An AI policy is not enough: why schools need a structure to govern AI

AI is already part of everyday school life. Teachers use it to plan lessons and draft reports, pupils come across it in the apps they use for homework, and suppliers are adding AI features to tools schools bought years ago. For most schools, the question is no longer whether AI needs governing. It is where to start, who needs to be involved, and how to turn good intentions into something that works in practice.

Many schools have responded by writing an AI policy. That is a sensible first step, but on its own it rarely changes much. Below are the five gaps we see most often when schools try to govern AI, and what can be done about each.

AI use is running ahead of school oversight

In most schools, AI arrived informally. A teacher signs up for a free tool to save time on marking. A department starts using a chatbot for revision resources. An existing platform switches on a new AI feature in a routine update, and nobody is told.

None of this is unusual, and much of it is well intentioned. The problem is visibility. If a school cannot say which AI tools are in use, by whom, for what purpose and with what data, it cannot make informed decisions about any of them. Schools cannot govern what they cannot see.

Responsibility for AI is split across the school

AI touches teaching and learning, safeguarding, technology, data protection and leadership accountability all at once. Responsibility for those areas rarely sits with one person.

Academic leads tend to focus on educational value and innovation. Safeguarding leads think about online safety and digital harms. IT teams consider systems, access and security. Whoever leads on privacy is looking at personal data, impact assessments and vendor assurance. Each perspective matters. The problem starts when they operate separately, because every decision is then made with only part of the picture.

Often, "AI" is simply handed to one individual as an addition to an existing role. That person is then expected to understand and act on every one of those perspectives alone.

A policy on paper does not govern anything on its own

A written AI policy sets out intent. What it cannot do by itself is answer the operational questions staff face every week. How do I ask to use a new tool? Who decides? What happens if a tool I already use adds an AI feature? Where is the decision recorded?

Without the processes that sit behind it, a policy tends to live in a shared drive while practice carries on around it. Schools do not just need an AI policy. They need a governance structure capable of putting it into operation.

Approval decisions lack consistent criteria

When a member of staff asks to use a new AI tool, the decision should weigh educational value alongside safeguarding, privacy, cyber security and what the supplier can actually evidence about how it handles data. In many schools, that assessment happens informally, if at all.

The result is inconsistency. One request is approved after a quick conversation, another is refused for reasons nobody wrote down, and a third is never formally considered. When a parent, governor or inspector later asks how a decision was made, there is little to show.

AI understanding is uneven across the school community

Staff, pupils, parents and governors all need to understand how AI is used in school, but they need different things. Teachers need practical guidance on acceptable use. Pupils need age-appropriate AI literacy. Parents increasingly want to know which tools their children are using and why. Governors need enough understanding to provide meaningful oversight.

Where this is left to chance, expectations drift and confidence in the school's approach weakens.

What schools should be doing now

There is no single correct AI governance model, and every school starts from a different position. These steps, however, apply almost everywhere:

• Bring the right people together. Form a small cross-functional group covering academic, technology, safeguarding and privacy perspectives, with clear leadership accountability.
• Establish your starting point. Before writing anything new, take stock of the policies, processes and decisions that already exist.
• Find out what AI is being used. Start an AI use-case register covering current and proposed tools, who owns them and what they are used for.
• Set strategic principles before rules. Agree how AI supports your educational aims and where the boundaries sit, then build policy from there.
• Define acceptable use in practical terms. Set expectations for staff and pupils, recognising that what is appropriate may differ by age and context.
• Agree a proportionate approval process. Decide how requests are made, what criteria apply, who decides, and how decisions and conditions are recorded.
• Plan for literacy and communication. Identify what each group in your community needs to know, and who is responsible for keeping that current.
• Build in review. AI changes quickly. Set review dates and a forward plan so governance keeps pace.

How the AI Governance Academy helps

We created the 9ine AI Governance Academy for schools that know AI needs governing but want a structured way to do it.

The Academy is a guided implementation programme that runs across the academic year. Rather than a set of standalone training sessions, it takes schools through a connected journey: from establishing an AI governance baseline, through risk and opportunity, strategy and policy, acceptable use, recording AI use, and assessment and approval, to AI literacy and longer-term planning. Each stage builds on the last.

It is built around 9ine's Diamond Formation, our model for bringing academic, technology, safeguarding and privacy perspectives together under leadership accountability. Schools take part as a governance team rather than sending one person to be trained, so decisions are shaped by the people who will need to own them.

Between live sessions, schools apply what they have covered within their own environment. That work is supported by the 9ine platform, including the AI Readiness Toolkit, alongside practical templates, access to completed vendor assessments from the 9ine Vendor Library, and time with a named 9ine Data Privacy & AI Consultant. By the end of the programme, schools will have worked towards the structures, processes and documentation their approach needs, along with a 12-month AI governance roadmap to keep it moving.

Find out more about the 9ine AI Governance Academy.

For further guides, templates and insights, explore our resources library. If you would like to discuss your school's approach with our team, book a meeting.