Investigating an AI-writing concern: a step-by-step framework for integrity officers

The short answer

An investigation into an AI-writing concern exists to find out what happened — not to confirm a suspicion. The two most common procedural failures in these cases are treating a detector score as a finding and working from a conclusion backward through the evidence. Both are intellectually dishonest and, increasingly, both lead to successful appeals and litigation.

The Adelphi University case (February 2026) illustrates the endpoint: a court found the university had acted "without valid basis and devoid of reason" when it penalized a student based on an AI detection score. The UK's Office of the Independent Adjudicator (OIA) has said the same thing in regulatory guidance — a detector score alone should not be treated as sufficient evidence of misconduct. The framework below is designed to produce investigations that survive challenge, because they are grounded in evidence rather than inference from a model.

---

Before you investigate: triage

A detector score is a triage tool. It is not evidence. Do not open a formal investigation on a score alone.

Before deciding whether to proceed, ask: is there corroborating information independent of the detector? Corroboration might include:

• A turnaround time that is implausible given the assignment's scope (submitted one hour after a midnight release of a complex 2,500-word prompt)
• Writing quality that is dramatically inconsistent with the student's prior submitted work in the same course
• A peer or colleague reporting the student mentioned using AI tools
• Submission metadata anomalies (unusual IP address, submission from a device not previously associated with this student's account)

A detector score combined with corroborating observation gives you a reason to proceed. A detector score alone does not. Opening a formal process based solely on a score is the procedural error that produces successful appeals — and it is unfair to the student, who will bear the burden of disproving a statistical inference before any real evidence has been considered.

---

Step 1 — Document the initial observation

Before doing anything else, document what you observed, when, who saw it, and what triggered the concern. If a detection tool was run, record which tool, which version, the score, and any caveats the tool itself attaches to the score. Turnitin, for example, cautions in its own published guidance that the score is weaker on short texts and should not be the sole basis for action.

Date-stamp everything. Do not share the concern with anyone outside the formal process — not informally with colleagues, not with students other than the one under review. If a student hears they are under investigation through informal channels before you have gathered your evidence, the investigation is compromised. Do not tell the student at this stage.

---

Step 2 — Gather available evidence before contacting the student

Before the student knows they are under review, collect everything the institution has available:

• Version history, noting its limitations (version history in Google Docs and Word is mutable and does not carry a cryptographic integrity guarantee — see chain of custody guidance)
• Any process records the institution captures through writing tools or LMS integrations
• Submission metadata: timestamp, device, IP address, time between assignment release and submission
• Prior submitted work from this student in this course and in prior courses, particularly work where their writing register is well-established
• The assignment brief and any discussions or clarifications that occurred in the lead-up to submission

Assess what you have honestly, without the pressure of a conversation with the student already underway. At this stage you are building a picture, not building a case.

---

Step 3 — Consider the population this student belongs to

One of the most consistent findings in the AI detection literature is that detectors do not flag everyone equally. Liang et al. (2023) tested seven commonly used AI detectors against authentic essays written by non-native English speakers and found an average false positive rate of 61.3% — compared to near-zero for native English speakers' authentic essays. This is not a marginal effect. It means that for a student whose first language is not English, a detector score is substantially less informative than it would be for a native speaker.

Vanderbilt University, when it disabled Turnitin's AI detector in 2023, made the arithmetic explicit: at Turnitin's own claimed 1% false positive rate on its general population, roughly 750 of Vanderbilt's 75,000 annual submissions would be wrongly flagged — with no way to identify which ones. At a 61.3% false positive rate for non-native speakers, the scale of wrongful accusation for that subpopulation is severe.

Groups that are known to be over-flagged include:

• Non-native English speakers
• Writers who favor formal, academic register
• Writers who write in dense, structured paragraphs rather than varied syntax
• Writers submitting short documents (under ~300 words)

If the student under review is in one or more of these groups, the evidentiary bar for opening formal proceedings should be correspondingly higher. A detector score for a non-native English speaker is weaker evidence than the same score for a native speaker. This is not a policy judgment; it is a technical fact about how these systems perform.

---

Step 4 — The conversation with the student

This is an information-gathering step. It is not a disciplinary hearing.

The conversation should take place in a setting that is low-pressure but documented — a recorded Teams or Zoom call, or a meeting with a note-taker. The student should be told that you are discussing the assignment, not that a formal investigation has been opened, unless your institution's procedures require earlier disclosure.

The goal is to understand the student's account of how the work was produced. Ask open questions:

• "Tell me about how you worked on this assignment. Where did you start?"
• "What sources did you use? Can you walk me through how you used them?"
• "Are there any parts of the assignment you found particularly challenging?"

Listen for fluency with the content. A student who genuinely wrote an essay should be able to discuss the ideas in it, the choices they made, the parts that were hard. A student who transcribed AI output often cannot. This is not infallible — a highly anxious student may underperform in a meeting — but it is observational evidence that a detector score is not.

Ask the student if they have any evidence of their own writing process: drafts, notes, browser history showing research, library access records. The presence or absence of such evidence is informative; the absence alone is not evidence of misconduct.

Do not present the detector score as a finding. Do not say "the detector found that this was AI-generated." Say "I have some questions about how this was produced and I want to understand your process." The score is a triage trigger. It is not what you are acting on in this meeting.

---

Step 5 — Assemble the evidence and apply the burden of proof

After gathering everything available, apply the institution's burden of proof honestly. The OIA is clear: the institution bears the burden of proving misconduct. A finding of misconduct must rest on evidence, not on the absence of evidence of innocence.

Ask: what would a panel need to be confident that this was not genuine student work? That is your threshold. Evidence that points toward misconduct might include:

• Process record showing text arrived in large blocks inconsistent with composition
• Session time implausibly short for the document length
• Content dramatically inconsistent with the student's established register, even in a conversation about the assignment
• The student being unable to discuss the ideas in the assignment in any depth
• Corroborated external evidence (peer report, prior disclosure)

Evidence that points toward genuine authorship might include:

• Process records showing a composition pattern with pauses, revisions, and burst structure
• Research trail (library access, browser history) consistent with the sources cited
• Prior work that establishes the student writes at the level of the contested submission
• The student explaining the work fluently in conversation

If you cannot clearly articulate what evidence supports the finding, you do not have a finding. You have a suspicion triggered by a triage tool.

---

Step 6 — Panel presentation

If you proceed to a formal hearing, present evidence — not tool scores.

A panel should hear: what specific behavioral or document anomalies were observed, what the timeline shows, how the student's account compares to the available process evidence, and what prior work from this student establishes about their baseline. The panel should also hear the student's evidence and account.

The Adelphi ruling turned on the university having presented only a score. A panel with access to a verified process record, a documented conversation with the student, and a comparison against established prior work is in a fundamentally different evidentiary position. It may still find for or against the student — but it is doing so on evidence.

If your institution does not have process records because it has not prospectively enabled process capture, note that honestly. An absence of process records is not evidence of misconduct; it is an evidence gap that applies equally to both sides.

---

Procedural errors that lead to successful appeals

The following are the most common procedural failures in AI-writing misconduct cases, based on OIA casework guidance and the pattern of cases that have been successfully challenged:

• Using the detector score as a finding. The OIA and the Adelphi court both found this insufficient. The score is a trigger; it is not a conclusion.
• Failing to consider student counter-evidence. If the student provides a process record, drafts, or a research trail, it must be assessed — not dismissed as easily fabricated.
• Not following institutional policy timelines. Procedural fairness requirements (notification deadlines, response windows) are enforceable independent of the underlying finding.
• Not disclosing which tool was used. A student cannot challenge evidence they don't know exists. Concealing the tool or its score from the student is a procedural failure.
• Treating the absence of version history as evidence of misconduct. Not all students use Google Docs. Not all assignments were set up to capture version history. Absence of process evidence is not affirmative evidence of fraud.
• Running the same text through multiple detectors until one flags it. This is p-hacking — not investigation.
• Sharing the concern informally before the formal process begins. If the student hears about the investigation through a colleague, a classmate, or an informal conversation before formal notification, they have an opportunity to destroy evidence — and you have prejudiced a fair process. Keep the concern strictly within formal channels.

---

Institutions that prospectively enable process capture are in a stronger position from the start — both for finding misconduct when it exists and for exonerating students when it doesn't. The exonerating use case is more common: most students who are flagged did not use AI, and having a process record that shows genuine composition closes the case fairly and quickly.

---

Quick reference: the six steps

Step	Key action	Key error to avoid
1 — Document the initial observation	Record the tool, version, score, and caveats before doing anything else. Date-stamp everything.	Sharing the concern outside formal channels, or telling the student at this stage.
2 — Gather evidence before contacting the student	Collect version history, process records, submission metadata, and prior work while the student is unaware.	Starting the student conversation before you have assembled the available evidence.
3 — Consider the student's population	Check whether the student belongs to a group with elevated false-positive rates (non-native speakers, formal register writers, short submissions).	Treating a detector score as equally informative across all student populations.
4 — The conversation with the student	Ask open questions about process. Listen for fluency with the content. Ask if they have their own evidence.	Presenting the detector score as a finding or framing the meeting as a disciplinary hearing.
5 — Assemble evidence and apply the burden of proof	Ask what a panel would need to be confident this was not genuine work. Articulate the evidence clearly on both sides.	Proceeding to a finding when you cannot articulate supporting evidence beyond the triage score.
6 — Panel presentation	Present behavioral and document evidence, the timeline, the student's account, and their prior work baseline.	Presenting only a tool score, or failing to place the student's evidence before the panel.

---

Related reading:

• How to talk to a student about suspected AI use
• Process data in integrity cases
• What forensic-grade means in academic integrity
• Alternatives to AI detectors
• How accurate are AI text detectors?
• What your Turnitin AI score actually means