Assess, document, implement.

The parent document everything else hangs off. One policy, whole school, reviewed at least annually because the ground moves.

1. Purpose and scope. Who and what it covers, including staff use on personal devices. The decision: does this bind everyone, or only lessons?
2. Definitions. AI, generative AI, AI misuse, in words a governor and a Year 9 both understand.
3. Principles. Human accountability for every AI-assisted decision, including the power to question and override it; transparency about use; data minimisation; age-appropriateness.
4. Permitted and prohibited uses. Two tables, staff and students, by context. This is the section people actually read.
5. Approved tools and the approval route. Points to the vetting record (document 4); names who can approve a new tool and how long it takes.
6. Assessment integrity. Points to the addendum (document 3) rather than repeating it.
7. Data protection. Points to your GDPR documentation; restates the hard rule about student personal data.
8. Incidents and sanctions. The route from section 1 of the checklist, written down.
9. Review. Date adopted, owner, next review, and where the policy is published for staff, students and parents.

Worth borrowing: the TeachAI toolkit's sample policy language (CC BY-NC-SA) as raw material, rewritten for your jurisdiction and your voice.

The document the readiness check keeps asking for: what AI literacy means at your school, against a framework you can name. A page or two, owned by a named curriculum lead.

1. The framework, named. The EU/OECD AILit Framework (2026) or UNESCO's AI Competency Framework for Students (2024), with a sentence on why this one fits your curriculum. The decision: which standard you answer to when asked.
2. The map. Which domains or competences are taught in which subjects and year groups, even roughly. "Everyone teaches it" usually measures as no one teaching it.
3. The age arrangement. How under-13s learn about AI without AI accounts, and what changes at 13 and beyond.
4. The screen-free share. Where judgement is built with no AI in the room: self-directed projects, verification habits, debate. Both frameworks put judgement and ethics ahead of tool operation, so this is AI literacy curriculum and deserves to be written down as such.
5. Tracking. Who checks whether any of it lands, and when. A termly department note clears the bar.
6. Adoption and review. Owner, date adopted, next review, same as the policy.

This one page is the evidence for most of checklist section 2 above. It is the shortest of the seven, and the one a visiting inspector or a curious parent is most likely to ask for.

For centres of the Joint Council for Qualifications (JCQ, the UK exam boards) this is regulated territory: General Regulations 5.3(z) requires your malpractice policy to cover AI and be available for inspection. Non-JCQ schools keep the same logic in their accrediting body's language.

1. What AI use is, and when it is and is not permitted in each assessment type.
2. The acknowledgement rule. Tool name plus date generated; a non-editable copy of the AI exchange retained with the work.
3. What misuse is and that it is treated as malpractice, with the sanctions named.
4. Authentication. How teachers assure themselves work is the student's own, and the two routes: doubts before the declaration are handled inside the centre, doubts after go to the awarding body.
5. Marking. AI may assist marking only where the centre permits it, and never alone: a human assessor reviews everything and owns the mark.
6. Detectors. Your honest position on their unreliability; no sanction on a score alone.
7. Exam-day devices. Who checks that laptops in exams cannot reach AI tools, and when.

Source of truth: JCQ, AI Use in Assessments, Rev 2, 30 April 2025.

One page per tool, completed before anyone uses it with students, with a screening decision on whether a data protection impact assessment (DPIA) is needed. The register of these pages is your inventory, and your best exhibit if a regulator or parent ever asks.

1. What it does and for whom. The educational purpose, in one sentence.
2. EU AI Act risk level. Prohibited, high-risk or minimal as deployed: emotion recognition and biometric categorisation are banned in schools, and admissions, grading and proctoring tools are high-risk, needing the provider's CE mark and conformity evidence before use.
3. Data in, data out. What goes in, what the vendor keeps, whether inputs train their models.
4. Where processing happens. EU/EEA, adequacy country, or elsewhere, and under what transfer mechanism.
5. Lawful basis. And whose consent, if consent: mind the digital-consent age in your country.
6. Age terms. The vendor's own minimum age against the students who would use it.
7. DPIA screening. Children plus novel technology usually means yes; record the decision either way.
8. Contract. DPA signed, dated, on file.
9. Sign-off. Who approved it, when, and the review date.

Worth borrowing: the AI-relevant guiding questions in UNICEF's EdTech for Good Framework 2.0 (CC BY 4.0), written for exactly this judgement and tested on 1,400+ tools.

Two parts that live together: what staff may do, and the proof they were taught it. The training file is your evidence for Article 4 of the EU AI Act, the duty to ensure staff operating AI systems have sufficient AI literacy.

1. Staff guidance: which tools for which tasks; the hard line on student personal data; how to get a new tool approved; disclosure norms for AI-assisted materials; the marking rules from document 3.
2. Training plan: role-appropriate content for office, teaching, leadership and learning-support staff, with dates.
3. Attendance records: who, what, when. Unfashionable and decisive.
4. Refresh cycle: annual at minimum, plus on every new tool approval.

EU AI Act Article 4 has applied since 2 February 2025; national market surveillance authorities supervise from August 2026. "Sufficient" is undefined, which is precisely why the dated file matters.

Written for the kitchen table, translated where your community needs it.

1. The launch letter. What the school does with AI, what it will not do, and who decided.
2. The age lines, with reasons. Why under-13s work unplugged; what 13+ use looks like and under whose eye.
3. Homework. What is fine, what must be acknowledged, what to flag to the school.
4. The question route. A named person, and how opt-outs work where consent applies.
5. The exam-season note (coursework years): how help at home can cross the malpractice line, sent before coursework starts, kindly.

Our parent guide in the resource library covers the ground a letter cannot; link it rather than rewriting it.

One page per band, in student language, taught rather than merely signed, revisited yearly.

1. Under 13: we learn about AI without AI accounts, and here is what we do instead. Say it proudly; it is a feature.
2. 13 to 16: named tools only, supervised contexts, the acknowledgement habit from day one.
3. 16 plus: more independence, explicit boundaries per assessment type, and the declaration's meaning spelled out.