Before signing a contract or subscription for any AI product — an AI-powered MIS add-on, a lesson-planning assistant, a marking tool — run through a short checklist. It will save you from awkward conversations with your DPO later.

Questions to ask the vendor

  • Where is pupil data processed and stored, and for how long?
  • Is data used to train the underlying AI model, and can this be turned off?
  • Does the vendor have a Data Processing Agreement (DPA) available?
  • What happens to data if you cancel the contract?
  • Is the tool age-appropriate and compliant with relevant safeguarding standards if pupils will use it directly?

Internal checks

  • Has a Data Protection Impact Assessment (DPIA) been completed for higher-risk tools?
  • Has your DSL reviewed anything pupil-facing?
  • Is there a named internal owner for the tool once it's live?

The "no new software" alternative

Before procuring a new standalone AI platform, it's worth asking whether the same outcome is achievable within the systems your school already controls — Microsoft 365 or Google Workspace both now include AI features that avoid introducing a new third-party login, a new data processor, and a new item on your procurement checklist altogether.

A five-minute conversation with a vendor's sales team rarely answers the questions above properly — ask for it in writing.

Worth knowing: AskColin deliberately works within Microsoft 365 or Google Workspace — nothing new to procure, no additional third-party data processor, no new login for staff to manage. See the safe-use approach →

Key takeaways

  • Get vendor answers on data location, model training use, and DPAs in writing.
  • Complete a DPIA for higher-risk, pupil-facing tools.
  • Consider whether your existing Microsoft or Google setup already covers the need.