University of Toronto’s Copilot Teaching Model: AI Rules, Student Privacy and Enterprise Shield

In the piece, published by U of T News and written by Adina Bresge, four professors in linguistics, computer science, architecture and Spanish explain how they are handling AI this term. They share one idea: AI output can be fluent and confident and still be wrong, so the skill students need most is judgment.

The ground rules come first​

The university sets the baseline early. U of T students are expected to complete assignments without outside help unless an instructor says otherwise. Everything below is a course-specific exception to that rule, not a campus-wide permission.

U of T's student guidance says the same thing more bluntly. Students are responsible for checking the Code of Behaviour on Academic Matters, program guidelines and each syllabus. Presenting AI-generated ideas or work as your own can count as academic misconduct.

Section summary: AI use at U of T depends on the course, the instructor and the task. It is not a general entitlement.

Linguistics: students write the AI policy​

Safieh Moghaddam is an associate professor, teaching stream, in linguistics at U of T Scarborough. She starts with a demonstration: she shows students an AI answer that reads like textbook material, then reveals that it is completely wrong. In her account, students assume that polished means correct, and she wants to break that habit. She also built "Teaching in the Age of AI," a toolkit for instructors.

She says she has "moved away from policing and detecting." Instead, her upper-year classes write their own AI policy on day one and are held to it all term. Last winter the class allowed AI for brainstorming, structuring and editing, as long as the underlying ideas stayed the students' own. She also sometimes collects outlines, early drafts and reflections so that she grades some of the thinking, not only the final product.

A separate case study from U of T's Centre for Teaching Support & Innovation (CTSI) gives more detail about her Winter 2026 course, LINC10 (Argumentation and Analysis):

1. Warm-up. Students discussed "Would this count as plagiarism?" across four scenarios, from AI grammar fixes to AI-written paragraphs.
2. Small groups. Groups of two or three filled in a handout with four sections: Allowed Uses, Not Allowed, Gray Areas and Justification.
3. Class consensus. Revising outlines and essays and brainstorming were allowed. Having AI generate ideas, arguments or claims was not. Summarizing and translation were fine for personal understanding but not for graded work.
4. Disclosure. The class agreed to add an AI Acknowledgment section to final projects.

According to CTSI, the debrief brought out student anxiety about AI detectors. Moghaddam said she doesn't rely on them, pointing to their limitations and to the time her own writing was flagged as AI-generated. Students reportedly said that helping set the rules reduced their fear. That is feedback from one class, not a controlled study.

Section summary: When students set the rules and have to justify them, the question stops being "is AI allowed?" and becomes "what counts as my work?"

Computer science: a tutor that won't hand over the answer​

Tovi Grossman, a professor of computer science in the Faculty of Arts & Science, built LearnAid. It answers students' course questions by breaking them into steps instead of giving the solution. It draws on the course's lecture notes and materials rather than the open internet. Grossman compares it to the way a TA or professor guides a student during office hours.

U of T News says the design comes from Grossman's research. Students who copied and pasted AI answers did measurably worse on final tests, while students who used AI to work through problems scored higher than peers who didn't use AI. The article gives no sample size, effect size or citation for that comparison, so treat it as a reported finding, not a settled general result. The article also says that in one pilot, women were a minority of the class but used the tool at roughly twice the rate of men. No counts or explanation were given.

Grossman's earlier published work shows where this design approach comes from. A CHI 2024 paper he co-authored describes CodeAid, a different system. It was deployed to 700 programming students over a 12-week semester, and the researchers analysed 8,000 uses alongside weekly surveys, 22 student interviews and interviews with eight educators. CodeAid explained concepts, produced pseudocode with line-by-line explanations and annotated broken code without revealing the solution. The paper's design recommendations include:

• asking questions should stay easy, but the student still has to think
• avoid direct answers
• students should be able to see and steer what the AI is doing

CodeAid is not LearnAid, and its results shouldn't be read as evidence about LearnAid. It does show that Grossman's group has been working on this "guide, don't give" approach for years.

Section summary: Limiting a tutor to course materials and making it withhold final answers is a design choice with some research behind it.

Architecture: plenty of images, not enough judgment​

Wei-Han Vivian Lee directs the master of architecture program at the John H. Daniels Faculty of Architecture, Landscape, and Design. She notes that AI can produce more images in minutes than architects can draw in a week, and that more options don't mean better ideas. Her concern is a flood of imagery without the judgment to sort it.

Her rules change as students progress:

Her reasoning is that "all drawings are loaded." It takes training to see what an image emphasizes, what it leaves out and whose interests it serves. She worries about glossy renderings that show a sunlit building but not what the building is for. These are her own course rules, not faculty policy.

Section summary: Students have to learn to critique images before they are allowed to generate them.

Spanish: Copilot as a conversation partner​

Pablo Robles-García, assistant professor of Spanish at U of T Mississauga, is the instructor using a Microsoft product. His students use Microsoft Copilot for conversation practice. It adapts to their level and waits while they search for words, which matters in classes where skill levels vary too much to pair students easily. His one complaint, made as a joke, is that the AI "doesn't know when to stop."

For writing, students send sentences to Copilot with tailored prompts. Copilot labels the type of problem (grammatical, structural or practical) instead of rewriting the sentence. Students revise and resubmit until they reach a final version, and the whole exchange goes into a portfolio he reviews during the term.

He also names a limitation. Because most models are trained mainly on English, he observes that they are more likely to hallucinate in Spanish, sometimes insisting a correct sentence needs fixing. That is his classroom observation, not a measured error rate, but anyone deploying Copilot for non-English work should keep it in mind.

Section summary: The workflow is simple: Copilot identifies the problem, the student fixes it, and the instructor reviews the record.

What Windows and Microsoft 365 admins should notice​

This part of the story reaches beyond the classroom. U of T's student guidance says students who sign in to Microsoft Copilot with their UTORid get "a private enterprise license" and their prompts aren't used to train the model. When you log in with your UTORid, you access a private enterprise license, so your prompts are not used to train the AI model, helping to protect privacy and intellectual property.

U of T's own IT documentation adds useful detail:

• Check for the shield. CTSI's tool guide tells users to look for the enterprise shield symbol/icon near the top right, which confirms they're in the protected university environment. The EASI guide says the same: make sure you see the green shield icon in the top-right corner. This confirms you're in enterprise-protected mode and not using the public version.
• Data classification limits. CTSI says the enterprise-protected edition has been evaluated by the University's Information Security team, and it has been deemed safe to use for up to Level 3 (Three) data, and is not approved for level 4 University data.
• Retention. Per CTSI, chat interactions fall under the same data retention policy as MS Teams chat history, which is currently 30 days.
• Access has expanded. When U of T's IT Services launched the tool for staff and faculty, it stated that students do not currently have access to the enterprise edition of the service. The current student-life guidance, quoted above, now points students to UTORid sign-in. Robles-García's class practice depends on that change.

Microsoft's own documentation matches the university's description. Microsoft Support says Copilot Chat uses your work or school account for authentication and automatically provides enterprise data protection when you're signed in with that account. Your prompts, including any work content you add to the prompt, and Copilot's responses aren't used to train foundation models. It also notes that prompts, Bing search queries triggered by your prompts, and responses in Copilot Chat are logged. "Not used for training" does not mean "not recorded."

Branding keeps shifting, so write your help-desk scripts carefully. Microsoft Learn now states that Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat. Some experiences, licenses, and capabilities might continue to reference Microsoft 365 Copilot and Microsoft 365 Copilot Chat during the transition period.

The practical point for anyone managing a school tenant: if you want instructors to build assignments around Copilot, students need to know how to confirm they're in the protected, signed-in version. A student using a personal account doesn't get the same data protection, even if the class activity is identical.

Section summary: The classroom plan relies on students signing in with their school account and checking for the shield. Admins should make that easy and tell students clearly.

A reasonable counterpoint​

This is a university publicizing its own faculty, so it presents the approach at its best. The evidence behind it is uneven. The LearnAid performance claim has no published numbers in the article. The Moghaddam feedback comes from one class. The Spanish hallucination concern is anecdotal. None of that makes the teaching methods wrong, but they are promising practices, not proven results.

There is also a structural tension. Process-based assessment (drafts, portfolios, reflections) takes more of instructors' time, while detectors look cheap. They are also unreliable enough that Moghaddam, by her own account, has been flagged by one.

The bottom line​

Across four departments, the approach looks similar:

• set explicit, course-specific rules
• design or prompt tools so they scaffold instead of answering
• grade the process, not just the result
• make students check every output

As Robles-García puts it, "AI can help you, but the learning has to come from you." For the IT teams running the tenant, the job is to make sure the protected version of Copilot is the one students actually open.