The TEQSA AI toolkit governance expectations come down to four things a governing body and academic board must be able to show: that they have identified generative AI as a risk to award integrity, that they approved a credible institutional action plan and recorded the approval, that they receive a standing report on how the plan is progressing, and that they ask management questions the minutes can show were answered. This article reads TEQSA's AI publications from the board's chair rather than the teacher's.
I have written elsewhere about what the generative AI toolkit by TEQSA contains. Here the question is what oversight of AI risk looks like when the regulator reads the governance record, drawing on fifteen years of TEQSA registration and governance work with private providers.
Why TEQSA addressed AI to governing bodies, not just academics
In June 2024 TEQSA issued a request for information requiring every registered provider to lodge, by 3 July 2024, a credible institutional action plan addressing the risk generative AI poses to award integrity. The plan had to be overseen by the provider's governance, and TEQSA said it would follow up insufficient or absent plans and consider its regulatory tools.
That framing was deliberate. Academic integrity is a Standard 5.2 matter, and academic governance under Standard 6.3 is where responsibility for it sits. A plan written by a learning and teaching unit and never seen by the academic board does not satisfy the request, however good its content, because TEQSA asked for governance oversight and the evidence of that is a minute. In my experience the providers that responded well treated the request as a governance event first and a curriculum project second.
The action plan approval record at the centre of TEQSA AI toolkit governance
The single most important document is the record of the academic board and governing body approving the action plan. Assessors want to see when the plan was presented, what the board asked, what changed as a result, and the resolution adopting it. A plan that appears in the evidence index with no corresponding minute is, to the regulator, a plan that management wrote and nobody governed.
The record should also show the plan's connection to the Standards. TEQSA's 2023 paper on assessment reform for the age of artificial intelligence set out two principles, that students must be equipped for a society pervaded by AI and that trustworthy judgments about learning require multiple, inclusive and contextualised approaches, and the 2025 paper on enacting assessment reform moved from principle to practice. A board that approved a plan built on those principles, and minuted that it did so with reference to Standards 1.4 and 5.2, has produced governance evidence rather than a policy document, while showing it knows guidance publications are not themselves Threshold Standards.
The standing report: what the board should receive
An approved plan is the beginning of oversight, not the end. The academic board should receive a standing report, in my experience quarterly for the first two years, that tells it whether the plan is being implemented and whether it is working. The report needs data rather than reassurance: the proportion of units redesigned to include secured assessment points, integrity cases involving AI and their outcomes, staff development completed, and any unit behind schedule.
The corporate board then receives a summary from the academic board, because Standard 6.2 requires the governing body to monitor risks and Standard 6.3 requires academic governance to report to it. A generative AI report that goes to the CEO and stops there leaves the governing body without evidence that it monitored a risk the regulator has named. Our article on building an academic board TEQSA will accept describes how that reporting line should be constructed.
Questions a board should ask management
Directors without technical backgrounds sometimes assume they cannot govern AI risk. They can, because the questions are governance questions. Which of our awards depend on assessment that could be completed by a language model without the student learning anything, and what are we doing about each? Where are the secured assessment points in each course, and has the academic board seen the map? What is our policy on permitted use, how have students been told, and what happens when a student is accused?
Two further questions are the ones assessors ask. Are we relying on detection software, given that TEQSA does not treat detection as sufficient? And has anyone tested whether the plan works, by looking at outcomes rather than activity? In my experience a board that has asked those questions and minuted the answers is well ahead of the regulator's expectations, and a board that has not is exposed at the next renewal.
Where governance of AI risk goes next
TEQSA has said it will follow up on plans, and its gen-AI knowledge hub continues to publish sector practice. AI risk has become a permanent item in the governance calendar, like financial viability and student safety. Boards should expect to be asked about it at renewal and in the self-assurance report, and the answer needs to be a history of oversight rather than a description of intent. The broader institutional conversation is the subject of our piece on conversations on AI in higher education.
What I tell boards about generative AI oversight
Treat it as a risk you own. Approve the plan properly and record the approval, receive a report with numbers in it on a fixed cycle, ask the hard questions and minute the answers, and make sure the corporate board can show it saw what the academic board saw. That is the whole of the TEQSA AI toolkit governance task, and it is within the capacity of any board already governing competently. The boards that struggle treated the 2024 request as a compliance form, and the regulator remembers.
Download the AI Governance Checklist
— a board-level checklist covering the approval record, the standing report and the questions to ask management, drawn from our governance and TEQSA registration work with private providers. Get the checklist
Want the full article?
Enter your email for free access to the rest of this guide and our TEQSA resource library.
Frequently asked questions
What did TEQSA's 2024 request for information on AI require?
Every registered provider had to lodge, by 3 July 2024, a credible institutional action plan addressing the risk generative AI poses to award integrity, overseen by the provider's governance. TEQSA said it would follow up insufficient or absent plans.
Which governing body should approve the generative AI action plan?
The academic board should approve it as an academic integrity and assessment matter under Standards 5.2 and 6.3, and the corporate governing body should receive and note it as a monitored risk under Standard 6.2, with both approvals minuted.
How often should the board receive a report on AI risk?
In my experience quarterly for the first two years of implementation, with data on assessment redesign, integrity cases, staff development and student communication, then at least twice a year once the plan is embedded.
Does TEQSA accept AI detection software as evidence of assessment integrity?
No. TEQSA's assessment reform publications favour program-level assurance with multiple secured assessment points, and it does not treat detection software on its own as sufficient evidence that learning outcomes were achieved.
Dr Brendan Moloney is CEO of Darlo Higher Education, Australia's largest specialist TEQSA consultancy. He holds a PhD from the University of Melbourne, is a Cambridge University Press author on governance in higher education, and has advised private providers on registration and course accreditation for more than fifteen years.