AI policy for schools: where to start

The complaint is older than almost any tool you own. In the late thirteenth century a French proverb was already doing the rounds: a bad workman will never find a good tool. Randle Cotgrave put a version into his French and English dictionary in 1611. By 1738 Jonathan Swift had it in Polite Conversation as "an ill workman never had good tools".

Seven hundred years, then, of people explaining that the work would have been fine if the equipment had been better.

I have been thinking about it because of AI, and because of a report published this week. Sir Anthony Seldon, with Tim Bunting, says schools were not prepared for AI's arrival and describes the way it has landed as chaotic. The report makes ten recommendations, including that every school and college develops its own AI strategy, that Ofsted looks at how that is being put into practice, and that England has a national framework by September next year.

Those are recommendations, not rules. Nothing in the report changes what your school has to do tomorrow. But the underlying observation is hard to argue with, and it is not really about strategy documents. It is that AI is already in use in almost every school, and almost nobody has written down what is acceptable.

The Tool Does Not Sign the Letter

Here is the part I would put in front of staff before any policy.

You are responsible for what goes out. The letter to parents. The report to governors. The risk assessment. The reference. The policy itself. If AI helped you write it, that changes nothing about who owns it.

"The AI wrote it" is not a defence. Not to a parent who has received something careless, not to a governor asking where a figure came from, not to an auditor, not to the ICO, and not to an inspector. The name at the bottom is still yours.

Which means the rule is simple, and it is not new. Check what goes out. We have always done this with a colleague's draft. AI does not earn an exemption because it writes confidently.

But Tools Do Matter

The proverb is only half the story, and the other half is worth saying out loud.

Geneticists have a good example. Spreadsheets kept turning gene symbols into dates: type SEPT1 or MARCH1 into Excel and you get a date back. A study in 2016 found the problem in around a fifth of the papers it checked that carried gene lists in spreadsheets. Nobody could make the software stop, so in 2020 the people responsible for naming genes renamed the genes instead. SEPT1 became SEPTIN1. The tool shaped the work, and the humans took ownership of the consequences.

The Post Office makes the opposite point just as sharply. There, the tool was wrong and the people were blamed anyway, and it took years and the courts to unpick it.

So both blame-shifts fail. You cannot hide behind the tool, and you cannot assume the tool is right. That is precisely why the choice of tool, and the habit of checking its output, belong in writing.

Which Is What a Policy Is For

A policy is not a compliance exercise. It tells staff what is allowed, so that thirty people are not each deciding privately. It shows governors the school has thought about this, which they will ask sooner or later. And it gives you something to point at afterwards, because the question afterwards is always the same. What did we say?

Eight things make it useful.

What counts as AI, and who is covered. The obvious tools, and the AI features already inside the software you pay for. Say whether it covers staff, pupils, governors, volunteers and contractors.

Which tools are approved, and who decided. A short list, each with a named person who signed it off. Signing in with a school email account tells you who is using something. It does not mean anyone has checked it.

Personal data. What must never go into a tool that has not been checked for it: pupils' names, safeguarding information, health data. A new tool, or a new use of an existing one, may need a data protection impact assessment. Your DPO can advise.

What staff can use it for. The useful uses, and the limits. A person checks anything that goes out. AI does not make decisions about individual pupils.

Pupils. At what age, in what circumstances, and how supervised. Say whether that includes homework, which happens outside your filtering and monitoring.

Safeguarding and incidents. KCSIE now refers directly to generative AI, including AI-generated images. Safeguarding concerns go to the DSL. A data breach also goes to the DPO. They are separate routes, and one incident can need both. If a breach is reportable, the ICO's 72 hours start when the school becomes aware of it.

Assessment and honesty. If you offer qualifications, reflect the JCQ's guidance. For everyone else, say how staff will treat AI-assisted work.

Ownership and review. Who owns it, how staff are trained, and when it is reviewed. At least yearly, and whenever a significant new tool arrives.

Two things make it stick. Be honest about what you have not decided yet, because a policy that lists its open questions is safer than one that hides them. And write it for your school. A template describes somebody else's pupils, staff and systems, which is the gap the report is complaining about.

If You Would Like a Draft Written for Your School

That is why we built the Digital Confidence AI Policy Builder. Rather than editing a template, you answer about fifteen minutes of questions about your own school: your setting and pupils, the tools staff already use, and the rules you want. Most are tick boxes, "not sure" is always an allowed answer, and you do not need an account.

We then write a draft AI policy for your school. A person checks it before it comes back to you, and it lists the decisions you still need to make. It is a draft for your school to review and adopt. It is not legal advice, and the decisions remain yours.

The first ten schools to send their answers get their draft free. After that it is £95 plus VAT. We send an invoice, the draft follows once it is paid, and purchase order numbers are fine. The price and the terms are on screen before you answer anything.

Start your school's AI policy, no sign-in needed

A Free Session on Wednesday 30 September

At 12:30, for forty-five minutes, I am running a free online session on writing the policy itself. It is for school business leaders and digital leads, it assumes no technical knowledge, and there is time for questions. It is not a workshop on using AI day to day.

Anyone can book here: www.sbforum.co.uk/events

Seven hundred years on, the proverb still holds. The tool is not the one who has to answer for the work.