Egerton put AI policy inside the university. The draft needs student fingerprints

THE SIGNAL IN ONE SENTENCE

A university policy can be a fence, a map or a particularly expensive PDF that nobody opens after orientation. Egerton University has the chance to make its coming artificial intelligence policy something more useful: a campus constitution for work already happening in classrooms, laboratories, offices and student devices. From October 14 through 16, the Kenyan university held an AI in Higher Education Summit at its main campus in Njoro. The theme was Governing GenAI for Competency-Based Higher Education. Its program moved from case studies and keynotes into a participant-driven policy workshop, then scheduled policy presentations and a plenary review. The workshop was divided into four drafting groups. One addressed learning, including acceptable student use, cognitive skill preservation, student conduct and digital citizenship. A second covered teaching, disclosure, authentic assessment and human oversight. A third took on research authorship, data handling and integrity. The fourth addressed administration, student privacy, procurement and institutional security. That is a serious agenda. It puts the messy parts on the table instead of pretending one sentence about plagiarism can govern a technology that can tutor, translate, summarize, draft code, fabricate citations, process records and quietly leak sensitive data. Egerton's public materials describe an ambition to produce an adoptable institutional policy across learning, teaching, research and administration. University reporting says the summit was expected to contribute to a draft. It does not yet publish that draft, an adoption vote, an implementation date or enforcement rules. So this is not a story about a finished policy. It is a story about who should be holding the pen before the document hardens. The summit invited academics, researchers, policy makers, administrative leaders and students to submit work. Its program also included a student innovation showcase. Those are encouraging signs of participation. But the public pages do not show who sat in each policy breakout, how many students helped draft clauses, whether disability and accessibility expertise was represented, or how the wider campus will comment on the result. That gap matters because an AI policy distributes power. It decides which tools a student may use, which uses must be disclosed, what evidence counts as their own work and what happens when a lecturer suspects misconduct. It can determine whether a researcher may place interview transcripts in a commercial model, whether an administrator may automate a decision about a student and whether a faculty member must explain that an AI system helped prepare course material. Those are not merely technical choices. They are rules about authorship, privacy, due process and trust. Egerton's leaders are framing the problem around competency, which is the right center of gravity. Deputy Vice-Chancellor Bernard Aduda said universities must protect the credibility of qualifications by ensuring graduates possess the knowledge, skills and competencies their awards represent. Commission for University Education chief executive Mike Kuria also emphasized verifiable competencies rather than time spent in a classroom. The plain signal is this: if a graduate can demonstrate the claimed competence, the institution has something stronger than a prohibition. If nobody can show what the student knows without the machine, the policy has not fixed the assessment problem. It has only moved the argument into the disciplinary office. A competent policy therefore begins with assessment design. Every course should identify which outcomes students must demonstrate independently, which can be demonstrated with AI assistance and which require collaboration with tools as part of the professional skill. A writing course may require an unassisted diagnostic, a documented revision process and a final piece produced with limited assistance. A programming course may permit code completion while requiring a live explanation, tests and repair of a deliberately broken system. An agriculture course may let students use a model to propose an irrigation plan, then ask them to defend the assumptions against local soil, weather and cost evidence. The exact rule should vary by discipline. The institutional policy should provide the floor beneath those choices. That floor needs a simple vocabulary. Prohibited, permitted and required uses should be stated in each assignment. Disclosure should name the tool, version when available, purpose and material contribution. Students should not have to guess whether grammar help counts as misconduct while a lecturer quietly uses the same class of tool to generate feedback. Reciprocity matters. If students must disclose meaningful AI assistance, faculty and administrators should disclose it too. The institution also needs evidence rules that do not depend on unreliable detection software. A machine-generated score should not become proof of cheating. Better evidence comes from the work itself: version history, notes, source checks, oral explanation, live performance, code execution, laboratory practice and the student's ability to revise or defend a decision. That approach aligns with competency-based education because it asks the learner to do something observable. It also creates more work. Oral checks take time. Authentic assessments are harder to design and mark. Version histories are not available in every medium. Large classes make individualized review difficult. A policy that demands richer assessment without staff time, training and accessible tools is a wish list wearing a lanyard. The resource plan should therefore sit beside the conduct rules. Lecturers need examples of redesigned assessments, not just warnings. Students need approved ways to experiment, including access that does not depend on who can afford a subscription. Libraries and information specialists need a role in source verification and citation practice. Disability support teams should test whether restrictions remove tools students rely on for language, reading, communication or executive function support. Kenya's linguistic and connectivity realities belong in the document as well. A student working on a shared phone, an intermittent connection or a low-cost data plan encounters a different AI campus from someone with a new laptop and a paid model. A rule that requires a particular commercial tool can quietly become a fee. A rule that assumes fluent performance in one language can confuse language polish with disciplinary competence. The policy should allow equivalent routes to demonstrate the same learning outcome. Data governance is the less glamorous half of the job, which is usually where the actual trouble lives. The summit program explicitly assigned student data privacy, cloud vendor procurement and institutional data security to the administration drafting group. Those clauses should distinguish public, internal, confidential and highly sensitive information. Staff and students need to know what may never be entered into an external model, whether prompts are retained, whether inputs train the vendor's systems, where data is processed and how a deletion request works. Procurement should require evidence rather than adjectives. A vendor should document security controls, retention, subcontractors, model changes, incident reporting, accessibility and exit terms. The university should know how to retrieve its data and continue teaching if a tool disappears, changes price or alters its policy halfway through a semester. Research rules need similar precision. The program named acceptable researcher use, authorship attribution, data handling, research integrity and national regulatory compliance. A useful policy should separate low-risk assistance, such as formatting or code explanation, from work involving confidential data, human participants, unpublished findings or decisions that materially shape a result. AI cannot take responsibility for a paper. The human authors must verify sources, methods, analysis and claims. When a model materially affects the work, the disclosure should be detailed enough for a reader or reviewer to understand what happened. Then comes due process. A campus constitution needs an appeals route. The student should see the allegation and evidence, have a chance to respond, and reach a human decision-maker. The process should record when AI-generated evidence or a detector influenced the case. Penalties should distinguish confusion, careless disclosure and deliberate deception rather than treating every mismatch as the same moral event. Faculty and staff need due process too. A research or administrative error involving AI may expose institutional weaknesses in training, procurement or workload, not only individual fault. The policy should be versioned, dated and public. Each revision should explain what changed and why. A standing governance group should include students, teaching staff, researchers, administrators, library and information professionals, data protection and security expertise, disability support and worker representation. Tool vendors may provide evidence, but they should not write the constitution. That group should publish receipts. How many courses state clear AI rules? How many students have access to approved tools? Which assessments were redesigned? How many misconduct allegations involved automated detection, and how many were upheld after human review? What data incidents occurred? Which disciplines report stronger or weaker evidence of student competence? The numbers should be interpreted carefully, but silence is worse. Without a public learning loop, policy becomes theater: a launch, a photograph and a PDF aging gracefully in a submenu. Egerton's summit already did something valuable. It placed the policy problem inside the institution and split it across the places where generative AI actually touches university life. It connected the argument to competence rather than panic. It also created a visible program against which the eventual document can be judged. Now the draft needs fingerprints in the metaphorical sense: evidence that the people who will live under it helped make it. Publish the draft. Name the consultation period. Show who participated. Let students test the assignment language, researchers test the data clauses, lecturers test the workload and staff test the administrative controls. Record disagreements instead of sanding them into bland consensus. Then adopt a policy that can change when the evidence changes. Generative AI will not sit politely outside the university while committees finish their minutes. It is already in the room. The useful question is whether the rules in that room can still prove what a graduate knows, protect the people whose data passes through it and give the campus a fair way to argue when the answer is unclear.