The Diamond Formation: Why Schools Need a Governance Structure for AI

Embedding AI into schools is not really about the technology. It is not even about the people leading the initiative. More often, success or failure comes down to the structures those people are working within.

When delegated authority is unclear, when decision-making boundaries are not defined, or when the management system restricts progress, AI quickly becomes harder to manage than it needs to be. Schools are trying to balance academic innovation, safeguarding, child protection, privacy, cyber security, procurement, inspection, accreditation and legal accountability. Each of these areas matters, but they do not naturally align unless there is a structure to bring them together.

Academic teams may focus on curriculum, teacher workload and student agency. Technology teams may focus on systems, access controls and cyber risk. Privacy leads may focus on lawful processing, vendor due diligence and DPIAs. Safeguarding teams may focus on online harms, filtering, monitoring and the risks that arise when students use AI tools in ways adults cannot easily see or predict.

Each perspective is valid. The problem is when they operate separately.

That is why schools need what we describe as the Diamond Formation.

What is the Diamond Formation?

The Diamond Formation is a cross-functional governance structure for managing the safe, lawful, ethical and effective use of AI and other emerging technologies in schools.

It brings together four core functions:

Academic — those who understand teaching, learning, curriculum, assessment and pedagogy.

Safeguarding — those responsible for child protection, online safety, digital harms and student wellbeing.

Technology — those who manage infrastructure, systems, access, cyber security and implementation.

Privacy — those responsible for data protection, vendor due diligence, records of processing, DPIAs and lawful use of personal data.

The point is not to create another committee. The point is to create a practical operating model where the right voices are involved early enough to shape decisions, not late enough only to react to the consequences.

AI is not simply a classroom tool. It is not simply a procurement issue. It is not simply a safeguarding concern. It is not simply a data protection problem. It is all of these things at once.

A school cannot govern AI properly if academic opportunity is considered separately from safeguarding risk. It cannot govern AI properly if privacy is reviewed only after a tool has already been adopted. It cannot govern AI properly if technology teams are expected to implement systems without understanding the educational purpose. It cannot govern AI properly if leadership only receives updates when something has gone wrong.

The Diamond Formation gives schools a structure for joining these perspectives together.

Policy sets the boundaries. Strategy sets the direction.

For the Diamond Formation to work, schools need two things in place: an agreed AI policy and an agreed AI strategy.

The AI policy sets the boundaries. It explains what the school can do, what it cannot do, what requires approval, what is prohibited, what must be escalated, and what standards staff and students are expected to follow.

The AI strategy sets the direction. It explains what the school is trying to achieve, where AI may support learning, where it may support operations, where it may reduce workload, and where the school believes AI should not be used because the risks outweigh the benefits.

Both are needed. A strategy without a policy encourages experimentation without sufficient control. A policy without a strategy can restrict innovation without giving staff a positive route forward.

The Diamond Formation sits between the two. It helps the school translate strategy into action, and policy into practical decision-making.

This is where many schools struggle. They may have written a policy, but have no operational mechanism to implement it. Or they may have enthusiastic staff experimenting with AI, but no shared structure to assess tools, manage risk, approve use cases, train staff, support students or report to leadership.

This is where the 9ine platform becomes practical.

The Diamond Formation defines the governance model. The 9ine platform gives schools the operating system to run it.

Operationalising the Diamond Formation

The Diamond Formation only works if it moves beyond discussion.

Schools need a way to turn decisions into actions, actions into evidence, and evidence into leadership oversight. They need to know which tools have been approved, which risks have been identified, which vendors have been assessed, which staff have been trained, which incidents have occurred, which policies apply, and which decisions need to be escalated.

The 9ine platform supports this by bringing the key components of technology governance into one connected environment.

The Governance module gives schools a place to structure the Diamond Formation itself. It enables schools to create projects, assign responsibilities, track risks, manage issues, allocate tasks, monitor progress and report to leadership. AI governance does not sit in meeting notes or disconnected spreadsheets. It becomes a live management process.

The Privacy module supports the data protection side of the Diamond Formation. It helps schools manage records of processing, identify when DPIAs are required, assess privacy risks, document lawful processing, track incidents and evidence the decisions made around the use of personal data in AI-enabled systems.

The Vendor Management module supports supplier assurance. Schools can assess edtech and AI vendors against privacy, cyber security, safeguarding and AI-related risks. This is essential when schools are being asked to trust products that may process student data, generate content, personalise learning or introduce AI functionality through existing platforms.

The Application Library gives staff a clear, school-approved view of the tools they can use. It can show how tools should be used, what restrictions apply, what training is available, and what risks or safeguards staff need to understand. This is where governance becomes visible to teachers, not just leadership.

The Contract module connects technology governance to spend, renewal dates, value, duplication and impact. This matters because AI will increase pressure on budgets. Schools need to know not only whether a tool is safe and compliant, but whether it is necessary, used, effective and worth paying for.

The Academy LMS supports the training layer. Teachers cannot be the human in the loop if they have not been trained to understand AI risk, bias, hallucination, data protection, safeguarding, academic integrity and appropriate use.

Together, these products help schools move from “we need AI governance” to “we can evidence how AI governance is being managed”.

Reporting to leadership in the right way

Strong governance depends on the right information reaching the right people at the right time.

Leadership teams and boards do not need every operational detail. They do not need to review every AI tool, every classroom use case or every minor question raised by staff. But they do need assurance.

They need to know whether AI is being used in line with school policy. They need to know whether approved tools are being reviewed. They need to know whether staff understand what they can and cannot do. They need to know whether personal data is being entered into AI systems. They need to know whether safeguarding risks are being identified. They need to know whether incidents are occurring. They need to know whether the school has sufficient resources, training and controls in place.

The Diamond Formation provides the reporting structure. The 9ine Governance module provides the mechanism to manage and evidence that reporting.

Schools can use it to track progress, risks, incidents, actions, approvals, rejected tools, training gaps, policy exceptions, emerging developments and areas requiring leadership direction. This gives the highest levels of management meaningful oversight, rather than either too much operational detail or no useful visibility at all.

Academic first. Safety always.

The deployment of AI in schools should be academic and safety first.

Academic first means the school should be intentional about where AI can genuinely improve teaching, learning, curriculum design, assessment, feedback, inclusion, administration or staff workload. It should not be adopted because it is fashionable. It should be adopted because it serves a clear educational purpose.

Safety always means that academic benefit cannot be separated from the duty to protect children, staff and the wider school community.

The best AI governance does not stop innovation. It makes innovation safer, more deliberate and more sustainable. It gives staff confidence to explore because they understand the boundaries. It gives leaders confidence because they can see the controls. It gives parents confidence because the school can explain its approach. It gives governors and boards confidence because there is evidence of oversight and accountability.

This is why the Application Library and Academy LMS are so important. The Application Library gives staff clarity on approved tools and how they should be used. The Academy LMS builds the knowledge and confidence needed to use those tools responsibly.

Together, they support staff agency, which in turn supports student agency.

AI gives people access to intelligence. But agency is what enables them to act intentionally, make informed choices and exercise meaningful control over learning, teaching and decision-making.

Accountability creates evidence

Strong governance evidences accountability.

Schools increasingly need to show that they have thought carefully about AI, not simply reacted to it. They need to demonstrate that decisions have been made intentionally, risks have been assessed, responsibilities have been allocated, tools have been reviewed, incidents can be escalated, and leadership has oversight.

If something goes wrong, the school should be able to evidence what it knew, what it considered, what decisions were made, what controls were in place, who was responsible, and how the matter was escalated.

The Diamond Formation creates the operating model for that evidence to exist.

The 9ine platform helps schools capture it.

Governance records the work. Privacy records the data protection decisions. Vendor Management records supplier assurance. Application Library records approved use. Academy LMS records training. Contract records cost, renewal and value.

This creates a more complete evidence base for leadership, governors, inspectors, accreditors and, where necessary, regulators.

Better pedagogy, better procurement, better use of budgets

AI will increase pressure on school budgets. Vendors will continue to integrate AI features into existing products. New products will enter the market. Staff will request tools. Students will use tools independently. Existing platforms will add AI functionality through updates, sometimes with little obvious change to the way the product is marketed or procured.

Without governance, this becomes fragmented and expensive.

With governance, the school can ask better questions before money is spent. Does the tool support the school’s AI strategy? Does it solve a real educational or operational problem? Is it safe for the age of students using it? Does it process personal data? Has the vendor provided sufficient assurance? Does it duplicate something the school already pays for? Can staff use it effectively? What training is required? How will impact be reviewed?

This supports better pedagogy because tools are selected for educational purpose, not novelty. It supports better safety because risks are assessed before use. It supports better budgeting because the school is less likely to buy overlapping, unsuitable or poorly governed technology.

Conclusion: the foundation for using AI well

The Diamond Formation is critical to the successful use of emerging technologies like AI.

It gives schools a practical way to bring together academic ambition, safeguarding responsibility, technical implementation and privacy oversight. It connects policy to practice. It connects strategy to delivery. It connects operational work to leadership accountability.

But the Diamond Formation should not live only as a diagram, a policy statement or a leadership discussion. It needs to be operationalised.

That is where the 9ine platform supports schools. It gives the Diamond Formation a practical management layer: one place to govern projects, assess vendors, manage privacy risk, approve applications, train staff, evidence decisions and connect technology use to cost, safety, compliance and impact.

AI will continue to evolve. The risks will change. The tools will change. The opportunities will change. Schools therefore need a governance structure that is capable of learning, adapting and improving.

The Diamond Formation provides that structure.

The 9ine platform helps schools put it into practice.

Sign up to a guest pass for the 9ine Platform to see for yourself how to operationalise your Diamond Formation.