Ethical AI Governance in Higher Education: Why Ugandan Universities Need Internal Policies Now

Why I write AI policy before I buy another tool

I coordinate e-learning work and teach in the Faculty of Computing and Informatics at Makerere University Business School (MUBS). Students already paste assignment briefs into public chatbots. Staff already ask generative tools to draft slides. That reality arrived before any perfect national statute. When NCHE and quality forums talk about Artificial Intelligence (AI) in higher education, the useful question for a computing faculty is not "will AI come?" It is "who owns the local rules when a student uses a model on a take-home task, or when a lecturer pastes a class list into a commercial tool?"

Uganda is building AI readiness conversations, including UNESCO-linked work on ethical governance and readiness assessment. Higher education still needs campus documents that lecturers can apply on a Tuesday. Related: The 2027 NCHE mandate for computing faculties. This post is a practical internal AI governance outline for Ugandan universities, written from teaching and e-learning coordination, not from a consultancy brochure.

What the national signals actually say

NCHE's 6th Annual Higher Education Conference (AHEC 2025) in Mbarara took AI integration as its theme. The published emerging issues include accuracy limits, academic integrity, data privacy, equitable access, infrastructure, and weak AI knowledge among educators. The same proceedings call for policies at institutional, regulatory, and national levels, and note that NCHE itself needs a regulation on AI use in higher education institutions: AHEC 2025 conference page and proceedings.

In August 2026, the Uganda Universities Quality Assurance Forum (UUQAF) Campus Convention at Kampala University carried a related message: adopt AI while strengthening assessment, integrity, and governance. Coverage of that convention records NCHE's Dr Vincent Ssembatya urging universities to redesign assessment so students show their own competence as AI spreads: Kampala University report on the UUQAF convention.

At national level, UNESCO reporting on Uganda's AI readiness work notes that Uganda still lacks a comprehensive AI-specific legal framework, and that instruments such as the Data Protection and Privacy Act (2019) do not fully cover algorithmic transparency or AI-specific data governance: UNESCO: National stakeholders dialogue on ethical AI governance. That gap is exactly why waiting for a finished national AI Act is a poor faculty strategy. Students will not pause their ChatGPT use until Parliament finishes a bill.

Institutional autonomy is not an excuse for silence

NCHE has encouraged dialogue and responsible adoption rather than a single overnight ban. That is sensible. It also means each university must write its own floor rules. A policy that only says "do not cheat" fails on day one. Students need examples. Markers need consistent penalties. IT and registry need data rules. Quality assurance needs a sampling method.

At MUBS, the conversations that stick are concrete. In Information Security and Unix-style modules, I care whether a student can configure a control, explain a log, and defend a choice under viva. A fluent AI essay about firewalls does not prove that competence. Governance and assessment redesign travel together: AI as a catalyst, not a crutch, for university assessment.

Part 1: Acceptable use and academic integrity

Write the boundary in plain language, with module annexes.

• Allowed with disclosure: brainstorming questions, outlining, grammar help, explaining an error message, generating a draft code snippet the student then rewrites and can defend.

• Not allowed: submitting model-generated text or code as original work; using AI to complete observed competence tasks; fabricating citations; running confidential case data through a public tool.

• CBE-sensitive tasks: observed labs, viva, live troubleshooting, and workplace evidence should be AI-free at the point of demonstration. Prepare and practice may use tools if declared; the demonstration itself must be the student's performance.

Publish short examples for humanities and for computing. Vague rules produce uneven marking between departments.

Part 2: Data privacy and security

Uganda already has the Data Protection and Privacy Act, No. 9 of 2019. Universities that collect and process student and staff personal data sit inside that regime even before any AI-specific Act arrives. Faculty policy should translate the Act into tool rules:

• Do not paste student names, registration numbers, phone numbers, health notes, or assessment scores into public generative tools.

• Classify research and institutional data: public, internal, restricted. Restricted data stays off consumer chatbots.

• Prefer institutional or vetted enterprise tools when the university can afford contracts with clear retention and training-use clauses.

• Record who may approve exceptions for research, and for how long outputs are kept.

UNESCO's readiness dialogue explicitly flags the mismatch between DPPA-era privacy law and AI-era risks. Campus policy should not pretend the Act already answers every chatbot question. It should use the Act as a floor and add AI-specific bans where the Act is silent.

Part 3: Transparency and disclosure

Require a short disclosure block on submissions that used AI: tool name, version if known, purpose (outline, grammar, code sketch), and what the student changed. Staff should model the same habit when they use AI to draft feedback or exam variants. Disclosure is not a moral carnival. It is audit evidence. If you teach planning and evidence discipline in IT/IS audit, the same habit fits: IT/IS audit series, Part 1.

Quality assurance can sample 10-20 scripts per large module each semester and check whether disclosure matches writing style, viva performance, and lab logs. Punish undeclared use consistently. Celebrate honest disclosure that still shows competence.

Part 4: Bias, fairness, and Ugandan context

Models trained mainly on other regions invent confident nonsense about Ugandan law, local institutions, and campus procedures. Policies should order staff and students to verify facts against primary sources, especially for legal, medical, and security claims. Do not outsource grading decisions to opaque scoring tools without a human accountable marker. Equity also means recognising that some students have better device and bandwidth access to AI than others. Literacy training and lab access reduce that gap; infrastructure planning matters: closing the infrastructure gap for AI and CBE.

Part 5: AI literacy and continuous training

A PDF policy without workshops is decoration. Sequence it:

1. Staff first: one practical workshop on disclosure, data bans, and redesigned assessment.

2. Student induction in week one of each year: same rules, with module examples.

3. Refreshers when tools change or when NCHE issues new guidance.

MUBS leadership has publicly pushed AI fluency across programmes. Fluency without ethics training produces polished misconduct. Fluency with ethics training produces graduates who can use tools and still own their competence.

How UUQAF and peer sharing help

Universities should not invent five incompatible definitions of "acceptable AI." UUQAF is a natural place to compare drafts, share disclosure templates, and align integrity language. NCHE conference follow-up strategies already include disseminating proceedings and building an action plan for AI integration. Use those national conversations, then write a local document your senate can approve.

A 60-day faculty drafting plan

1. Days 1-10: Inventory current AI use in your faculty (anonymous staff and student pulse). List high-risk modules (take-home essays, code take-homes, clinics).

2. Days 11-25: Draft the five parts above in eight pages or fewer. Attach module annexes for computing and one non-computing programme.

3. Days 26-40: Legal/registry review against DPPA duties; QA review against assessment regulations; student representative comment.

4. Days 41-50: Pilot disclosure forms in two modules; run one staff workshop.

5. Days 51-60: Senate or relevant board approval; publish on LMS and website; schedule annual review.

Keep the document short enough that a part-time lecturer will read it. Long philosophy chapters do not survive marking week.

What "good enough" looks like on campus

Good enough is not a glossy strategy deck. Good enough is a marker who knows whether AI was allowed on that task, a student who can point to the disclosure box, a lab where observed competence is AI-free, and an IT note that blocks pasting student registers into public tools. Pair governance with industry-relevant outcomes so policy does not float above employability work: industry linkages under CBE.

NCHE will likely tighten regulation over time. UNESCO readiness work will inform a national AI strategy. None of that removes the duty to govern what is already happening in your LMS and WhatsApp assignment groups. Write the internal policy now. Teach it. Sample it. Revise it. That is ethical AI governance in Ugandan higher education as I see it from a MUBS computing desk.