Assess, document, implement.

The parent document everything else hangs off. One policy, whole school, reviewed at least annually because the ground moves.

1. Purpose and scope. Who and what it covers, including staff use on personal devices. The decision: does this bind everyone, or only lessons?
2. Definitions. AI, generative AI, AI misuse, in words a governor and a Year 9 both understand.
3. Principles. Human accountability for every AI-assisted decision, including the power to question and override it; transparency about use; data minimisation; age-appropriateness.
4. Permitted and prohibited uses. Two tables, staff and students, organised by context.
5. Approved tools and the approval route. Points to the vetting record (document 4); names who can approve a new tool and how long it takes.
6. Assessment integrity. Points to the addendum (document 3) rather than repeating it.
7. Data protection. Points to your GDPR documentation; restates the hard rule about student personal data.
8. Incidents and sanctions. The route from section 1 of the checklist, written down.
9. Review. Date adopted, owner, next review, and where the policy is published for staff, students and parents.

Worth borrowing: the TeachAI toolkit's sample policy language (CC BY-NC-SA) as raw material, rewritten for your jurisdiction and your voice.

The document the readiness check keeps asking for: what AI literacy means at your school, against a framework you can name. A page or two, owned by a named curriculum lead.

1. The framework, named. The EU/OECD AILit Framework (2026) or UNESCO's AI Competency Framework for Students (2024), with a sentence on why this one fits your curriculum. The decision: which standard you answer to when asked.
2. The map. Which domains or competences are taught in which subjects and year groups, even roughly. "Everyone teaches it" usually measures as no one teaching it.
3. The age arrangement. How under-13s learn about AI without AI accounts, and what changes at 13 and beyond.
4. The screen-free share. Where judgement is built with no AI in the room: self-directed projects, checking habits, debate. Both frameworks put judgement and ethics ahead of tool operation, so this is AI literacy curriculum and deserves to be written down as such.
5. Tracking. Who checks whether any of it works, and when. A termly department note clears the bar.
6. Adoption and review. Owner, date adopted, next review, same as the policy.

This one page is the evidence for most of checklist section 2 above. It is the shortest of the seven, and the one a visiting inspector or a curious parent is most likely to ask for.

For centres of the Joint Council for Qualifications (JCQ, the UK exam boards) this is regulated territory: General Regulations 5.3(z) requires your malpractice policy to cover AI and be available for inspection. Non-JCQ schools keep the same logic in their accrediting body's language.

1. What AI use is, and when it is and is not permitted in each assessment type.
2. The acknowledgement rule. Tool name plus date generated; a non-editable copy of the AI exchange retained with the work.
3. What misuse is and that it is treated as malpractice, with the sanctions named.
4. Authentication. How teachers assure themselves work is the student's own, and the two routes: doubts before the declaration are handled inside the centre, doubts after go to the awarding body.
5. Marking. AI may assist marking only where the centre permits it, and never alone: a human assessor reviews everything and owns the mark.
6. Detectors. Your honest position on their unreliability; no sanction on a score alone.
7. Exam-day devices. Who checks that laptops in exams cannot reach AI tools, and when.

Straight from the source: JCQ, AI Use in Assessments, Rev 2, 30 April 2025.

One page per tool, completed before anyone uses it with students, with two screening decisions: whether a data protection impact assessment (DPIA) is needed, and whether a fundamental rights impact assessment (FRIA) is. The register of these pages is your inventory, and your best exhibit if a regulator or parent ever asks.

1. What it does and for whom. State its educational purpose.
2. EU AI Act risk level. Prohibited, high-risk or minimal as deployed: emotion recognition and biometric categorisation are banned in schools, and admissions, evaluating learning outcomes, placement and proctoring tools are high-risk under Annex III point 3, needing the provider's CE mark and conformity evidence before use. Those obligations have applied since 2 August 2026.
3. The not-high-risk reasoning, if you claim it. Article 6(3) lets an Annex III tool out on four grounds: it performs a narrow procedural task, it only improves the result of work a human already did, it detects deviations from prior human decisions without replacing them, or it is purely preparatory. Which one, and why. A claim you cannot write down is a claim you do not have.
4. Data in, data out. What goes in, what the supplier keeps, whether what you put in trains their models.
5. Where processing happens. EU/EEA, adequacy country, or elsewhere, and under what transfer mechanism.
6. Lawful basis. And whose consent, if consent: mind the digital-consent age in your country.
7. Age terms. The supplier's own minimum age against the students who would use it.
8. DPIA screening. Children plus novel technology usually means yes; record the decision either way.
9. FRIA screening. AI Act Article 27, and it falls on you as deployer rather than on the supplier. Where the tool is high-risk: who could be affected, which rights are in play, what could go wrong for a particular child, what human oversight catches it, and who they complain to. Different question from the DPIA, so it does not fold into it.
10. Contract. DPA signed, dated, on file.
11. Sign-off. Who approved it, when, and the review date.

Worth borrowing: the AI-relevant guiding questions in UNICEF's EdTech for Good Framework 2.0 (CC BY 4.0), written for exactly this judgement and tested on 1,400+ tools; and the eight question sets in the Commission's revised ethical guidelines (CC BY 4.0, 2026), which give you the school-side wording for most of the above.

Two parts that live together: what staff may do, and the proof they were taught it. The training file is your evidence for Article 4 of the EU AI Act, the duty to ensure staff operating AI systems have sufficient AI literacy.

1. Staff guidance: which tools for which tasks; the hard line on student personal data; how to get a new tool approved; disclosure norms for AI-assisted materials; the marking rules from document 3.
2. Training plan: role-appropriate content for office, teaching, leadership and learning-support staff, with dates.
3. Attendance records: who, what, when. Unfashionable and decisive.
4. Refresh cycle: annual at minimum, plus on every new tool approval.

EU AI Act Article 4 has applied since 2 February 2025; national market surveillance authorities supervise from August 2026. "Sufficient" is undefined, so the dated file matters.

Written for the kitchen table, translated where your community needs it.

1. The launch letter. What the school does with AI, what it will not do, and who decided.
2. The age lines, with reasons. Why under-13s work unplugged; what 13+ use looks like and under whose eye.
3. Homework. What is fine, what must be acknowledged, what to flag to the school.
4. The question route. A named person, and how opt-outs work where consent applies.
5. The exam-season note (coursework years): how help at home can cross the malpractice line, sent before coursework starts, kindly.

Our parent guide in the library covers the ground a letter cannot; link it rather than rewriting it.

One page per band, in student language, taught rather than merely signed, revisited yearly.

1. Under 13: AI literacy through stories, discussion, paper activities and teacher demonstrations.
2. 13 to 16: named tools only, supervised contexts, the acknowledgement habit from day one.
3. 16 plus: more independence, explicit boundaries per assessment type, and the declaration's meaning spelled out.