Every week brings a new AI tool promising to save teachers hours. Some are excellent; some should never be near pupil data. Here is a simple 10-point checklist UK schools can use to decide, with the questions to put to any supplier.
The 10-point checklist
1. What is it for, and who will use it?
Start with the job, not the tool. A teacher-only planning tool with no pupil data is low risk. A pupil-facing chatbot is a very different decision. Write down who uses it and what for before you look at anything else.
2. Does it need personal data?
If the tool works without pupil or staff names, keep it that way. If it needs personal data, you will need a data protection impact assessment and a data processing agreement with the supplier.
3. Where is data stored and processed?
Ask for the location in writing. Processing outside the UK is not automatically a problem, but it needs appropriate safeguards and should be in your DPIA.
4. Is your data used to train the AI?
The DfE's guidance is clear that pupils' work should not train AI models without consent. School-licensed accounts for Copilot and Gemini come with that commitment; many free consumer tools do not. See DfE guidance on personal data and AI.
5. What are the age limits?
Most general AI tools require users to be 13 or older, some 18. For primary pupils, that rules out direct use of almost all of them. Check the terms before anyone switches a tool on for a class.
6. Does it meet the DfE's product safety expectations?
For any pupil-facing tool, ask the supplier how it meets each area of the DfE's generative AI product safety expectations — filtering, monitoring, security, privacy and responsible design — and get the answer in writing.
Not sure whether a tool is safe for your school?
Tell me what you're trying to sort out — a tool, a policy, a parent question, a workload problem — and I'll give you a straight answer.
7. Can you control it?
Can accounts be managed centrally? Can AI features be switched off for pupils? Can the school see usage? Tools that cannot be controlled are hard to govern. See how school IT admins control AI tools.
8. Does it fit your filtering and monitoring?
Your DSL should confirm the tool sits within the school's filtering and monitoring arrangements, especially for pupils. See KCSIE filtering and monitoring for AI.
9. Is the output good enough?
Safety is necessary but not sufficient. Trial it on real tasks with three or four staff for a fortnight and measure time saved and editing needed.
10. What happens when you stop?
Can you export your data and delete your account? A tool that traps your data is a long-term risk.
Questions to send any supplier
- Where is our data stored and processed?
- Is any of our data, including pupils' work, used to train your models?
- Will you sign a data processing agreement under UK GDPR?
- What are your minimum age requirements?
- How does the tool filter harmful content and flag safeguarding concerns?
- Can the school manage accounts, switch features off and see usage?
- How do we export and delete our data if we leave?
Make it routine
The simplest way to keep this manageable is a short approval process: a staff member requests a tool, IT and the DPO check it against this list, the DSL checks pupil-facing tools, and approved tools go on the list in your AI policy. A small AI steering group can own the process. For a broader starting point, see five questions to ask before adopting any AI tool.
Where AskColin comes in
You could work through this checklist yourself, tool by tool. Or I can do it with you: a 30-minute audit of what your staff actually use, a written verdict on each tool, and the policy and staff agreement that make it stick — all in the fixed-price KCSIE AI package at £495. For ongoing help as new tools appear, support starts at £175 a month — less than one supply day.
Frequently asked questions
How do schools know if an AI tool is safe?
Check what data it needs, where data is processed, whether data trains the model, age limits, DfE product safety expectations, school controls, filtering and monitoring, output quality and exit arrangements.
Do schools need a DPIA for every AI tool?
A DPIA is needed where a tool processes personal data in a way that could be high risk. Planning tools used without pupil data usually do not need one; tools using pupil data usually do.
Can primary pupils use AI tools?
Most general AI tools have minimum ages of 13 or 18, so primary pupils should not use them directly. Teacher-led use and child-safe tools are the alternatives.
What should we ask AI suppliers?
Data location, model training, data processing agreement, age limits, content filtering and safeguarding alerts, school controls, and data export and deletion.
Who should approve AI tools in a school?
A simple process involving IT, the data protection officer and the DSL, with approved tools recorded in the school AI policy.