Getting AI Governance Done. Our updated support service for schools

One of the recurring themes in my conversations with school leaders around the world is the growing operational burden associated with managing technology, privacy and AI. Schools are increasingly aware of their responsibilities. They understand the importance of assessing applications, reviewing vendors, protecting personal data, managing AI risks and demonstrating accountability. What they often lack is the capacity to coordinate and complete all the work involved.

There is also a problem with the traditional consultancy model, and it is something we have been reflecting on at 9ine. A school engages a specialist organisation to help it manage privacy and AI governance. The consultants review the school's arrangements, identify risks, recommend improvements and produce an action plan. The school receives good advice, supported by the expertise it needs. But what happens next?

The recommendations land with the school's Data Protection Lead, Director of Technology, Deputy Head or another member of the leadership team. That person is now responsible for coordinating colleagues, gathering information, updating records, contacting vendors, implementing controls and reporting progress.

The school has paid for specialist support, but the immediate outcome can be more work for people who were already struggling with capacity.

I think we need to challenge that approach.

Schools will always retain responsibility for their decisions, their risks and the way technology is used. Those responsibilities cannot simply be outsourced. But that does not mean schools should have to undertake all the coordination, assessment and administrative work required to make informed decisions. There is a significant difference between telling a school what it needs to do and helping the school get it done.

This is why we are changing the way we deliver some of our services, placing greater emphasis on defined managed services and completed governance activities rather than relying primarily on consultancy advice.

Consider what happens when a teacher wants to introduce a new AI application.

The educational opportunity may be compelling. The application might reduce workload, support personalised learning or introduce functionality that was previously unavailable to the school. But before it can be approved, several questions need answering. What personal data will the application process? Where will that information go? How does the vendor use AI? Is the application appropriate for the intended age group? What are the digital safety implications? Does it require integration with existing school systems? Who will oversee its use, and what happens if something goes wrong?

These questions do not sit neatly with one person.

They involve the four functions of what we describe as the Diamond Formation: Academic, Digital Safety, Technology and Privacy. Each brings a different perspective, and all four need to contribute to the school's understanding of the opportunity and associated risks.

The problem is that someone must coordinate them.

In many schools, that responsibility falls to the same person who is already managing the application request. They must contact the vendor, obtain the necessary documentation, coordinate internal colleagues, complete or commission assessments, record risks and prepare the recommendation for approval. Even when a school has access to specialist privacy advice, much of this work can remain with its internal team.

As an example, under our new Managed Application Vetting service, we are changing that. Once the school has authorised an application for vetting, 9ine takes responsibility for coordinating the assessment process. We engage with the relevant Diamond Formation roles, review the vendor's privacy, cybersecurity, AI and digital safety arrangements, coordinate the collection of supporting evidence and prepare the necessary governance records.

Where appropriate, we undertake DPIA screening, review the associated Records of Processing and identify the controls that need to be in place before the application can be used. We then bring that work together into a documented assessment, with a recommendation and any conditions that should accompany approval.

The school remains responsible for deciding whether the application should be used and accepting any residual risk. However, the work required to reach that decision has been coordinated and prepared by 9ine.

That is a fundamentally different service outcome.

We are introducing two levels of support. Coordinated Application Vetting provides a managed assessment process, including stakeholder coordination, vendor due diligence and consolidation of findings to support informed leadership decision-making. Managed Application Assurance goes further, providing additional assessment capacity, preparation of supporting privacy documentation and defined follow-up of the actions arising from the decision.

Both are structured around agreed service allowances and clearly defined activities, so schools understand what is included and we can provide a consistent, sustainable service.

Importantly, this is not just about assessing applications. The same problem exists across many areas of privacy and AI governance.

Take Records of Processing. A school may have hundreds of processing activities documented within its privacy programme. Those records need reviewing as systems change, new vendors are introduced and the way personal data is used develops. Traditionally, a consultant might identify which records require updating and ask the school's privacy lead to coordinate the work.

We believe there is greater value in 9ine managing an agreed programme of reviews, contacting the relevant process owners, preparing the updates and presenting the exceptions that require a school decision.

The same principle applies to Data Protection Impact Assessments. Rather than simply advising that a DPIA is necessary, we can coordinate the relevant stakeholders, prepare the assessment, identify mitigating controls and present the outcome for review and approval.

It also applies to vendor reassessments, policy implementation, privacy incident coordination and leadership reporting. In each case, the objective is to move beyond identifying work towards completing a defined part of it.

This approach is supported by the 9ine Platform, which connects Privacy, Vendor Management, Application, Governance and our other products. An application can be linked to its vendor, the relevant processing activities, its assessments, outstanding risks and the actions required before approval.

As we embed AI further into the platform, we can also support our consultants in identifying records requiring attention, examining relationships between applications and vendors, preparing assessments and highlighting risks that need prioritising. Human oversight remains central, but the technology can reduce the administrative effort involved in maintaining governance.

If your school is finding that managing privacy, AI and technology governance is becoming an increasing operational responsibility, we would welcome a conversation about how our managed services and platform can help.

Contact us