Academic integrity evidence: a comprehensive framework for evaluation and use

Short answer

Evidence in academic integrity proceedings must be evaluated across three independent axes: its type (observational — created by watching the event — or circumstantial — inferred from the artifact after the fact), its creation timing (pre-dispute, where evidence predates any knowledge of a dispute, or post-hoc, gathered in response to a concern already raised), and its verifiability (independently checkable by any party using public methods, or platform-dependent, requiring access to a vendor's system or data to confirm). No single method is sufficient on any of these axes alone, and no single method addresses all three simultaneously. The appropriate evidentiary combination depends on what was collected, at what point in the process, and what the proceeding demands — but the legally defensible minimum requires corroboration independent of the primary method, the student's documented opportunity to respond, and panel reasoning that engages with the specific evidence presented.

---

The three axes of evidence quality

Every piece of writing evidence occupies a position on three axes. Getting the axes right is the foundation of the whole framework — without them, it is impossible to assess whether evidence is sufficient, or to understand why two pieces of evidence from ostensibly the same method can have very different evidentiary weight.

Axis 1: observational vs circumstantial

Observational evidence was present at the event it documents. It records what happened, not just the residue left behind. A keystroke process record captures each input event as it occurs; an oral examination tests comprehension in real time. Circumstantial evidence, by contrast, infers past events from present artifacts. A detector score is computed on the finished text and asks whether that text has statistical properties associated with AI generation. Stylometric analysis compares the finished text to a reference corpus. Both are working backward from a product to a hypothesized process — an inferential step that an adversary can contest.

The distinction matters because circumstantial evidence always admits an alternative explanation. A high detector score is consistent with AI authorship — but also with a non-native speaker writing naturally in a formal register, which Liang et al. (arXiv:2304.02819) documented with a 61.3% false positive rate for non-native speakers when tested against GPTZero. Observational evidence does not require the same inferential step: a process record showing 47 minutes of composition with cognitive pause distributions at sentence boundaries is direct evidence of a writing event occurring; the question is whether the record is authentic, not whether the event occurred.

Axis 2: pre-dispute vs post-hoc

Evidence created before any party knew there would be a dispute has a structural advantage: it cannot have been fabricated for the purpose of the dispute. A process record sealed at submission time predates the concern; any version history that existed in the document predates the concern. A detector score run after a submission is flagged is post-hoc in the strict sense — it was created in response to a suspected dispute, not independent of it.

This axis is distinct from the timing of capture. A detector score run immediately at submission — as part of routine screening — is still post-hoc in the sense that the text existed first and the score was computed from it; the score was not created during the writing event. The axis turns on when the evidence would need to have been fabricated, if it were fabricated: a pre-dispute record would have to have been forged before the student knew the submission would be scrutinized, which is a much harder bar to clear than fabricating evidence after a concern is raised.

Axis 3: independently verifiable vs platform-dependent

Evidence that any third party can verify using publicly documented methods and the evidence itself — without access to the original vendor's systems — is independently verifiable. Evidence that requires a platform's cooperation to confirm is platform-dependent. NIST SP 800-86 builds its entire framework for forensic evidence around the principle that integrity should be verifiable by any party: the SHA-256 hash of a collected artifact can be recomputed by anyone with the artifact and a standard cryptographic tool, with no access to the original collection system required.

Version history requires Google's or Microsoft's platform to render or export — there is no platform-independent hash to verify against, and the data lives under the platform's control between the writing event and the presentation of evidence. A detector score can be rerun, but different tools produce different results (Weber-Wulff et al., arXiv:2306.15666), so "independently verifiable" is at best partial. A hash-sealed process record with a published cryptographic digest can be verified by any party using OpenSSL or equivalent — the verification requires no vendor participation.

Where evidence types fall in the three-axis space

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
graph TD
    A[Evidence type] --> B[Observational\nCaptures the event directly]
    A --> C[Circumstantial\nInfers from artifact]

    B --> D[Pre-dispute?]
    C --> E[Pre-dispute?]

    D --> |Yes| F[Sealed process record\nStrongest tier]
    D --> |Yes, unsealed| G[Unsealed keystroke log\nCorroborative]
    D --> |Live — no prior record| H[Oral examination\nStrong on comprehension]

    E --> |Continuous capture| I[Version history\nWeaker — mutable]
    E --> |Post-hoc score| J[AI detector score\nScreening only]
    E --> |Post-hoc analysis| K[Stylometric analysis\nCorroborative]

    F --> L{Independently\nverifiable?}
    G --> M{Independently\nverifiable?}
    I --> N{Independently\nverifiable?}
    J --> O{Independently\nverifiable?}
    K --> P{Independently\nverifiable?}

    L --> |Yes — hash-sealed| Q[Primary evidence\nAll three axes met]
    M --> |Partial — no seal| R[Corroborative\nTwo of three axes]
    N --> |No — platform lock| S[Corroborative only\nOne of three axes]
    O --> |Partial — tool variance| T[Screening only\nOne axis, partially]
    P --> |Partial — tool variance| U[Corroborative\nOne axis, partially]

---

A decision tree for evidence sufficiency

The following tree maps the path from available evidence to evidentiary conclusion. It is designed to reflect how a panel should reason through the evidence available to it — not as a mechanical checklist, but as a structured account of what the evidence does and does not establish.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart TD
    Start([Begin: concern raised about submission]) --> PR{Process record\nexists for submission?}

    PR --> |Yes| Sealed{Is the record\ncryptographically sealed?}
    PR --> |No| VH{Version history\navailable?}

    Sealed --> |Yes — hash verifiable| OE1{Add oral\nexamination?}
    Sealed --> |No — unsealed log| OE2{Add oral\nexamination?}

    OE1 --> |Yes| Strong[Strong primary evidence\nTwo orthogonal methods\nMeets minimum defensible standard]
    OE1 --> |No — not feasible| SealOnly[Sealed record alone\nPrimary evidence — document\nwhy oral not added]

    OE2 --> |Yes| Corrobo1[Corroborative + oral\nSolid — note tamper risk\nDocument hash absence]
    OE2 --> |No| Corrobo2[Unsealed log alone\nCorroborative only\nNot sufficient for sole basis]

    VH --> |Yes| VHWeak{Any detector\nscore or stylometry?}
    VH --> |No| NoProcess{Oral examination\nfeasible?}

    VHWeak --> |Yes — multiple signals align| MultiCorrobo[Multiple corroborating\ncircumstantial indicators\nMay support finding with\ncaution and documentation]
    VHWeak --> |No — detector score alone| DetOnly[Detector alone\nInsufficient — OIA guidance;\nAdelphiruling; proceed to\noral examination or close]

    NoProcess --> |Yes| OralOnly[Oral examination only\nTests comprehension now\nDoes not reconstruct past process\nDocument limitations]
    NoProcess --> |No| EvidGap[Evidence gap\nDocument formally;\npanel must reason from\nabsence and context only]

    MultiCorrobo --> OralAdd{Oral examination\nadded?}
    OralAdd --> |Yes| StrongerCorrobo[Corroborative stack\nwith oral — stronger;\nstill note each method's limits]
    OralAdd --> |No| WeakCorrobo[Corroborative stack only\nNo observational anchor;\nproceed with significant caution]

    Strong --> Defensible([Defensible finding basis])
    SealOnly --> Defensible
    Corrobo1 --> Review([Panel review — document reasoning])
    Corrobo2 --> Review
    StrongerCorrobo --> Review
    WeakCorrobo --> Caution([Proceed with caution;\nconsider closing or further steps])
    OralOnly --> Review
    EvidGap --> Caution
    DetOnly --> Caution

The tree embeds three key principles from the legal and regulatory record. First: a detector score alone never reaches the minimum threshold — the OIA's casework guidance and the Adelphi ruling both confirm this independently. Second: corroborating evidence must be independent; two circumstantial methods pointing to the same inference are not equivalent to one observational method. Third: every path to a finding requires documented panel reasoning, not just a conclusion — panels that cannot articulate why the evidence supports the finding are the ones that fail on appeal.

---

The legal standard: what "sufficient evidence" means in practice

Three legal and regulatory sources together define the framework within which academic integrity evidence will be evaluated if a finding is challenged externally.

FRE Rule 901 and the authentication requirement

Federal Rule of Evidence 901 requires that any proponent of evidence "produce evidence sufficient to support a finding that the item is what the proponent claims it is." For digital records, Rule 901(b)(9) addresses process or system evidence specifically, requiring a showing that the system "produces an accurate result." The practical implementation is set by NIST SP 800-86, which recommends cryptographic hashing as the minimum integrity control: evidence collected without a hash at acquisition cannot be verified as unmodified. This is the standard any writing-evidence record will be tested against if it reaches a formal proceeding in a US jurisdiction.

OIA burden-of-proof doctrine

The UK Office of the Independent Adjudicator's casework guidance on AI and academic misconduct establishes what institutions must demonstrate to sustain a finding that a student has used AI improperly. The OIA's guidance is explicit: institutions must show that the process for gathering and evaluating evidence was fair, that the evidence relied upon was sufficient to support the finding, and that reliance on a single tool or method — particularly an AI detection score — is not adequate. The OIA has upheld complaints from students where institutions relied solely on a detection tool without corroborating investigation or adequate opportunity for the student to respond. The burden of proof rests on the institution; the student does not have to prove they did not use AI. The institution has to prove, to the standard of the balance of probabilities, that they did.

The Adelphi ruling

In February 2026, a US court ruled in favor of a student who had been sanctioned by Adelphi University based primarily on an AI detection score. The ruling, reported by Inside Higher Ed, held that the university had not provided sufficient evidence to sustain the finding and that the disciplinary process lacked adequate procedural protections. While the full judgment has not been published at the time of writing, the outcome establishes two things clearly: that detector scores are not sufficient standalone evidence in a formal proceeding, and that procedural fairness — the student's opportunity to understand and respond to the evidence — is independently required, not just a best-practice addition.

What these three sources together establish

Read together, FRE 901, the OIA doctrine, and the Adelphi ruling establish a consistent standard across both major common-law jurisdictions: evidence must be authentic (verifiably unmodified), corroborated (no single method alone), and procedurally fair (the accused must have a genuine opportunity to respond to the specific evidence presented, not just to the allegation). None of these three requirements is jurisdictionally specific in its logic; they reflect principles that formal adjudication has converged on independently. Institutions outside the US and UK should assume that equivalent standards apply under their own regulatory frameworks, because those standards reflect structural requirements of fair adjudication rather than jurisdiction-specific legal rules.

---

A taxonomy of evidence types

The following table rates all six recognized evidence methods across the criteria that matter most in formal proceedings.

Method	Evidence type	Creation timing	Tamper-evident	Independently verifiable	Adversarial cost to defeat	Appropriate role
AI detection score	Circumstantial	Post-hoc	No	Partial — tool variance	Low — paraphrase attack suffices	Screening only; never standalone
Stylometric analysis	Circumstantial	Post-hoc	No	Partial — method variance	Medium — requires style adoption	Corroborative where prior samples exist
Version history	Circumstantial	Concurrent but mutable	No	No — platform-locked	Low — forgery tools publicly available	Corroborative with noted limitations
Oral examination	Observational	Real-time (now, not then)	N/A	Yes — live interaction	High — requires real-time unprepared engagement	Corroborative or standalone for comprehension only
Unsealed process record	Observational	Concurrent with writing	No	Partial — no hash anchor	Medium — log can be modified without detection	Corroborative; stronger than version history
Sealed hash-chained process record	Observational	Concurrent with writing	Yes	Yes — hash publicly verifiable	High — requires forgery of both behavioral timing and cryptographic proof	Primary evidence; highest single-method tier

Several cells deserve elaboration beyond the summary ratings.

AI detection — "Low" adversarial cost: Weber-Wulff et al. (arXiv:2306.15666) tested multiple commercial detection tools against paraphrase attacks and found detection rates drop sharply after a single rewriting pass. Free consumer-grade paraphrasing tools perform this attack in seconds. The adversarial cost is not the cost of producing AI text; it is the cost of defeating the detector once the text is produced — and that cost is very low.

Version history — "Concurrent but mutable": The creation timing looks favorable — version history logs are generated during writing — but the log itself is not hash-protected. The DocuSim project demonstrates that a visually indistinguishable Google Docs revision history can be synthesized programmatically, and Microsoft Word's revision history lives in editable Open XML files. The creation timing advantage is neutralized by the lack of tamper-evidence.

Oral examination — "Real-time (now, not then)": This distinction is important and frequently overlooked. An oral examination tests current comprehension; it does not reconstruct the original writing event. A student who did not write a piece may fail an oral examination — but a student who used AI assistance and then studied the result thoroughly may pass one. Oral examination is a strong method for testing the cognitive relationship between a person and their submitted work as of the examination date; it is a weaker method for establishing what happened during composition.

Sealed record — "High" adversarial cost: Crossley et al. (EDM 2024) found that authentic composition produces a distinctive distributional signature at linguistic boundaries — greater pause frequency before sentences and words — that is absent in transcribed text. Forging a sealed record that passes hash verification requires simultaneously replicating this behavioral signature (which requires modeling the cognitive writing process, not just typing speed) and producing a hash-chained log that passes cryptographic verification. An honest writer produces the right signal automatically; a forger must solve a non-trivial inverse problem under time constraints.

---

Population-dependent evidence interpretation

The same evidence has different weight depending on the student population to which it is applied. This is not a caveat to add to findings; it is a core part of how evidence should be evaluated, and failing to account for it is the most common reason formally sound-looking findings fail on appeal.

Detector scores and non-native speakers. Liang et al. (arXiv:2304.02819) tested GPTZero and other detection tools against essays written by non-native English speakers and found a false positive rate of 61.3% — that is, genuine human writing by non-native speakers was flagged as AI-generated more than three times in five. The mechanism is understood: formal academic English written by a non-native speaker can share statistical features with AI-generated text because both are drawing on a register that differs from casual native prose. A detector score for a non-native speaker is, therefore, weaker evidence than the same score for a native speaker — not because the tool is unreliable in general, but because the population base rate is radically different. A panel that does not know which population the student belongs to cannot correctly interpret the score.

Oral examination and test anxiety. A student with documented anxiety disorders, communication disabilities, or language barriers may perform poorly in an oral examination for reasons entirely unconnected to whether they wrote the submitted work. Relying on oral examination performance as sole evidence of AI use in a population that includes such students creates an asymmetric test: students with no anxiety disorder are examined; students with anxiety disorders are effectively at higher risk of a finding regardless of their conduct. Population matters here not as a methodological footnote but as a due-process concern.

Process records and prior capture history. A sealed process record is stronger evidence when the student has a history of providing such records — because the existence of the record for this submission is consistent with the student's established pattern, and its absence would itself be noteworthy. For a student whose first process record appears on the one submission under scrutiny, the record is still authentic, but the baseline comparison that makes it most compelling is absent. Conversely, a student who routinely submits with process records and then does not do so for one submission has an absence that is more informative than the absence would be for a student without that history.

Stylometric analysis and genre variation. Stylometry requires prior writing samples in a comparable genre and register. If prior samples are drawn from different assignment types — say, reflective journals compared to a research essay under scrutiny — the comparison may be unreliable for reasons unrelated to AI use. Even within the same genre, significant time gaps between samples can reduce reliability because writing style evolves. Stylometric evidence should be evaluated against the question of whether the prior corpus is genuinely comparable, not just whether the student has prior writing on file.

---

The prospective vs reactive distinction

Evidence gathered before a dispute is categorically different from evidence gathered after one. This distinction applies to each method differently, and understanding it is essential for deciding how much weight to assign to a given piece of evidence.

A sealed process record generated at submission time is prospective: it was created during the writing event, sealed before submission, and existed before any concern was raised. This is the strongest possible position on the pre-dispute axis. The record cannot have been fabricated in response to the dispute because it predates the dispute's existence. Any challenge to its authenticity must therefore argue that it was forged prospectively — that the student anticipated scrutiny and constructed a false process record in advance of submission — which requires a much more complex theory of deception than the alternative.

Version history also predates the dispute in terms of when its contents were created — the revision log was generated during writing. But the log as presented is post-hoc in a different sense: it is retrieved, exported, or screenshotted after the concern is raised, at which point its contents could have been modified between writing and retrieval. The creation was prospective; the presentation is post-hoc; and the lack of tamper-evidence means there is no way to distinguish the two.

A detector score is unambiguously reactive: the text is submitted, a concern is raised (or screening is run), and then the score is computed. The score did not exist during the writing event. An oral examination is reactive in the same sense — it occurs after the submission, in response to a concern. These methods are not weaker because they are reactive; they are weaker because of what they can and cannot establish about the past event, which is a function partly of their reactive nature and partly of their intrinsic method characteristics.

The practical implication for institutions is significant. A policy of collecting sealed process records at submission for all students — not just those under investigation — produces prospective evidence as a structural matter. A reactive policy of collecting process records only when suspicion is raised produces post-hoc evidence, because the student knows they are being investigated when they supply it, which changes both its evidential weight and its adversarial-cost dynamics.

---

Implementation implications for institutions

The framework has direct implications for how institutions should design their evidence policies — not just how they should evaluate evidence in an individual case, but what infrastructure needs to be in place before cases arise.

Deploy evidence collection prospectively, not reactively. Institutions that collect sealed process records at submission as standard practice have a structurally stronger evidentiary base than those that rely on evidence gathered after suspicion arises. The prospective record predates the dispute by definition; the reactive record does not. Policies that require process records only for certain assignment types or risk-flagged submissions should treat those as minimum coverage requirements, not as complete solutions.

Maintain a hierarchy of evidence methods. Not all evidence is equal; institutional policy should reflect the taxonomy above. AI detection should be named explicitly as a screening method, not a finding method. Version history should be documented as corroborative with the tamper-evidence limitation noted. Process records should be identified as the primary evidence tier. This hierarchy should be written into academic integrity policy so that panels apply it consistently and so that findings can demonstrate methodological consistency on appeal.

Document panel reasoning, not just conclusions. The Adelphi ruling and OIA casework guidance both point to the same failure mode: a finding that states a conclusion — "the panel determined that AI was used" — without articulating what evidence supports that finding and how. A defensible finding documents which evidence was considered, what each piece establishes, what alternative explanations were considered and why they were discounted, and why the balance of probabilities points in one direction. The reasoning must engage with the specific evidence for the specific student, not a generic description of the method.

Account for population in the evidence evaluation. The Liang et al. findings on non-native speaker false positive rates should be explicit in institutional guidance: a detector score for a student writing in a second language carries less weight than the same score for a native speaker, and the panel should say so in its reasoning. Institutions should also maintain documented procedures for oral examination accommodations to avoid the due- process exposure that population-blind examination creates.

Build an appeal-ready evidence package at the time of finding. The standard for a defensible finding is set not by what seems persuasive in the moment, but by what survives appeal to the OIA, a court, or an arbitral tribunal. For each contested case, the institution should be able to produce: the primary evidence with its provenance documented, the corroborating evidence and its limitations noted, the student's opportunity to respond and their actual response, and the panel's written reasoning engaging with both the evidence and the student's response. A finding that lacks any of these elements is at risk regardless of what the evidence actually shows.

---

Summary: the minimum defensible evidential standard

A defensible finding in an academic integrity case requires, at minimum, three things: corroborating evidence independent of the primary method (meaning at least two methods, with orthogonal failure modes); the student's documented opportunity to understand and respond to the specific evidence presented; and written panel reasoning that engages with the evidence, addresses the student's response, and explains why the balance of probabilities supports the finding.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart LR
    A[Concern raised] --> B[Gather available evidence\nand document each item's\ntype / timing / verifiability]
    B --> C{At least one\nindependent corroborating\nmethod available?}
    C --> |No| D[Do not proceed to finding\nDocument evidence gap;\nconsider oral examination\nor further steps]
    C --> |Yes| E[Notify student;\nprovide full evidence\ndisclosure]
    E --> F[Student response\nand opportunity to\npresent their account]
    F --> G[Panel evaluates:\nevidence weight per\npopulation and method limits]
    G --> H{Panel reasoning\ndocuments evidence,\nstudent response,\nand balance of probabilities?}
    H --> |No| I[Not defensible — return\nto panel for documented\nreasoning]
    H --> |Yes| J[Defensible finding\nAppeal-ready record]
    J --> K[File: evidence package,\nstudent response,\npanel reasoning,\nall in writing]

The standard described here is demanding, but it reflects what is actually required when a finding is challenged — and findings are challenged with increasing frequency as students become more aware of their options. The framework does not prevent institutions from acting; it ensures that when they do, the action survives scrutiny. An institution that cannot articulate its evidence in these terms has not met the standard; an institution that can has built a defensible record regardless of which way an appeal ultimately goes.

A process record sealed at submission time addresses the three axes simultaneously — it is observational, pre-dispute, and independently verifiable — which is why it forms the primary evidence tier. Authmarks is designed to produce exactly this class of evidence, capturing the writing process at the device level and sealing it with a cryptographic hash at submission, so that the record exists before any dispute and can be verified by any party without vendor participation.

---

Jurisdiction-by-jurisdiction legal standards

The preceding sections draw primarily on US and UK legal frameworks because those are where the most developed case law and regulatory guidance exist. But the principles established by FRE 901, OIA doctrine, and the Adelphi ruling are not isolated to those jurisdictions. Academic institutions operate globally, students appeal internationally, and an increasing number of cases involve international students whose home-country consumer protection law may be relevant even when they are studying abroad. The following surveys the major additional jurisdictions and identifies what each adds to the picture.

Australia: TEQSA, the Evidence Act 1995, and consumer law

Australia's Tertiary Education Quality and Standards Agency (TEQSA) is the national regulator for higher education providers. TEQSA has issued guidance acknowledging that AI-generated content poses a genuine challenge to academic integrity assessment, and that institutions' assessment design — including what evidence they can gather — is a quality matter under the Higher Education Standards Framework. The practical implication is that institutions with insufficiently robust evidence-gathering infrastructure face not just individual case failure but potential regulatory exposure if their practices are found systematically inadequate.

The New South Wales Evidence Act 1995, section 48, addresses the admissibility of electronic evidence in court proceedings. Section 48 allows documents produced by a device to be admitted where the court is satisfied that the device was operating properly at the relevant time — a requirement that maps directly onto the NIST SP 800-86 framework for hash integrity. A writing process record from an unsealed system cannot demonstrate, under section 48's implicit standard, that the device produced an accurate record that has not been modified since. A hash-sealed record, by contrast, satisfies the section 48 test by providing an independently checkable integrity guarantee.

Australian Consumer Law (ACL), contained in Schedule 2 of the Competition and Consumer Act 2010, is increasingly relevant in the higher education context because of the contractual relationship between students and institutions. Where a student can demonstrate that an institution's disciplinary process caused them a material loss — a delayed graduation, a revoked scholarship, reputational damage — ACL's consumer guarantees framework creates a potential civil claim pathway. This is not a theoretical risk: Australian courts have accepted that student enrollment is a consumer contract for ACL purposes. Institutions whose procedures produce unfair outcomes on inadequate evidence are therefore exposed on both administrative law and consumer law grounds.

Canada: common law authentication and FOIPPA

Canadian courts apply common law authentication standards derived from the same English common law roots as US and Australian evidence law. The Supreme Court of Canada's framework in R v. Goldhart and subsequent digital evidence cases requires that electronic records be authenticated as accurate and complete before they can be relied upon. For academic proceedings, this translates to the same functional requirement as FRE 901: the institution must be able to demonstrate that the evidence is what it claims to be and that it has not been altered.

British Columbia's Freedom of Information and Protection of Privacy Act (FOIPPA) introduces a tension specific to the Canadian context: student records are personal information subject to access rights, meaning that a student investigated for academic misconduct has a statutory right to access the evidence against them. This is procedurally protective — it aligns with the OIA's requirement that students have a genuine opportunity to respond — but it also means that institutions must be able to produce evidence in a form that can be disclosed. Evidence that lives in a vendor's proprietary system and cannot be exported in verifiable form creates a FOIPPA compliance problem, not just an evidentiary one.

The Truth and Reconciliation Commission's work in Canada established an important precedent in a very different context: oral testimony, properly corroborated and documented, can constitute legally adequate evidence of historical events even without contemporaneous written records. While this precedent does not apply directly to academic integrity proceedings, it reinforces a broader principle that the common law's approach to evidence is not rigid in its form requirements — what matters is reliability, not medium. A sealed digital process record meets the reliability standard; an unsupported detector score does not.

European Union: GDPR data minimisation vs evidence preservation

The General Data Protection Regulation's Article 5 requires that personal data be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed" (data minimisation) and that data be "kept in a form which permits identification of data subjects for no longer than is necessary" (storage limitation). These principles sit in direct tension with the evidentiary requirement to preserve process records that may be needed in future proceedings.

The resolution is not to choose one principle over the other but to design evidence infrastructure that satisfies both simultaneously. A sealed process record that is cryptographically keyed to a specific submission — and whose retention is governed by a documented policy with defined retention periods tied to the academic calendar and appeal windows — can satisfy both the evidence preservation requirement and the GDPR data minimisation principle. What cannot satisfy both simultaneously is a policy of unlimited retention of all keystroke data from all students on the off chance that any individual might later be investigated.

German administrative courts (Verwaltungsgericht) have addressed the treatment of electronic academic records in several cases involving degree revocation and disciplinary sanctions. The consistent principle is that electronic evidence must be accompanied by adequate documentation of the collection process — who collected it, when, by what method, and whether its integrity has been verified — before it can support a finding. This closely tracks both the NIST SP 800-86 requirement and the common law authentication standard.

The French data protection authority (CNIL) issued guidance in 2024 on algorithmic decisions in education, noting that institutions cannot rely solely on automated algorithmic outputs — including AI detection scores — to make decisions that significantly affect students. The CNIL guidance aligns with Article 22 GDPR's restriction on automated individual decision-making. While the CNIL framing is data protection rather than evidence law, the practical requirement is identical: a human must review independent evidence; the algorithm's output is not the decision.

Common principles across all jurisdictions

Despite the jurisdictional variation in how these requirements are framed, three principles emerge consistently.

Authentication: evidence must be what it claims to be. Every jurisdiction examined requires some form of authentication — a showing that the evidence accurately captures what it purports to capture and has not been modified. The cryptographic hash is the most widely recognized mechanism for meeting this requirement in digital evidence contexts.

Corroboration: no single automated tool is an adequate sole basis for a finding that affects a student's academic standing. This principle appears in the OIA guidance, the Adelphi ruling, the CNIL guidance, and the implicit logic of section 48 of the NSW Evidence Act. It reflects a deep structural feature of how adjudication works: the consequences of false positives from a single method are too severe to bear without independent confirmation.

Procedural fairness: the student must have a genuine opportunity to understand and respond to the specific evidence used against them. This is not merely a procedural requirement that can be satisfied by formally notifying the student; it requires that the evidence be disclosed in sufficient detail that an informed response is possible.

Comparative summary

Jurisdiction	Primary legal framework	AI detection as sole evidence	Recommended evidence standard
United States	FRE Rule 901; NIST SP 800-86	Insufficient (Adelphi ruling, Feb 2026)	Authenticated + corroborated + oral opportunity
United Kingdom	OIA casework doctrine	Insufficient (OIA guidance, explicit)	Balance of probabilities; institutional burden; independent corroboration
Australia	TEQSA Higher Education Standards; Evidence Act 1995 s 48; Australian Consumer Law	Insufficient (no basis under s 48 without integrity guarantee)	Hash-verified record or equivalent; consumer contract exposure for inadequate process
Canada	Common law authentication; FOIPPA access rights	Insufficient (common law authentication not met)	Reliable + disclosable; student access rights must be satisfiable
European Union	GDPR Art 5, Art 22; CNIL guidance; German Verwaltungsgericht practice	Insufficient (Art 22 automated decision prohibition)	Human review mandatory; documented collection process; GDPR-compliant retention

---

The different hearing types and what each requires

Academic integrity proceedings are not a single type of event. They occur across a spectrum of formality, from a brief conversation between an instructor and a student to external judicial review. Each stage in that spectrum has different evidentiary requirements — and a critical failure mode in practice is applying the wrong standard to the wrong stage, or carrying insufficiently documented evidence from an informal stage into a formal one where the gaps become decisive.

The informal meeting

An informal meeting is typically the first response when an instructor notices something that raises a concern. This might be a conversation in office hours, a request to discuss the submission, or an email exchange. At this stage, no formal evidentiary burden applies: the conversation is fact-finding, not adjudication. The instructor is trying to understand what happened; the student is explaining their process.

Two important constraints apply even at this stage. First, no adverse outcome can follow from an informal meeting alone. If the conversation produces a concern that rises to the level of a formal allegation, that allegation must be processed through a formal proceeding — the informal stage cannot be used to shortcut to a sanction. Second, what is said in the informal meeting may later be relevant in a formal proceeding: if a student's account in the informal meeting contradicts evidence presented later, that contradiction can be material. Instructors should keep brief contemporaneous notes of informal meetings for this reason.

The informal stage is also where many cases that should not proceed further are resolved. A student who can explain their process — even without formal documentation — and whose explanation is plausible given the submission may simply resolve the concern. The purpose of the informal conversation is to gather information, not to assign blame.

The formal disciplinary hearing

A formal hearing is a structured proceeding with defined roles, a formal record, and the possibility of sanctions. In the UK, formal hearings apply the balance of probabilities standard: the panel must find it more likely than not that the conduct alleged occurred. In the US, the standard is preponderance of the evidence, which is functionally equivalent. Both standards require the institution to affirmatively prove the allegation; the student does not have to prove innocence.

At the formal hearing stage, every element of the evidentiary framework in this article becomes directly applicable. The evidence must be: authenticated (is this what it claims to be?); corroborated (is there at least one independent method confirming the primary finding?); and subject to procedural fairness (has the student had genuine opportunity to see and respond to the specific evidence?). The panel's reasoning must be documented in a form that explains why the evidence supports the finding and how the student's response was considered.

Formal hearings produce appeal-ready records — or they should. The quality of the record produced by the formal hearing determines whether the institution's position can survive external review. A panel that reaches a defensible conclusion on adequate evidence but records only a one-line summary of its reasoning will fare poorly if the finding is challenged.

The academic appeal

An academic appeal is not a re-hearing of the case. It reviews the original hearing's process and evidence to determine whether the procedure was correctly followed and whether the evidence was adequate to support the finding. An appeal panel typically does not hear new evidence or call witnesses; it reviews the record from the formal hearing.

This has a critical practical implication: defects in the first-instance proceeding generally cannot be cured on appeal. If the evidence at the formal hearing was insufficient, the appeal panel will find that the original finding was not supported. If the student was not given adequate opportunity to respond to specific evidence, the appeal panel will find a procedural failure. The appeal is not a second chance for the institution to produce better evidence; it is an examination of whether the institution met the standard the first time.

This is why building an appeal-ready evidence package at the time of the formal finding — not afterward — is the only effective strategy. The standard the evidence must meet is set by what survives appeal, not by what convinces the first-instance panel.

External ombudsperson and court review

At the most formal end of the spectrum, an external ombudsperson (such as the OIA in the UK) or a court applies the highest evidentiary standard. At this level:

• Hash integrity of digital evidence is a baseline requirement, not a best practice. NIST SP 800-86 or equivalent provides the operational standard for what "integrity verified" means.
• The process records used as evidence must be producible in full, not just summarized. If the evidence was a sealed process record, the institution must be able to produce the record and its hash for independent verification.
• Procedural failures identified by the external reviewer typically result in the original finding being set aside. It is very difficult for institutions to recover from procedural failures at this stage.

External review also introduces the possibility that the student is represented by counsel, which changes the nature of the evidentiary challenge the institution faces. An unrepresented student at a formal hearing may not know to contest the authentication of a detector score; a represented student at external review absolutely will.

The escalation failure pattern

A critical and frequently observed failure pattern in the academic integrity proceeding lifecycle is the following: an informal meeting produces an adverse outcome — an instructor, after a brief conversation, concludes that the student used AI — but no formal proceeding is initiated. The student then formally complains about the informal adverse treatment, and the complaint is processed through a formal hearing that inherits the evidentiary gaps from the informal stage.

The formal hearing is now working with evidence that was never collected for formal purposes: no authentication, no corroboration, no contemporaneous documentation of the informal conversation's content. The panel is asked to make a formal finding on the basis of what the instructor remembers, a detector score, and perhaps the submission itself. This stack fails the minimum defensible standard on multiple grounds, and when it is challenged externally, the institution typically loses.

The preventive measure is procedural clarity: informal meetings are fact-finding only; any adverse outcome requires a formal proceeding; formal proceedings require evidence collected to the standards described in this framework from the outset.

Hearing types and escalating evidentiary standards

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart TD
    A([Concern identified]) --> B[Informal meeting\nFact-finding only\nNo sanctions\nBrief notes recommended]

    B --> C{Concern resolved?}
    C --> |Yes| D([Case closed — no record])
    C --> |No| E[Formal disciplinary hearing\nBalance of probabilities\nPanel + formal record\nSanctions possible]

    E --> F{Student accepts\noutcome?}
    F --> |Yes| G([Finding recorded\nSanction applied])
    F --> |No| H[Academic appeal\nReviews process + evidence\nDoes not re-hear de novo\nFocuses on procedure and\nevidence adequacy]

    H --> I{Appeal outcome}
    I --> |Finding upheld| G
    I --> |Finding overturned| J([Finding set aside\nSanction removed])
    I --> |Procedural defect\nidentified| K[Remitted to\nformal hearing\nfor correction]

    K --> E

    H --> L{External escalation?}
    L --> |OIA / ombudsperson| M[External review\nHighest standard\nHash integrity required\nCounsel possible]
    L --> |Court| N[Judicial review\nor civil claim\nFull evidence rules apply\nFRE 901 / Evidence Act s 48]

    M --> O{External outcome}
    N --> O
    O --> |Institution upheld| G
    O --> |Institution overturned| J

    style B fill:#fffdf8,stroke:#6f5618
    style E fill:#e8f4ee,stroke:#1f5a3a
    style H fill:#e8f4ee,stroke:#1f5a3a
    style M fill:#f0ede4,stroke:#1f5a3a
    style N fill:#f0ede4,stroke:#1f5a3a

The diagram illustrates both the escalation path and the key asymmetry: evidentiary standards become more demanding at each stage, but the evidence that will be examined at each stage was collected at a prior stage. The only way to build a defensible record is to collect evidence to the highest foreseeable standard from the earliest stage at which it might be needed.

---

Case studies: how the framework applies to five real scenarios

The following five worked examples apply the framework to concrete fact patterns. Each scenario is a composite that illustrates a distinct evidentiary situation; none is drawn from a specific identified case. The purpose is to show how the abstract framework resolves to concrete conclusions — and why those conclusions follow from the framework's principles rather than from intuition about what "looks like" AI use.

Scenario 1: Detector flag with no process record

Facts. A 600-word philosophy essay scores 85% AI on Turnitin. The student is a native English speaker and a second-year undergraduate. No process capture was in place for this assignment — the institution does not currently use process record infrastructure. The student says they wrote the essay themselves over approximately two hours in the library. No corroborating witness is available.

Evidence map. The detector score is circumstantial, post-hoc, and only partially independently verifiable — rerunning Turnitin on the same text would produce the same score, but different tools produce materially different results for the same text (Weber-Wulff et al.), so "independently verifiable" is constrained to that one tool's methodology. There is no corroborating evidence. No oral examination has been conducted. The student's verbal account is unverified but also unchallenged; it is a claim, not evidence. There is no process record at all — not because one was suppressed, but because none was collected.

Framework verdict. This evidence stack does not meet the minimum defensible standard. There is a single circumstantial, post-hoc, partially verifiable data point and nothing else. A formal charge brought on this basis is at high risk on appeal: the OIA guidance explicitly covers this scenario, and the Adelphi ruling establishes that US institutions face the same outcome.

Correct immediate outcome. An informal meeting to discuss the essay, not a formal charge. The meeting should explore the student's process, test their comprehension of the specific arguments made in the essay, and look for any available corroborating signal. If the meeting produces credible concern about comprehension, an oral examination in a formal context can be arranged before any formal proceeding is opened.

What would have helped. Prospective process capture would have provided a sealed record at submission time. In its absence, an oral examination conducted before any formal charge is the only available method of adding corroborating evidence. The institution should treat this case as a demonstration of the infrastructural gap that prospective capture is designed to close.

Scenario 2: Process record exonerates

Facts. A student submits a 2,100-word essay and is subsequently flagged by the institution's AI detection screening. Her sealed process record is retrieved. It shows three hours and fifteen minutes of composition across two sessions, 847 distinct revision events, pause distributions consistent with Crossley et al.'s authentic composition signature — longer pauses before sentence boundaries, shorter pauses within phrases — and zero paste events exceeding 40 characters.

Evidence map. The sealed process record is observational (it captured events during the writing session), pre-dispute (it was sealed at submission, before any concern was raised), and independently verifiable (its cryptographic hash can be recomputed from the record and the published algorithm). It meets all three axes simultaneously. The detector score is circumstantial, post-hoc, and partially verifiable — it was the trigger for the concern, not independent evidence of the conduct alleged.

Framework verdict. The process record answers the question the detector raised. The detector inferred from the artifact; the process record shows what actually happened. These are not equivalent or competing pieces of evidence — they address different questions. The record shows that a writing process of 3h15m with 847 revision events occurred; the detector's inference from the finished text is superseded by direct evidence of the composition process. The correct outcome is: the concern is resolved, the record is filed, and no proceeding is opened.

What institutions sometimes do wrong. A common error is to treat the process record as "the student's claim" rather than as independent evidence. It is not the student saying "I wrote this." It is a sealed record that predates the dispute, produced by an independent capture system, showing what happened. Its probative status is equivalent to a CCTV recording of the writing session — not identical, but in the same logical category. Treating it as merely the student's self-report misunderstands both the evidentiary value of the record and the purpose of prospective capture infrastructure.

Scenario 3: Contract cheating with no digital trace

Facts. A student purchased an essay from a contract cheating service. The service produced a human-written essay by a professional writer — not AI-generated text. The detector scores it as human (correctly — it is human-written, just not by the student). No process record exists because none was collected for this assignment. No unusual paste events are apparent in the document's metadata. The writing style is broadly consistent with the student's prior submissions, because the contract writer was briefed on the student's prior work.

Evidence map. There is no evidence of AI use — because AI was not used. There is no evidence of contract cheating in the digital record or the text itself. The process record infrastructure is absent, so there is no process record showing what happened. The only available signal is stylometric: a careful comparison of the submitted essay to prior work might reveal inconsistencies that the contract writer's briefing did not eliminate. But stylometric evidence requires a comparable prior corpus and produces circumstantial, post-hoc analysis — it can raise a question but not answer it.

Framework verdict. This scenario is entirely outside the scope of AI detection, which is irrelevant here. Process records would have revealed the absence of a writing process — but no process record was collected. The only available investigative method is oral examination: a careful conversation testing the student's familiarity with the specific arguments and sources in the submitted essay. Without a behavioral signal from process evidence and without a stylometric mismatch strong enough to support a formal finding, the institution cannot make a finding.

What this case illustrates. The framework's limits are real. Neither detection-based nor process-based evidence helps when a third party has written a text authentically. Contract cheating services exist precisely because they can defeat both AI detection (by using human writers) and stylometric analysis (by mimicking the student's prior style). The oral examination remains the only method that can test whether this student can explain and defend the specific work submitted — and its absence here is a structural gap, not a case-specific failure.

Scenario 4: Non-native speaker falsely accused

Facts. A graduate student whose first language is Mandarin submits a literature review for a research methods course. Her English proficiency is high — she holds an IELTS score of 7.5 — but she writes in a formal academic register that draws heavily on established disciplinary vocabulary. Turnitin AI scores the submission at 76%. No process record exists. The instructor refers the case for formal investigation on the basis of the detector score.

Evidence map. The detector score is the only evidence. For this student population — a non-native English speaker writing in formal academic English — Liang et al.'s finding of a 61.3% false positive rate against GPTZero (and similar tools sharing the same statistical approach) means the evidentiary value of a 76% score is materially lower than it would be for a native English speaker. The base rate of false positives for this population is high enough that a 76% score is, in probabilistic terms, more consistent with genuine human writing by a non-native speaker than with AI generation. The detector has not identified AI writing; it has identified a statistical register that correlates with AI writing and also with non-native academic English.

Framework verdict. Population assessment changes the evidentiary threshold before any other analysis. The same score that might justify opening an informal conversation with a native English speaker does not reach the threshold for this student. A formal charge brought on a single detector score for a non-native English-speaking student is at extremely high risk on appeal, because the false positive rate for this population is documented in peer-reviewed literature and will be cited by any well-prepared appeal submission.

What went wrong. The instructor applied the detector score without performing population assessment. The question that must be asked before any detector score is used as even a triage trigger is: for this student, in this population, what is the known false positive rate? For students writing in a second language, that question has a documented answer that changes the evidentiary calculus entirely. The Adelphi ruling is particularly instructive here because, while the facts of that case are not fully published, the pattern — detector score applied without population assessment, formal proceeding opened, student sanctioned, court reverses — precisely describes the risk this scenario presents.

Scenario 5: Sealed record supports a finding

Facts. A student submits a 2,400-word argumentative essay. When the institution reviews the sealed process record associated with the submission, it shows: total session duration of 12 minutes; a single paste event at 11:43:22 that inserted 2,391 words into a previously blank document; zero revision events after the paste; the session ending 47 seconds after the paste event. The document's total writing activity consists of the paste event, one paragraph break insertion, and a title typed before the paste.

Evidence map. The sealed process record is observational, pre-dispute, and independently verifiable — all three axes met. What it shows is not an inference about the character of the text; it is a direct record of what happened during the document's creation. Specifically, it shows that 99.6% of the document's text arrived as a single block in a single paste event and that no writing activity occurred before or after. This is not an AI detection score inferring from the product. It is the process showing what the product's creation looked like.

Framework verdict. This record provides sufficient primary evidence to open a formal proceeding. The evidence is specific, documentable, and directly addresses what happened: the essay was not composed; it was pasted. An oral examination conducted before the formal hearing will add corroborating evidence — the student's ability to explain, defend, and engage with the specific content of the essay — and its results, whatever they are, will either strengthen or qualify the process record's implications. The institution can articulate specifically what the evidence shows: not "AI was used" but "the document was submitted as a single pasted block with no prior writing activity." That is a finding about process, not an inference about authorship, and it is observable in the sealed record by any party.

The critical distinction. This scenario illustrates the most important practical distinction in the framework: process evidence can show what happened; detectors infer from what resulted. A process record showing a 12-minute single-paste composition is not claiming to know whether AI was involved. It is showing that the composition process was absent. That is a standalone finding with independent evidentiary value, regardless of what the detector score says.

---

Expert witnesses in AI integrity proceedings

Most academic integrity proceedings do not involve expert witnesses, and they do not need to. The framework described in this article is designed to be applied by institutional panels without technical expertise, provided that the evidence itself has been collected and documented appropriately. But in a subset of cases — particularly those that have reached external review or court proceedings, or where the technical evidence is genuinely complex — expert witness input becomes relevant.

When an expert witness is appropriate

Expert testimony is appropriate when a panel needs to understand technical evidence that it cannot reasonably evaluate without specialized knowledge. In academic integrity proceedings involving AI and process evidence, this typically arises in three situations:

First, when the institution's evidence includes a sealed process record with complex behavioral analysis — keystroke timing distributions, pause pattern analysis, comparison to population norms — that the panel cannot interpret without technical guidance. An expert who can explain what the distributional signature means and how it was analyzed provides the panel with what it needs to assign appropriate weight to the evidence.

Second, when a student challenges the reliability of a specific detection tool and the challenge requires technical evaluation. Weber-Wulff et al.'s documented false positive and true negative rates are peer-reviewed findings, but interpreting them in the context of a specific tool version, a specific text, and a specific threshold requires expertise that a typical academic panel does not have.

Third, when a cryptographic hash verification is contested — for example, when the student or their counsel argues that a sealed record could have been tampered with despite the hash. An expert who can explain what SHA-256 verification demonstrates, what its limits are, and why the specific claim of tampering is or is not technically plausible provides the adjudicative clarity the panel needs.

What a credible expert would and would not testify to

A credible expert in this domain would testify to: the accuracy limits of specific detection tools as documented in published research; the meaning of a cryptographic hash verification and whether the specific record in evidence passes it; the interpretation of a keystroke timing distribution and what it does and does not indicate about the composition process; the known false positive rates for specific population subgroups.

The same expert would not testify to: whether AI was or was not used in this specific submission (the expert cannot know this); whether this specific student is or is not capable of writing at this level (the expert has no basis for this); whether the student is honest or dishonest (this is a character judgment, not a technical assessment). Expert testimony confined to explaining what the evidence establishes is credible and useful; expert testimony that leaps from evidence to conclusion is both methodologically inappropriate and likely to be challenged on cross-examination.

The expert's role in the adjudicative process

The expert's function is to give the panel what it needs to reason about the evidence, not to provide the conclusion the panel is required to reach. A panel that adopts an expert's conclusion wholesale without engaging with the specific evidence has not met its own adjudicative responsibility. An expert who offers a conclusion rather than an explanation has exceeded their appropriate role. The evidentiary framework — authentication, corroboration, procedural fairness — is applied by the panel; the expert explains what the inputs to that framework mean.

For most institutional proceedings, practical considerations make expert testimony unavailable: the costs and timelines of formal expert evidence are disproportionate to the scale of the proceeding. The framework in this article is therefore designed so that institutional panels can reason through AI integrity evidence without expert input — but only when the evidence has been collected in a form that non-expert panels can evaluate. A sealed process record with a documented hash, presented with the evidence it produced, is designed to be interpretable by a non-expert panel. An unsealed log from a proprietary system with no documentation of its collection method is not, even with expert help.

---

How evidence standards are evolving

The evidentiary landscape for academic integrity cases is not static. The confluence of AI capability improvements, increased student awareness of appeal rights, developing legal precedent, and emerging process evidence infrastructure is changing both what evidence is available and what standards it will be held to. Understanding the direction of travel is important for institutions planning their evidence infrastructure today.

The current landscape (2026)

In 2026, the dominant institutional practice remains detector-led investigation: a submission is flagged by an AI detection tool, a concern is raised, and the investigation proceeds from there. The OIA's guidance and the Adelphi ruling have begun to shift this, but practice lags behind legal standards because policies update more slowly than case law.

The consequence is a growing mismatch between what institutions believe their evidence supports and what it actually supports in external review. Cases that institutions consider closed — "we found AI use, the student accepted the sanction" — are reopening as students become aware that accepted sanctions on inadequate evidence may not have been freely accepted at all. The OIA's published casework data shows a year-on-year increase in AI misconduct cases and a consistent pattern of procedural failures in those that are upheld.

The strongest signal of current inadequacy is the Adelphi ruling itself: a case that reached a US federal court on facts that most institutions would have considered routine. The student was sanctioned; the evidence was a detector score; the court reversed the sanction. Every institution that has imposed sanctions on detector scores alone should be treating Adelphi as a direct signal about the vulnerability of its past decisions.

Near-term developments (2026–2028)

In the near term, the Adelphi ruling will be cited in a growing number of student appeals and court filings, because it represents the kind of clear precedent that appeals lawyers reach for. Institutions that have not updated their procedures to reflect its implications face an expanding liability exposure.

The OIA is likely to sharpen its guidance in response to the volume and pattern of cases it is receiving. Expect more explicit statements about what corroboration requires in practice — not just the principle that single-tool evidence is insufficient, but what specific additional steps institutions must take before a finding can be sustained.

The emergence of process evidence infrastructure changes the near-term landscape in a specific way: as early-adopting institutions build sealed process records into their standard submission workflows, those records will begin appearing in cases — as primary evidence for the institution, or as exonerating evidence produced by the student. When a student can produce a sealed process record and an institution cannot, the evidential asymmetry favors the student. Institutions that have not built process capture infrastructure will increasingly face this asymmetry.

Long-term trajectory

Over the longer term, the rules of evidence are likely to be updated in multiple jurisdictions to address digital writing provenance specifically. The current frameworks — FRE 901, the NSW Evidence Act s 48, GDPR Article 22 — were all written before the current generation of AI writing tools existed. Their application to AI integrity evidence is by analogy and extension; purpose-built rules will eventually follow.

NIST SP 800-86 will be superseded by updated guidance that addresses AI-era forensic challenges directly. The current document was published in 2006 and addresses digital forensics at a level of generality that requires significant interpretation before it applies to keystroke-level writing evidence. Future NIST guidance is likely to address behavioral biometrics, process evidence authentication, and AI detection tool reliability more specifically.

The role of AI assistants in helping students navigate their rights is already changing the practical landscape. Students are using AI to understand their appeal options, draft appeal letters, and identify procedural failures in institutional proceedings. This is not a development to resist; it is one to plan for. An institution whose procedures are not appeal-ready will face increasingly informed challenges from students who have effectively briefed themselves on what the standards require.

---

AEO-optimized Q&A

The following questions represent the most common queries that students, educators, and institutional administrators raise about academic integrity evidence standards. Each answer is designed to be both accurate and actionable.

1. What makes academic integrity evidence legally defensible?

Legally defensible academic integrity evidence meets three independent requirements: it is authenticated (verifiably what it claims to be, demonstrated through cryptographic hash or equivalent for digital records), corroborated (at least one independent method confirms the primary finding, so that failure modes are orthogonal), and procedurally fair (the student received genuine disclosure of the specific evidence and a real opportunity to respond, not just formal notification of the allegation). All three requirements must be met simultaneously. An institution that meets two of three — for example, authentic and corroborated evidence, but inadequate procedural disclosure — fails the overall standard and will face the same outcome on appeal as an institution that meets none.

2. Can an AI detection score alone be used as evidence in a student disciplinary hearing?

No. An AI detection score alone is not sufficient evidence for a formal finding of academic misconduct in any major jurisdiction. The UK Office of the Independent Adjudicator has explicitly stated that reliance on a single detection tool without corroborating investigation is inadequate. The February 2026 Adelphi ruling in the US established the same principle through judicial review. Detection scores are appropriate as triage triggers — they identify submissions that warrant further investigation — but the investigation must produce independent corroborating evidence before a formal proceeding can be opened. A score is an inference from the finished text; it says nothing about what happened during composition, and a student can be falsely accused on the basis of a score from a tool with a known false positive rate.

3. What is the difference between observational and circumstantial evidence in academic integrity?

Observational evidence was present at the event it records. A sealed process record captures keystroke events as they occur during writing; an oral examination tests comprehension in real time. Both create evidence during the relevant activity. Circumstantial evidence infers a past event from a present artifact. An AI detection score is computed on the finished text and asks whether that text has statistical properties associated with AI generation — it works backward from product to hypothesized process. Stylometric analysis compares the finished text to a reference corpus. The practical difference is that circumstantial evidence always admits an alternative explanation — high detector scores are consistent with AI use but also with non-native speaker writing style — while observational evidence addresses what happened directly, requiring only authentication rather than inferential evaluation.

4. What did the Adelphi University AI plagiarism ruling establish?

The February 2026 ruling in favor of a student sanctioned by Adelphi University established two principles in US law. First, AI detection scores are not sufficient standalone evidence to support a formal disciplinary finding; the institution must produce corroborating evidence that addresses the composition process, not just the artifact's statistical properties. Second, procedural fairness is an independent legal requirement: the student must have a genuine opportunity to understand and respond to the specific evidence used against them, not merely to be notified that an allegation has been made. The ruling is directly cited by students and their advisors in academic appeal proceedings across the US, and its implications extend to any institution that has imposed sanctions on detector-score-only evidence.

5. What is a sealed process record and why does it meet the highest evidentiary standard?

A sealed process record is a timestamped log of composition events — keystrokes, deletions, pastes, pauses — captured during a writing session and protected with a cryptographic hash at the point of submission. The hash ties the record to a specific moment in time and allows any party to verify that the record has not been modified since sealing. It meets the highest evidentiary standard because it satisfies all three evidence axes simultaneously: it is observational (it captured events during the writing session rather than inferring from the finished text), pre-dispute (it was sealed before any concern was raised, so it cannot have been fabricated in response to a dispute), and independently verifiable (the hash can be recomputed by any party using standard cryptographic tools, without access to the original capture system). No other single evidence method meets all three axes simultaneously.

6. How does the OIA burden-of-proof doctrine apply to AI cheating allegations?

The OIA's casework guidance on AI and academic misconduct places the burden of proof on the institution, not the student. The institution must demonstrate, to the standard of the balance of probabilities, that the student used AI improperly — the student does not have to prove that they did not. This is the same standard as other formal academic misconduct proceedings: the institution is making an allegation and bears the burden of supporting it with adequate evidence. The OIA has upheld complaints from students where the institution relied on a detection score without corroborating investigation, where the student was not given adequate opportunity to respond to the specific evidence, and where the panel's reasoning did not engage with the evidence in sufficient depth. The doctrine also requires that the institution's process was procedurally fair throughout — not just at the formal hearing but including the investigative stage.

7. What evidence should a student keep to prove they wrote their own work?

Students who want to protect themselves against false AI misconduct allegations should prioritize three types of evidence. First and most important: a sealed process record generated at submission time. If their institution uses a platform that produces sealed process records, the record is generated automatically and predates any dispute. Second: version history in a documented, timestamped form. While version history has known tamper-evidence limitations, its existence corroborates the process record. Third: research materials, notes, and drafts that predate the submission — annotated readings, outline drafts, browser history showing research activity. These are circumstantial but corroborative. Students should also preserve any written communications about the assignment — feedback from instructors, peer review comments, draft submission receipts — because contemporaneous communications about work in progress are pre-dispute evidence that does not require technical infrastructure to create.

8. Why does version history fail as standalone evidence?

Version history fails as standalone evidence because it is not tamper-evident. The revision log in Google Docs can be synthesized programmatically using documented tools — the DocuSim project provides a public demonstration that a visually indistinguishable revision history can be produced without genuine writing activity. Microsoft Word's revision history lives in editable Open XML files that can be modified directly. Neither platform protects the revision log with a cryptographic hash that would allow a third party to verify that the log has not been modified since it was created. Version history is corroborative when combined with other evidence — particularly a sealed process record that was created independently — but it cannot serve as primary evidence precisely because the ease of its fabrication is publicly documented and eliminates the adversarial-cost protection that makes primary evidence persuasive.

9. What is the minimum evidence standard for a defensible academic integrity finding?

The minimum defensible standard requires three things simultaneously. First, at least two methods with orthogonal failure modes, meaning that the ways in which each method can produce false results are different enough that both failing in the same direction requires a separate explanation. A detector score and a version history are not orthogonal — both can be produced without genuine writing — while a detector score and a sealed process record are orthogonal. Second, the student must have received documented disclosure of the specific evidence and a genuine opportunity to respond to it, not just notification of the allegation. Third, the panel's written reasoning must engage with the specific evidence, address the student's specific response, consider alternative explanations, and articulate why the balance of probabilities supports the finding. A finding that meets two of these three requirements is still not defensible — all three are necessary conditions, not a scoring rubric.

10. How should institutions handle evidence from non-native English-speaking students?

Institutions must perform population assessment before applying any detector-score evidence to a non-native English-speaking student. Liang et al.'s peer-reviewed research (arXiv:2304.02819) documents a 61.3% false positive rate for non-native speakers when tested against GPTZero — that is, more than three in five authentic essays by non-native writers were classified as AI-generated. This rate is high enough that a detector score alone for a non-native speaker has near-zero probative value because the false positive rate is so high relative to the base rate of actual AI use. Before any formal step is taken on the basis of a detector score for a non-native speaker, the institution must gather independent corroborating evidence — specifically, a process record or oral examination that addresses the composition process rather than the artifact's statistics. Institutional policies should document this population-dependent adjustment explicitly, both to ensure consistent application and to provide a written basis for the procedure if it is later challenged.

---

Related reading:

• Writing evidence methods compared
• Investigating AI writing concerns
• What forensic-grade means in academic integrity
• Chain of custody for digital writing evidence