University AI updates need renewed academic approval

Several Australian universities now permit limited AI-assisted marking and feedback, although their rules differ. The University of Melbourne permits AI to support academic staff in evaluating students’ work, provided staff review its output and remain responsible for academic judgement. The University of Sydney prohibits the use of AI-driven marks and grades in summative assessment, although it permits approved AI use in formative assessment and feedback. A 2026 systematic review of 72 studies identifies grading and feedback among the ways educators use generative AI in higher education (Crompton and Burke, 2026). Now consider a hypothetical university that initially approves an artificial intelligence (AI) tool only to prepare a lecturer’s feedback. A later update lets the same tool propose grades and upload them to the assessment system. The lecturer still clicks ‘Confirm’ to approve the proposed grade; however, the software has already suggested the score and supplied its rationale. Would that change require renewed academic approval? My PhD research in AI governance has convinced me that universities should require renewed academic approvals when updates materially change systems’ educational purposes, their influence on assessment, or their arrangements for human oversight.

From feedback to grading

Across many sectors, updates are raising governance issues. Education lends a distinct institutional definition to such governance issues. Feedback enables students to learn; grades represent achievement and often determine student progression. These two activities warrant separate academic approval, even if a single system performs both. Changes that move a tool from feedback support to grading alter the authority to exercise judgment over the student’s learning. Can the university still justify the assessment as a valid judgment of the student’s learning based upon a vendor’s enhanced performance score?

The European timetable provides an opportunity to define clear processes. The European Commission’s July 2026 announcement regarding the implementation of the EU AI Act states that the Annexe III high-risk rules apply from 2 December 2027. Annexe III lists educational uses, including admissions, evaluation of learning outcomes, and detection of prohibited behaviour during tests. Article 6 provides a limited exception for some narrow, preparatory or supporting tasks that do not pose a significant risk or materially influence the decision. This exception does not apply to systems that profile individuals. Therefore, universities must assess intended uses and the decision-making consequences rather than using an ‘educational AI’ label.

Academic integrity represents one of the stakes involved. A peer-reviewed study published in Patterns found that seven detectors misclassified human-written TOEFL essays by non-native English writers as AI-generated, with an average false-positive rate of 61.3%. This historical study does not establish how accurately current products perform. Rather, it exemplifies why a university should test a modified detector on relevant student writing before permitting scores generated by the detector to influence misconduct proceedings. A modified threshold may lead to some students being scrutinised more thoroughly.

Assessment quality additionally requires more than one measure of accuracy. Steiss et al. (2024) compared human- and ChatGPT-generated feedback on 200 secondary school essays. On four of the five dimensions (use of criteria, directions for improvement, accuracy, priority given to essential features, and supportive tone), human-generated feedback was superior to ChatGPT feedback; however, the overall differences were relatively minor. Such findings cannot be transferred directly to university grading practices. However, they illustrate why assessments of feedback involve multiple educational judgements that should be examined in the context in which the tool will operate.

A UNESCO report prepared by Miao and Holmes (2023) calls for institutions to validate generative AI pedagogically and ethically. I see renewed validation following consequential changes to systems as a practical application of this recommendation. Renewed validation should be tied to a specific educational activity and a set of safeguards, with an identifiable person responsible for reconsidering both.

When an AI update warrants review

The EU framework already contains elements that define consequential changes. Article 25 of the EU AI Act makes a deployer a provider, subject to provider obligations, if they alter a previously non-high-risk system’s intended purpose to make it high-risk. Article 43(4) requires a new conformity assessment after substantial modification of an already assessed high-risk AI system; it excludes certain predetermined, documented changes in “continuously learning” systems. Academic institutions should apply similar logic to procedural matters. The internal review criteria for academic activities may include criteria beyond those specified by law, as academic acceptability depends on the specific purposes and assessment conditions of each course.

I would flag three types of changes for review: a transition from providing feedback to assessing with grades, an alteration in the role of the automated system relative to misconduct decisions, and human intervention during an assessment at a point later than when assessment results were initially provided. The responsibility to evaluate if the previous approval for the activity still applies to the modified activity rests with the academic official(s) with authority over all aspects of assessment. Evidence regarding modifications should come primarily from technical personnel and/or procurement departments, whereas students could help identify potential adverse consequences not apparent in institutional testing. Before making the modified assessment function available to students, reviewers should compare its outputs against established assessment rubrics and examine student performance across relevant groups. Procurement contracts should require notification of changes affecting permitted uses and provide sufficient detail to evaluate their effects. Where advance notification is impossible, universities should develop policies and procedures to detect changes and temporarily suspend affected functions pending review. Review documentation should clearly indicate what was changed, who approved continuation of the altered function, and what conditions applied to such approval.

Protecting students and human judgment

Universities should inform students about how automated assessment tools contribute to their assessment. Students should also be able to request human review of their assessment results. The university administration should maintain adequate documentation of disputed assessment results resulting from computer-related changes. If a university adopts a marking model midway through the marking period, must it evaluate previously submitted assignments under the same approved conditions? Documentation need not reflect every interaction. However, it should identify the applicable version number, assessment settings, relevant evidence considered, and any human decision-making, along with provisions for access and retention that are consistent with protecting students’ personal data in the event of a subsequent formal assessment appeal.

Human oversight must carry meaningful authority. Article 14 addresses both automation bias in decision-making and the need to ensure humans have the capacity to disregard, override, or reverse algorithm-generated outputs. A confirmation button alone does not demonstrate that a teacher has the information and time to exercise independent judgement. The review must clarify when the intervention occurs and whether it can alter outcomes before it affects a student.

Universities should screen routine patch updates proportionately without delaying urgent security fixes. All changes that involve redistributing academic judgments must occur after an explicit decision. My central question is whether a university can articulate who authorised the algorithmic system that assessed a student, what changes were made to the system following initial authorisation, and why the system’s continued use remained academically justifiable.