Can Different Departments Within the Same University Have Different AI Rules?

Why Might the Same University Have Different AI Rules?

You discover that colleagues in another faculty are allowed to use an AI tool that your department restricts. Or one school permits generative AI for certain research tasks while another requires approval before researchers use it with project data.

That can look inconsistent, particularly when everyone belongs to the same university. Yet university-wide policies often establish a baseline rather than an exhaustive rule for every research environment. Different academic and professional units handle different types of information, technologies, participants, contractual obligations, and regulatory risks.

The practical issue is not whether every department must have identical AI rules. It is determining which central and local requirements apply to your particular research.

University-Wide Rules Can Coexist With Stricter Local Requirements

Why AI Rules Can Differ Within One Institution

A Central Policy May Establish a Floor Rather Than a Ceiling

A university may establish general principles for responsible AI use while allowing schools and units to develop more specific requirements for their own activities.

Harvard University's current generative AI guidance provides a straightforward example. Its university-level guidance addresses issues such as confidential data, security, privacy, compliance, copyright, and responsibility for generated content. It also explicitly directs users to review local School or Unit policies. Harvard Medical School, in turn, maintains research-focused AI resources addressing research practices, approved tools, publishing expectations, and requirements from research funders.

This structure is not evidence that one policy is necessarily wrong. The central policy may govern the whole institution while local guidance addresses risks peculiar to a particular environment.

Different Departments Handle Different Kinds of Data

Research material is not equally sensitive. A historian working with public-domain documents, a computer scientist experimenting with synthetic data, and a clinical researcher analysing patient information may all use generative AI, but the information they process can create very different obligations.

A medical or health sciences unit may work with health information and human genomic data. A business school may handle commercially confidential company data. An engineering laboratory may work with export-controlled technology or proprietary designs. A social science research centre may maintain identifiable interview recordings.

Consequently, a unit may restrict particular AI services because of the information typically handled there, even when the university permits those services for lower-risk activities.

Professional and Regulatory Requirements Can Differ by Discipline

Departments may operate within different external regulatory environments. Researchers in medicine, psychology, law, engineering, education, finance, or other professional fields may be subject to requirements that do not apply in precisely the same way to colleagues elsewhere in the university.

A university's general AI policy cannot necessarily anticipate every discipline-specific standard. Oxford's Research Integrity Policy, for example, requires researchers to follow applicable requirements and guidance from professional, statutory, regulatory, or discipline-specific bodies, in addition to university requirements.

That means two researchers employed by the same university can legitimately face different constraints because their work falls under different professional or regulatory regimes.

Research Ethics Can Create Project-Level Differences Too

Even researchers in the same department may not have identical permissions. One project might use only public data, while another involves vulnerable participants and identifiable health information. Their ethics approvals may therefore impose different conditions.

If an approved protocol specifies how data will be stored, accessed, processed, or transferred, an AI workflow that is acceptable for another project may not automatically be acceptable for yours. The question of whether an ethics committee can restrict AI use in a particular study therefore sits below the broader institutional level.

Approved AI Tools Can Vary by Data Classification

Local differences do not always take the form of "Department A allows AI, Department B bans it." The difference may concern which tool can process which category of information.

Harvard's current university guidance, for example, distinguishes publicly available AI services from systems assessed and approved for particular categories of confidential data. Harvard Medical School's research guidance then identifies institutionally available AI tools and applicable data classifications.

This produces a more nuanced rule than a simple yes or no. The same researcher might be allowed to use a public AI service with publicly available literature, an institutionally approved service with certain protected institutional information, and no external AI service at all for another restricted dataset.

Contracts and Sponsors Can Affect Particular Units or Projects

A research centre with extensive industry partnerships may operate under confidentiality agreements that restrict third-party processing. A laboratory conducting government-funded work may face security or export-control obligations. A clinical research unit may have agreements with hospitals or data providers.

Those obligations do not necessarily extend to every department in the university. They can nevertheless justify additional local controls because the affected unit routinely manages information subject to those restrictions.

Local Rules May Govern Teaching and Research Differently

Another source of apparent contradiction is the activity being regulated. A department might allow students to use generative AI in particular classroom exercises but prohibit it in an examination. The same department might separately allow researchers to use approved AI systems for coding or literature exploration.

Statements such as "our department allows ChatGPT" are therefore too imprecise to establish much. Always identify the activity, user, data, system, and purpose covered by the rule.

A Department Cannot Necessarily Override Central University Requirements

The existence of local discretion does not mean every department can simply disregard institutional policy. The authority of a local rule depends on the university's governance arrangements and the subject involved.

If a university-wide information-security policy prohibits a particular category of confidential data from being transferred to an unapproved service, a departmental preference for that service would not ordinarily erase the central security requirement. Conversely, a department may be permitted to impose stricter controls because of its particular research environment.

Different Rules Become Especially Important in Cross-Department Research

Interdisciplinary projects can expose these differences quickly. Imagine a computer science team developing an AI model with a medical school using patient-derived data. The computing researchers may normally use a range of external development tools, while the medical collaborators operate under stricter data-handling requirements.

The project cannot safely assume that each researcher may continue following only the ordinary practices of their home department. The team needs to identify which requirements govern the shared data, infrastructure, research procedures, and outputs.

The same problem becomes more complex when researchers belong to different universities, which is why determining the applicable AI policy in multi-institution research requires a separate analysis.

The Same AI Tool, Two Departments, Different Rules

The difference is not simply that one department "likes AI" and another does not. The research contexts create different governance requirements.

Common Misunderstandings About Departmental AI Rules

Check Both the Institutional Baseline and Your Local Research Environment

When your university has a central AI policy, treat it as the starting point rather than assuming it answers every local question. The next step is to determine whether your school, faculty, department, laboratory, research centre, clinical environment, or project has additional requirements.

Research teams can reduce later ambiguity by establishing their own project-level expectations for AI use. Those internal expectations should be compatible with every external requirement that governs the project.

When Your Department Has Its Own AI Guidance

Frequently Asked Questions About Different Departmental AI Rules

Different Local Rules Can Be Legitimate Within the Same University

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.