Generative AI Governance in Education: A Scoping Review of Principles, Mechanisms, and Risks in English-Language Documents

Synthesis: Elmahjub et al. (2026) ran a PRISMA-ScR scoping review that identified 498 records and close-read 160 English-language AI Governance documents published between January 2020 and December 2025 — 47 from intergovernmental and regional bodies, 97 from national or jurisdiction-based sources — to ask whether governance of Generative AI in education amounts to a coherent response. On the evidence of instrument form, it does not: only 4 of the 160 documents take formal legal or regulatory form, while 92 are guidance, ethical frameworks, advisory documents, toolkits, or handbooks, so the commitments written down most often carry the least authority. The authors' principles–mechanisms–risks nexus sorts 11 principles, 12 mechanisms, and 11 risk categories, then reads their co-occurrence. Accountability appears in 146 documents but a named oversight body, committee, or professional role in 102. Capacity building is the most frequent mechanism at 152 documents, environmental sustainability the least at 87, and no national framework sets enforceable environmental standards.

Key Findings

1. A three-year field. The corpus holds 1 document from 2020, 1 from 2021, 2 from 2022, then 25 from 2023, 66 from 2024, and 65 from 2025, so 156 of 160 were published in 2023–2025.
2. Most governance is not binding. Four documents (2.5%) have formal legal or regulatory form, 24 (15.0%) are policies or national strategies, 92 (57.5%) are guidance or toolkits, and 40 (25.0%) are reports or white papers.
3. Accountability outruns the machinery for it. Accountability is coded in 146 documents (91.2%) but a named body, committee, or role in 102 (63.8%); in the guidance stratum it is 84 of 92 (91.3%) against 54 (58.7%).
4. Attention clusters on institutional risk. Ethics and governance (133, 83.1%), data privacy (127, 79.4%), legal compliance (122, 76.2%), and human capacity (111, 69.4%) lead; pedagogical quality trails at 29 (18.1%).
5. Capacity is the default answer. Capacity building and AI literacy is the most frequent mechanism at 152 documents (95.0%), ahead of monitoring and audit (147, 91.9%) and disclosure (141, 88.1%).
6. Environmental and cultural concerns are named, not operationalized. Sustainability is a mechanism in 87 documents (54.4%) and a risk in 47 (29.4%), co-occurring in 46 (28.8%); cultural heritage is the thinnest principle at 37 (23.1%).
7. The corpus is Anglocentric. U.S. issuers supply 42 documents and UNESCO 23; 22 records from 12 South American countries yielded no included national document under the English-language rule.

Four documents with legal force

The review's sharpest move is to sort documents by the authority they carry rather than by what they say. Four documents take formal legal or regulatory form, 24 are official policies or national strategies, 92 are guidance, advisory documents, or toolkits, and 40 are reports or white papers. The totals hold, but their meaning changes: the education-specific direction on assessment practice, professional roles, and classroom practice sits mostly in the 92-document guidance stratum, while the clearest written obligations on transparency, documentation, and human oversight sit in the smallest one — most visibly the EU AI Act, which places specified educational uses in the high-risk category. The authors flag a related ambiguity: 131 documents are coded as invoking legal or regulatory controls, but only 3 of those are themselves legal instruments.

Where documentary attention concentrates

Eleven principles were coded, and the procedural ones cluster tightly: safety, wellbeing, and integrity in 150 documents (93.8%), accountability in 146 (91.2%), transparency with Privacy and assessment trust in 142 each (88.8%). Educational commitments follow — inclusivity and equity in 141 (88.1%), knowledge integrity in 134 (83.8%) — with human-centeredness a clear step behind at 103 (64.4%). Civic and market principles thin further: competition and market integrity in 96 (60.0%), democracy and rule of law in 92 (57.5%), cultural heritage in 37. Risks repeat the shape, led by ethics and governance, data privacy, legal compliance, and human capacity, with pedagogical quality appearing in only 29 documents. K–12 exemplars state age-sensitive safeguards and risk routines; higher education texts are less specific. The asymmetry is a record of what issuers write about, not an estimate of which harms occur.

The distance from a principle to a named actor

Frequency measures attention; the nexus is built to show where attention stops short of arrangement. Transparency pairs with a disclosure mechanism in 139 documents (86.9%) and privacy pairs with data protection in 114 (71.2%), but accountability pairs with a named oversight body, committee, or role in 100 (62.5%). That pairing is also the one that thins as authority falls: the principle appears in all 24 policies or national strategies, the oversight mechanism in 19 of them (79.2%), against 54 of 92 guidance and toolkit documents (58.7%). Close reading supplies the labels for what remains: indicative alignment where principle, mechanism, and risk are explicitly joined; shallow alignment where the mechanism stays generic; documentary decoupling where a risk carries no mechanism; and accountability voids where responsibility language never names an actor, a process, and a remedy.

What the corpus leaves outside

Three absences structure the discussion. Environmental Sustainability is discussed more often than it is operationalized: mechanism and risk co-occur in 46 documents (28.8%), yet even the most explicit UNESCO and Finnish passages impose no duty on institutions to measure or report energy, carbon, water, or material impacts, and the EU's green-digital agenda runs on a separate track. Cultural heritage and authenticity appears in 37 documents, almost entirely UNESCO and European texts, rarely attached to a national education duty. Pedagogical quality, the least coded risk, is displaced by integrity and detection framings. The authors distinguish four ideal types — regulatory, international normative, capacity-first, and practice-oriented — and find capacity-first logic in Benin, Tanzania, Pakistan, Lebanon, Mauritius, and Seychelles treating educator capacity and readiness as a precondition for adoption.

What this means for practice

• Instructors. State in writing when AI assistance must be disclosed and what counts as acceptable help, then redesign the assessment rather than leaning on detection: UNESCO, EDUCAUSE, and Ofqual all caution that detection cannot settle authorship.
• Administrators. Name the body, committee, or officer that owns GenAI decisions, since a named oversight role appears in only 102 of 160 documents; a defined mandate plus a readiness assessment covering leadership, workforce, policy, and risk controls gives it an institutional home.
• Policymakers. Write the actor, the review process, and the remedy into each principle, and use procurement rules to address lock-in, interoperability, switching costs, and environmental disclosure: market integrity appears in 96 documents, yet education-focused texts rarely make concentration a selection constraint.
• Faculty developers. Make verification, provenance awareness, and critical evaluation explicit learning outcomes, and schedule recurrent rather than one-time professional learning: capacity building is the corpus's most frequent mechanism, and the systems keep changing.
• Researchers. Code at the clause level, recording the stated relationship, responsible actor, degree of obligation, review route, and remedy; document-level counts cannot separate a named duty from an endorsement.

Limitations

• Eligibility required English or an official English translation, so primary instruments from Latin America, francophone Africa, the Arab states, and East Asia are absent; China appears only through third-party analyses, and 22 records from 12 South American countries yielded no included national document.
• The corpus is issuer-concentrated (42 U.S. documents, 23 UNESCO), and 81 of the 160 records are general or cross-sector texts admitted on a substantive education passage, so frequencies describe attention within this assembled English-language corpus, not global consensus.
• No formal quality appraisal was conducted, each document contributes one observation regardless of legal authority, and a policy package plus its guidance component, such as Victoria's, can count twice.
• The 32-document (20%) independent coding was codebook calibration, not a reliability study: 6 documents contained at least one discrepancy, and no chance-corrected coefficient was calculated.
• The study reads governance as written: it does not test whether any framework changes educator behavior, protects learners, or is enforced, and the four diagnostic states are qualitative readings of cited exemplars.

Citation

Elmahjub, E., Arshad, M. H., Iqbal, W., Tabassum, A., Pathari, S., & Qadir, J. (2026). Generative AI Governance in Education: A Scoping Review of Principles, Mechanisms, and Risks in English-Language Documents. EdArXiv preprint.