Can you use ChatGPT at a UK university? What the rules say

Short answer first: yes, in most cases, and there is no national ban to appeal to. Since July 2023 UK universities have worked from five Russell Group principles that treat generative AI as something to teach rather than forbid. What each university does instead is publish a category for every assessment. Manchester assigns each summative assessment one of four, from AI Prohibited to AI Integrated, from 1 September 2026. Bristol's default is Category 2, minimal. Exeter runs the same four-step scale under its own names. Misconduct is not using the tool. It is submitting what the tool wrote and calling it yours.

This article is about permission: what you may use, where the permission is written down, and what happens when you go past it. Detection is a separate question, and so is language help on writing you did yourself.

What have UK universities actually agreed?

One document sits underneath most UK guidance. In July 2023 the Russell Group published five principles on the use of generative AI tools in education, developed collectively by its member universities with AI experts. They commit to making students and staff AI-literate, to equipping staff to support that use, to adapting teaching and assessment to include ethical use of generative AI while supporting equal access, to upholding academic rigour and integrity, and to sharing practice as the technology changes. The document is explicit that transparent policies are what keeps standards consistent, and that fairness of access matters when the better tools sit behind a subscription.

Read that list again and notice what is not in it. There is no principle saying students must not use these tools. The sector's position is that the tools are part of the work now, and that the rules have to be published assessment by assessment.

Publication is where it gets uneven. HEPI Policy Note 71, written by Professor Sam Illingworth of Edinburgh Napier University and published in May 2026, went looking for the AI policies of 163 UK degree-awarding institutions and found only 96 with a publicly accessible one. Two in five had nothing a student could easily find. The note also describes the model the published policies run on as conditional trust: students are trusted if they declare their use, keep evidence and accept verification. That is a fair summary of what the rest of this article asks of you.

How does your university tell you what is allowed?

Not through one blanket rule. Through a category attached to each piece of assessed work.

• Manchester assigns a letter. The AI in Teaching and Learning Policy, in effect from 1 September 2026, gives every summative assessment one of four categories: A. AI Prohibited, B. AI Minimal, C. AI Permitted or D. AI-Integrated. The policy requires that the category is stated in the assessment brief and on Canvas, and the category decides what information the brief has to carry.
• Bristol numbers them and sets a default. Its guidance on using AI in assessment runs Category 1 Prohibited, which allows "not even spell- and grammar-checkers, e.g. in person invigilated exams", through Category 2 Minimal, Category 3 Selective, where AI may be used in limited and clearly defined ways such as exploring concepts, suggesting structure or summarising key ideas, to Category 4 Integral, where prompting and then critiquing the output is the assessment. Category 2 applies unless the unit director says otherwise.
• Exeter uses plain names. Its guidance on GenAI in assessments labels work AI-prohibited, AI-minimal, AI-assisted or AI-integrated, and for AI-assisted and AI-integrated work asks you to include your prompts and, where possible, links to the output as part of the submission.

The names differ, the ladder does not. If you learn the shape of it once, you can read any UK brief.

Where to find your category

The category is not folklore and it is not what the year above told you. It is written down, and it is specific to the assessment.

1. Open the assessment brief for that piece of work, not the module handbook.
2. Look for the category letter, number or name, and for a list of permitted uses.
3. Check the virtual learning environment page for the same assessment, since Manchester requires it there too.
4. If the brief is silent, email the module leader and ask which category applies. Keep the reply.
5. Assume the narrow end until you have that answer in writing.

What can you use it for without breaking a rule?

The uses that survive almost every policy are the ones where the tool works on your understanding rather than on your submission. Dundee's guidance for students names two of them directly: supporting research into a topic or concept to help develop initial understanding, and help with drafting ideas or suggesting how you might structure your own written materials. Bristol's Category 3 adds exploring concepts and summarising key ideas.

In everyday terms, that covers asking for a concept to be explained again in different words after a lecture that lost you, arguing with an explanation until it makes sense, asking for practice questions on a topic and then answering them yourself, and asking what a marking criterion is likely to be looking for. None of that ends up in the submission. More on the study side of this is in using AI for studying.

What changes at the boundary is authorship. Exeter puts the test as a single question to ask before you submit: who is the author of this work? If you cannot answer with your own name and mean it, you have gone past the line, whatever category the assessment sits in.

What counts as academic misconduct?

Three things come up again and again in UK cases.

• Submitted text you did not write. Dundee states that submitting work which is not your own, and the unauthorised use of generative AI, is academic misconduct. Bristol's regulations put the mis-use of artificial intelligence alongside collusion and contract cheating under cheating.
• References that do not exist. Covered in its own section below, because it catches honest students as well as dishonest ones.
• Generated code, diagrams and designs. The rule is about submitted work, not about prose. Dundee's wording covers using AI to generate assessment text or designs for submission. A generated function in a coursework repository is the same offence as a generated paragraph, and it is easier to spot, because you will be asked to explain it.

There is also a quieter category: use that was permitted but not declared. Exeter and Dundee both attach an acknowledgement requirement to permitted use, and leaving it out turns an allowed action into an integrity question about honesty rather than about AI.

Do you have to declare that you used AI?

Where it was permitted, yes, at most UK universities, and the wording is usually a single sentence.

Exeter's rule is the clearest statement of the principle: AI-generated content should be acknowledged in the same way as content taken from human authors. Practically that means you reference it. Exeter also asks for the prompts you used and, where possible, hyperlinks to the output, and provides a template for recording it.

Dundee gives students a model sentence to copy and adapt, of the form "I acknowledge the use of [AI tool] to generate materials for background research and self-study", or a longer description setting out the prompts you used, what came back and what you changed.

What an acknowledgement should contain

Keep it to the facts and put it where the marker will see it.

• The tool and its version. ChatGPT and Copilot behave differently, and so do versions of each.
• What you used it for. One clause. Explaining a concept, generating practice questions, checking a structure.
• What it did not do. If none of the submitted text came from it, say so.
• Your prompts, if the brief asks for them. Exeter does. Save the conversation as you go rather than reconstructing it in the last hour.

The uncomfortable case is the assessment where AI was allowed, you used it lightly, and you said nothing because it felt too small to mention. That is the case an investigation reads worst. Write the sentence.

What does a misconduct case actually cost?

Bristol's academic misconduct regulation is a useful map, because it publishes both the process and the range of outcomes. A panel is convened, you are invited to an interview online or in person, and you may put in a written submission instead. The panel decides on the balance of probabilities, which it defines as finding the offence proven if, on the evidence available, it is more likely than not that it was committed.

The penalties the panel can apply to the mark are capping it at the pass level, reducing it by 10 marks, reducing it by 20 marks, awarding zero for the assessment, or recording a fail on a pass or fail assessment. It can also find no case, or refer a case of serious dishonesty into the formal student disciplinary procedure, which is where suspension and expulsion live.

Look at what a zero does to a degree rather than to a module. A capped or zeroed component feeds into a credit-weighted average that is dominated by the later years, which is set out in how a UK degree classification is calculated. One assessment can move a boundary. That is the real cost, and it lands two years after the decision.

Why do the references it gives you not exist?

Because a language model produces text that looks like a citation, not a citation. Dundee names this plainly in its student guidance: AI tools make up references and citations that are completely fictitious, that do not exist. Exeter's instruction is to critically analyse and verify any information you plan to use in your academic work, including any references or sources provided by a generative AI tool, and its guidance lists fabrication, which it defines as the creation of false data or references, among the academic conduct offences that misuse of AI can amount to, alongside plagiarism, misrepresentation and falsification.

The failure mode is specific and worth recognising. The author names are real, the journal is real, the year is plausible, the title is the title a paper on that subject would have, and the DOI resolves to nothing. A marker who knows the field spots it in seconds, and a marker who does not will find it when they try to follow it up.

The rule that protects you is mechanical: no citation goes in your reference list until you have opened the actual source, through your library, and read enough of it to know it says what you are claiming. If you cannot open it, it does not go in. Your library's reading list and the module's own bibliography are a faster route to a real source than any chatbot.

What should you never paste into a chatbot?

This is the part of the rules students break by accident, because it does not feel like cheating. The University of Kent's data privacy guidance is blunt about the mechanism: generative AI tools process everything you type and many use this data to train their systems.

• Other people's personal data. Kent warns that sharing sensitive third-party data or research participant data without consent could present a serious breach of data protection law. Interview transcripts and survey responses are the obvious cases.
• Unpublished or proprietary material. Kent's guidance notes it could be stored and reused by AI providers. That includes a supervisor's draft, an industrial partner's documents and a placement provider's internal files.
• Your own identifying details. Kent's example is that if you enter your full name and contact details when asking a question, that information could later appear in a response given to someone else.

Kent's test is the useful one to carry around: treat the box like a public post and ask whether you would be happy for it to appear online. What your university holds about you, and what you can ask for, is a separate subject covered in your data rights as a UK student.

Two related questions sit next door to this one. Whether a marker can tell, and what happens when a detector says yes, is covered in Turnitin and AI detection at UK universities. Where a spellchecker stops and a rewrite begins, on work you wrote yourself, is in proofreading and Grammarly rules at UK universities.

Where Notibo fits

Notibo is not a text generator for assignments. It records a lecture, or takes an audio file you upload, and returns a transcript, structured notes and flashcards with spaced repetition. It also turns PDF, PPTX and DOCX files into notes and flashcards. The material it works from is the teaching you attended, which is the safe side of every category above, and the output is revision material rather than submitted prose. It handles 89 languages, and the transcript comes back in the language that was spoken.

The data answer, since you have just read Kent's warning. Files are stored in the EU, on Supabase in Frankfurt, while transcription and the AI notes run on US processors under standard contractual clauses. Uploads are capped at 50 MB, and long recordings are saved in smaller parts as they run and joined back into one transcript. You can try Pro free for 14 days, with 240 minutes of recording and no card. After that the free plan covers 30 minutes of recording a month, and Pro is EUR 9.99 a month or EUR 88.99 a year. Ask your lecturer before you record anything, and do not upload someone else's unpublished work.