Register before policy
Writing an AI policy before knowing what staff already use produces a document nobody follows. Build the register first.
What the register should record
Keep it short enough that it stays current.
- The tool and what it is used for
- Who approved it, and when
- Which schools use it
- What data it touches
- What controls or restrictions apply
- The named responsible owner
- The next review date
Controls that matter more than wording
Human review before anything consequential, no access beyond a user's own permissions, clear labelling of AI-generated drafts, and an easy route to switch a tool off.
Caveat
A register supports governance. It does not assess the legal or data-protection position of any third-party AI tool, and it does not replace advice from your data protection officer.
General guidance only. It does not constitute legal, regulatory, safeguarding or data protection advice, and it does not describe any real trust or school.