GDPR compliance, data processing agreements, consent, retention and information security.
The same domain takes different forms at each level. The three readings below give its micro, meso and macro counterparts separately.
Respondents in every stakeholder group report withholding personal, sensitive and confidential material from prompts, preferring platforms the institution has licensed to publicly available ones, and using temporary chat modes so that no record is retained. The report characterises the pattern as a habit rather than as compliance with a rule.
Information security guidelines issued in December 2023 direct users to work primarily with Microsoft Copilot on a university device while logged in with university credentials. The instrument governs data exposure by prescribing where the interaction takes place rather than by listing prohibited content.
The institution updated its AI guidelines in April 2025 and its recommendations for action in July 2025, both advisory in character, while an overarching AI strategy and guidelines for AI in examinations were under development. Alongside them the university maintains a mandatory internal regulation of learning analytics to ensure data privacy, which is the one binding instrument in the set.