From compliance to critical AI literacy: what HEPI Policy Note 71 points towards

This blog was kindly authored by Professor Mirjam Hauck, Professor of Critical Digital Pedagogies and Academic Lead for AI in Learning, Teaching and Assessment, The Open University

Sam Illingworth’s HEPI Policy Note 71, What UK University AI Policies Actually Do, makes a finding that should unsettle anyone responsible for institutional AI guidance. Of the 19 policies he reads closely, the keyword analysis misclassifies twelve. The language is about learning. The policies enforce compliance. Where a policy sits, and how it is built, determine what it actually does.

The empirical work behind that finding is rigorous: 96 collected policies; qualitative coding of 19; an open data repository. The location-predicts-function result will be the report’s most enduring contribution. A policy hosted within an academic misconduct framework inherits that framework’s assumptions about students, whatever vocabulary softens the message. It is a structural insight that changes how you read every policy.

I want to focus on one element of the report: its fourth principle. Illingworth proposes that ‘critical literacy should replace tool proficiency’ as the organising principle for institutional AI policy. I agree. But the report invokes critical literacy as a self-explanatory term, and critical literacy needs an operational framework. Otherwise, it becomes the next piece of educational vocabulary absorbed into compliance structures, exactly the mechanism the report diagnoses.

The report’s four exemplary policies (Durham, Stirling, Canterbury Christ Church, Arts University Plymouth) each define critical AI literacy in their own way, leaving the sector with four exemplars whose shared construct still needs to be named.

The missing layer

The Critical AI Literacy (CAIL) framework I have been developing with colleagues at the Open University offers one way to operationalise critical literacy across six dimensions, taught, assessed, and embedded in curriculum design, through an equity, diversity, inclusion and accessibility (EDIA) lens. The EDIA lens is what I want to emphasise here, because it addresses something the report’s analysis leaves open.

Illingworth’s deficit-model finding, that policies assume what students lack and structure guidance around that assumed lack, is correct. But the report leaves open which students the deficit model is most likely to harm. The answer matters.

When policies require students to document and declare every use of AI, the burden falls hardest on those struggling with institutional systems designed around a different default student: disabled students who rely on AI as part of their access needs; students for whom English is an additional language; students whose visa status amplifies any accusation; students whose writing depends on support that surveillance treats with suspicion. The compliance architectures fall unevenly while claiming to apply a single standard. An EDIA-grounded literacy framework makes that inequality visible and changes what policy is being asked to do.

What changes in practice

Three things follow if we take a literacy framework, rather than a principle, as the starting point.

First, it shifts the policy-writing question. Instead of asking ‘how do we manage AI use?’ institutions are asked, ‘what AI literacies are we cultivating, across which dimensions, with what attention to whom?’ The grammar of compliance gives way to the grammar of literacy.

Second, it makes policy teachable. A literacy framework maps onto modules, assessment briefs, induction materials, and staff development. Compliance documents stop at themselves. This is why Illingworth’s exemplars work: each points towards something beyond the document itself, implying a literacy claim that the framework lets the sector teach to.

Third, it produces claims that can be evaluated. A framework makes ‘we develop critical AI literacy’ checkable against teaching, assessment, and curriculum; without it, the claim is rhetoric. Illingworth’s keyword analysis would read differently on policies that operationalise their literacy commitments rather than point at them.

At the Open University, we have been working in this direction. Our Senate-approved AI Principles, agreed in February 2026, identify critical AI literacy as one of their organising commitments. Like policies, these principles need revisiting as the technology and our understanding evolve. Literacy frameworks are designed to grow in step with the technologies and contexts they describe.

The coordination question

Illingworth rightly identifies coordination as a sector-level problem. With 163 institutions producing separate responses, sector bodies including Jisc, Universities UK, and the Association of Heads of University Administration have a role in seeding shared starting points. A shared literacy framework is the prior step. Coordinating around vocabulary produces shared language and divergent practice. Coordinating around a framework produces a shared structure.

CAIL is one candidate framework among others. A serious critical AI literacy literature exists, drawing on multiliteracies, critical pedagogy, decolonial and disability scholarship, and data feminism. Bringing it into conversation with the report would deepen the diagnosis. Whether the sector adopts CAIL or another framework, critical literacy needs an explicit operational meaning. Otherwise, Principle 4 ends up absorbed into the next generation of compliance documents, this time with the word ‘critical’ attached to them.

What the sector needs next

Universities are supposed to develop critical thinkers, and AI policies which resort to compliance while claiming to educate contradict the mission. The next step is the literacy framework that teaches the critical thinking the sector’s policies claim to want, with the EDIA grounding that opens critical AI literacy to all students, breaking the pattern where the already advantaged develop it while everyone else navigates surveillance.

HEPI Policy Note 71 has done the diagnostic work. The framework work is where the sector needs to go next.