groundy
Ethics, Policy & Safety

How to Set AI Policy for Student Email: What Cheating Rules Miss

A 2026 preprint suggests AI email drafting may erode student writing skills without breaking rules. This policy matrix uses message stakes to guide disclosure and assessment.

Published 7 references
A closed forest-green ceramic envelope sits beside a larger open ivory envelope held by two sculpted ceramic hands. Copper accents, rough seams and hard shadows stand out against a warm ivory background.
On this page10 sections

Set your AI policy for student email by message type, not by authorship. That is the practical answer, and it falls out of a structural problem: a student who asks an AI to draft a routine email to an instructor breaks no existing rule, produces a better message, and leaves nothing for a detector or integrity office to find. The cost, if there is one, shows up only in aggregate and over time, in students who can recognize a professional email but can no longer write one unaided. A policy built on cheating rules cannot see that cost, because nothing in the process trips a rule.

The evidence for this reframing comes from an August 2026 preprint, Delegating Before Learning: Where Generative AI Sits in Students’ Professional Communication, which models student-to-institution communication as two processes, one with AI mediation and one without. Its central passage is worth quoting at length because it defines the policy problem precisely:

“The student breaks no rule, the instructor is not wronged, and no vendor decision is to blame. Every visible sign improves: the emails are clearer, arrive faster, and are better received. The cost exists only in aggregate and over time, and it becomes visible only where someone deliberately looks. Research can look for it, since the models predict that heavy delegators should remain able to identify a professional email that works while becoming less able to produce one unaided. Policy can act on it, since institutions treat AI in student communication as an academic integrity question even though nothing in the process we model breaks a rule.”

Two cautions belong up front, because everything below rests on this paper. First, the authors explicitly frame their conclusion as a hypothesis: “The comparison shows that AI changes the process itself, and that its costs are invisible in the messages it produces. We offer it as a hypothesis.” Second, the underlying evidence is a single author-reported qualitative interview study of twelve students recruited across multiple North American universities, and the material presented draws on a preliminary analysis of six of the twelve interviews. No cited study follows students over time, and the authors state that testing the degradation claim would require evidence that follows students over time, which they do not have. Treat the framework that follows as precautionary reasoning, not as established fact about skill loss.

The blind spot: a better email with no rule broken

The two-process comparison is the paper’s useful contribution for policy writers. In the unaided process, a student drafting an email to a professor practices recipient-specific judgment: what this person needs to know, in what register, with what level of deference or directness. Success returns confidence in the writer’s own ability. In the AI-mediated process, per the authors’ model, the message is no longer written for its specific recipient in the same way, and the confidence a successful exchange returns attaches to using the system rather than to the writer’s own ability. Both of those are author-reported model claims, not measured outcomes.

What matters for an administrator is not whether the model is right in every detail. It is the asymmetry the model exposes. Cheating rules are designed to catch a visible wrong: copied text, outsourced authorship of graded work, a misrepresented artifact. Delegated routine email produces none of these. The artifact improves. The recipient is satisfied. If a writing program wants to defend the learning that routine email used to provide, it cannot do so by policing the emails themselves, because the emails are where the evidence is weakest. The defense has to live somewhere else: in the curriculum.

The authors say this directly: “Professional register, once acquired through ordinary daily practice, now has to be taught directly, and that is a curriculum question.”

A message-type matrix, not an authorship rule

If authorship is the wrong axis, what is the right one? Two, and both come from the mechanism the paper describes. The first is recipient stakes: what rides on the message for the person receiving it and for the student’s standing. The second is register-acquisition value: whether drafting this kind of message unaided is itself part of what the program is supposed to teach.

Crossing those two axes gives a policy matrix. This matrix is a construction the evidence motivates; none of the cited papers prescribes it. The mechanism comes from the two-process paper, the effective policy levers come from the integrity review discussed below, and the evidentiary floor comes from the detection studies.

Message typeExamplesRecipient stakesRegister-acquisition valuePolicy responseDisclosure norm
Routine transactionalScheduling, logistics, receipt confirmations, administrative queriesLowLow: the skill is peripheral to most programs’ objectivesAllow AI draftingOptional
High-stakes consequentialExtension requests, grade appeals, academic-difficulty disclosures, advising requests with real consequencesHigh: the recipient acts on the messageModerate: judgment about what to say matters, but the goal is a fair outcomeAllow with required disclosure; state consequences for misrepresentation of facts, not of proseRequired
Instructional register practiceMessages assigned or expected as professional-communication practice (first contact with a research supervisor, internship outreach, formal correspondence in a writing course)VariesHigh: unaided production is the learning objectiveRedesign as explicit instruction; require unaided drafts with drafting historyRequired, plus process artifacts

The logic of each row follows from the mechanism. Routine transactional email is where delegation does the least harm under the hypothesis and where enforcement is most hopeless, so prohibition buys nothing and drives use underground. High-stakes messages deserve disclosure not because the prose is suspect but because the recipient makes decisions based on them, and the student should own the content’s accuracy. Instructional messages are the one category where the unaided process itself is the point; these belong in the syllabus as taught, assessed work rather than in the integrity code as banned behavior.

What detection-based rules cannot see

Some programs will be tempted to keep an authorship rule and enforce it with detectors. The detection literature says this fails in both directions: it misses the use it targets and flags the writing it should reward.

On the miss side, Why AI Detection Fails for Academic Integrity reports that after humanization, “more than 96% of AI-labeled rewrites evade Pangram and GPTZero.” A student running a drafted email through a paraphrasing pass is, on these numbers, effectively invisible. The figure comes from a study of abstracts, not student email, and it will move as detectors and humanizers change, so treat it as dated evidence about direction, not as a permanent constant.

On the false-positive side, the same detection study found that light edits, human abstracts refined by an LLM, were flagged at 64–80% by Pangram and 38–49% by GPTZero; the study calls the pairing of those flags with near-total humanizer evasion an integrity catch-22. Style as a Confound: False Positives in AI Detection of Non-Native Academic Writing warns: “In practice, AI detector outputs should not be treated as definitive evidence of AI use, especially in academic settings where editing is common. Detector scores may indicate linguistic refinement rather than AI generation, so they should be considered alongside contextual information.” Applied to email, this is a trap with a specific shape: for several widely used detectors, the students most likely to be flagged are the ones whose writing is polished, heavily edited, or non-native, which is to say, exactly the professional register a writing program is trying to produce. A flag-based email policy risks punishing the skill it claims to protect.

The evidentiary standard that follows is also stated by the detection study itself: detector output is weak evidence, not default misconduct evidence, and any flag must be paired with drafting history, with sanctions reserved for cases where human judgment supports a lack of appropriate student effort. If your policy cannot accommodate drafting history as a required counterpart to any flag, it should not use flags at all.

Disclosure norms that survive contact with reality

Required disclosure is the matrix’s workhorse for high-stakes and instructional messages, so it is worth asking whether disclosure mandates actually produce disclosure. The adjacent evidence is discouraging. A full-text analysis of 164k scientific publications found that of the 75k papers published since 2023, only 76, roughly 0.1%, explicitly disclosed AI use, even though 70% of the journals analyzed had adopted AI policies, primarily requiring disclosure. Journal publishing is not student email, and the incentives differ, but the figure is a warning about the default: a disclosure requirement without instruction, norms, and any consequence structure will likely see near-zero voluntary compliance.

This is where the integrity-review evidence becomes operational. A narrative review of 16 publications on academic integrity and generative AI found that students do not interpret all forms of AI assistance as cheating, and that integrity risk rises when institutional guidance is vague, peer use appears normalized, pressure is high, and AI is perceived as a legitimate substitute for difficult cognitive labor. Its conclusion about what works is the policy writer’s lever set: “By contrast, assignment-level guidance, explicit disclosure norms, ethics-oriented instruction, and authentic assessment design appear to reduce integrity risk more effectively than detection-centered responses alone.”

Read together, the two sources imply that a disclosure norm works only when it is attached to something else: explicit teaching about when disclosure matters, and assessment designs that make the underlying skill observable. Vague guidance is not a neutral default; per the review, it is itself a risk amplifier. A syllabus that says “AI use in correspondence is prohibited” without defining correspondence, assistance, or disclosure is the worst available option: unenforceable, unread, and corrosive of the norm it asserts.

Where the policy lives

A program-level email policy also has to find its institutional home, and the governance evidence says that home is not obvious. An NLP analysis of AI policies across U.S. higher-education institutions in 34 states found “a clear divergence: university-level policies emphasize data security and risk mitigation whereas school-level policies, when present, focus on pedagogical applications and tool usage.” The same study reports that relatively few business schools maintain AI policies distinct from university frameworks, creating misalignment with discipline-specific learning objectives.

The practical reading: your university’s AI policy almost certainly covers data security, approved tools, and risk. It almost certainly does not cover whether a first-year student should draft their own email to a potential research supervisor, because that is a pedagogy question, and pedagogy lives at the program level or nowhere. Program-level silence is not permission, and university-level policy is not coverage. Someone in the writing program has to write the email-register policy, or it defaults to whatever students infer from each other, which the integrity review identifies as one of the conditions that raises risk.

Teaching register once everyday practice is delegated

The deepest consequence of the hypothesis is for assessment. If routine delegation removes the daily practice through which professional register used to accumulate, then a program can no longer certify communicative competence by assumption. The register skill has to be taught directly, practiced in assignments where unaided production is the point, and assessed authentically: supervised drafting, drafting-history review, live composition, or message-writing tasks embedded in coursework rather than observed in the wild of the inbox.

That is a real cost, and it deserves honesty rather than ritual lament. Explicit instruction in professional register takes curriculum hours that programs previously got for free from everyday practice. It also raises the cost of assessment, because “can this student write a professional email” becomes a claim that needs evidence rather than a safe inference from the emails the student sends. Under the hypothesis, the inbox stops being evidence at all: the better the delegated emails get, the less they say about the sender.

What the evidence does not show

The strongest counter-evidence comes from a different domain. A study of learning with logic puzzles found that “short-term skill development is associated less with how often participants request AI help and more with whether they continue to engage in independent reasoning.” Delegation frequency alone did not predict skill loss; what mattered was whether independent production survived somewhere. Logic puzzles are not professional email, but the finding is directly relevant to policy design: if the register-degradation mechanism is conditional on independent reasoning disappearing, then a policy that preserves unaided production in instructional settings may defuse most of the hypothesized harm without restricting routine delegation at all.

Combine that with the limitations already noted: a single author-reported qualitative study drawing on six of twelve interviews, a self-described hypothesis, no cited study that follows students over time, detector percentages that will drift, and a near-zero disclosure rate imported from journal publishing. The case for the matrix is precautionary and structural, not empirical proof that students are losing register now.

I would still write the policy this way before next term. Allow routine transactional email with optional disclosure, because prohibition there is unenforceable and, on the current evidence, low-stakes. Require disclosure on high-stakes messages, because recipients act on them. Convert the instructional category into explicit professional-register teaching with authentic assessment, because that is the one place where the unaided process is itself the objective, and it is the cheapest insurance against a hypothesis that would be expensive to confirm the hard way. And if you keep any detector in the loop, write the weak-evidence standard into the policy text: no flag stands alone, drafting history is required, and sanctions require human judgment about effort. The one option the evidence rules out is the one many programs currently have: a blanket authorship rule, enforced by detection, aimed at messages where nothing detectable is wrong.

Frequently Asked Questions

What are the two axes for the proposed AI email policy matrix?

The first is recipient stakes: what rides on the message for the person receiving it and for the student’s standing. The second is register-acquisition value: whether drafting this kind of message unaided is itself part of what the program is supposed to teach.

Why might a blanket authorship rule enforced by detection be ineffective?

The one option the evidence rules out is the one many programs currently have: a blanket authorship rule, enforced by detection, aimed at messages where nothing detectable is wrong.

References

Follow the links in the article for context. The supporting material is collected here for further reading.

  1. Why AI Detection Fails for Academic Integrityarxiv.orgAccessed
  2. A study of learning with logic puzzlesarxiv.orgAccessed

Join the discussion

Share a useful perspective or ask a question about this article.

Discussion guidelinesComments privacy