The AI governance framework your board can endorse this term
AI Governance Framework for School Boards, free for independent schools.
Chairs tell us the board has asked for "an AI policy" and nobody is quite sure what it should contain. Principals tell us the staff are already using tools nobody approved. Business managers tell us a parent has asked where the student data goes. All three are the same question: who decides, what is logged, and which of the duties the school already carries does AI now touch.
The AI governance framework answers it as a framework rather than a document in a drawer. It names the existing duties AI touches in child safety, privacy, records, WHS and staff conduct, sets out a decision-rights matrix, a logging standard and a board reporting line, and gives directors the eight questions to ask. The six parts are set out below; the AI Maturity Assessment tells a board which of them to start with, and the AI Risk Register puts the first twelve risks on the register the same week.
What the framework covers
An AI policy is a lens over duties a school already holds. PolicyAI has tagged the obligations a school already carries that AI activity now touches, and almost none of them say "AI". They say a human decides, data stays in a known system, a record is kept, a hazard is assessed by someone in the room. The framework in this pack is how a board makes that true when AI is in the loop.
The AI governance framework
The framework itself: purpose and scope, the five duties AI touches and what changes for each, the governance bodies and roles, the decision-rights matrix, the logging standard, the board reporting line, review and amendment. Each section is written as adoptable text with square-bracket fields for the school's own names, bodies and dates.
The decision-rights matrix
Fourteen AI decisions a school makes, from approving a tool to accepting a residual risk, each with who proposes, who decides, who must be consulted, who is informed, and what is logged. Roles are pre-filled for a typical independent school and are meant to be edited.
The logging standard
What a school records when AI is used in a decision, a communication or a student-facing process: the tool, the purpose, the data it saw, the human reviewer, the approval and where the record lives. Written so it can be met with a form, a register or an EthosOne assurance log.
The board reporting line
What the board sees about AI and how often: a standing item, a quarterly one-page report with the AI risks above appetite, incidents, tools approved and retired, and policy amendments in train.
Run at any scale. From one campus to a diocese, with every entity reporting the same way.
- Switch
- from your existing platform, for a low cost
- 25
- policy domains help you make sense of the policies you have, and the ones you need
- Every regulator
- in Australia and New Zealand supported
- Safe
- data, processing and AI based in Sydney and Melbourne via AWS
Coverage spans the eight Australian states and territories, with Commonwealth law applying across all of them, and separately New Zealand. Domain figures come from the PolicyAI Research Atlas, refreshed weekly.
Eight questions a board should ask
The eight questions directors ask the executive about AI, with the evidence that answers each.
- Stored in AustraliaAWS Sydney and Melbourne, one database per school
- AI stays in the country tooAmazon Bedrock; never trained on your content
- Published, not describedTrust Centre · ISMS policy · How we handle your data
PolicyAI answering the prompt “Draft me an AI Acceptable Use Policy.”, then working through: Reading the AI-engaged obligations; Matching privacy, records, child safety; Drafting against your existing library.
Solutions for every school’s AI challenge.
There is no AI-specific legislation in force in Australia or New Zealand. The duties your school already carries are the ones AI engages.
Governing AI, before your board asks again.
“The board asked what our position on AI is, and we did not have one.”
An AI policy is not a new rulebook, it is a lens over duties your school already carries: privacy, records, discrimination and child safety, engaged by an AI-shaped set of facts. Which is why a downloaded template does not survive contact with a regulator.
We have tagged the duties AI activity in a school engages, so the conversation starts from the obligations you already hold rather than from a blank page. Almost none of them say “AI”.
Try Draft with AI.Five paragraphs against the obligations of your State, with the provision beside each. Free, no login.
How schools use it
Principals tell us they take the framework to the executive first, fill the roles and bodies, and delete anything the school does not do. Chairs tell us the deck runs as an item at the next board meeting, ending in the motion on the last slide, and that the eight questions become the standing AI item afterwards. Business managers tell us the logging standard is the part that makes the rest real, because it is the first time anyone has written down what "AI was used" should leave behind.
In EthosOne the framework becomes live records: the policy amendments run through the controlled policy lifecycle with owner, reviewer, approver and immutable versions; PolicyAI shows where each policy meets the relevant Act; the logging standard becomes an assurance log with typed fields and entry history; the endorsement becomes a resolution with exact text, mover, seconder and outcome. The embedded helper drafts the policy amendments and the resolution wording from your context, and the approval, the vote and the acknowledgement stay with people. EthosOne's own AI is Frontier AI, hosted via Amazon Bedrock in AWS Sydney; the model is stateless and no school data trains any model.
The two we are asked every time.
Still weighing something up? Thirty minutes with us, on your own registers, answers the rest.
Take the AI maturity assessment01How is this different from the cyber and AI position?
The cyber and AI position holds the AI principles, the self-check and the cyber control checklist: what the school believes and what it relies on. This pack holds the governance: who decides, what is logged, what the board sees and which existing duties change. Most schools use both; the principles sit inside section two of this framework.
02Do we still need a standalone AI policy?
A school needs to govern AI, and most will express part of that in policy. The useful version is a short governing statement plus amendments to the child safety, privacy, records, WHS and staff conduct policies AI now touches. The framework tells you which amendments, and the decision-rights matrix and logging standard do the work a standalone policy usually leaves undone.
The AI governance framework starts with a readon where the board's oversight sits today.
The AI governance framework for school boards: decision rights, a logging standard, a reporting line and the eight questions a board should ask, with the AI maturity assessment as the next step.