

For several years, universities have worried about whether students can be trusted with AI.

The more consequential question may now be whether universities themselves can be trusted to use it responsibly. The institutions that succeed will not necessarily be those that automate fastest or purchase the most tools. They will be those that can innovate without surrendering judgement, accountability or resilience. The next stage of the AI debate in higher education should not simply be about AI adoption. It should be about AI resilience.