From tools nobody approved to a policy the board has endorsed.
A six-to-eight-week programme with a ladder of its own, delivered in the staff room and the boardroom. It starts with a day and ends with AI risk on the register with a name beside it.
AI governance for schools is EthosOne's programme for putting AI inside a school's existing governance rather than
Beside it. PolicyAI has tagged more than 200 obligations a school already carries that AI activity now touches. EthosOne is not a governance framework.
What we keep hearing
A teacher mentions in the staff room that she drafts her reports with an AI tool, and the letters home too. Nobody approved it; the school found out when a parent asked. The same week a vendor demo includes an AI feature, and nobody in the room can say which policy governs it. The chair's email asks for an AI policy, a template is tabled, and the conversation ends there.
None of those schools lacked care; what they lacked was a place in their governance for the question to live.
AI governance has its own five stages. Most schools arrive on the first. The programme leaves them on the fourth, with the fifth as the termly rhythm that keeps them there.
Unapproved
Staff are using tools nobody approved. The board has asked for a policy. A template has been tabled and the conversation has ended there.
You cannot go back when the staff AI pulse has been taken and the number is on the table.
Inventoried
Every AI tool a student or staff member touches is on one list with a vendor, what it does and whether students use it. The policy coverage check names which duties AI now touches.
You cannot go back when the tool inventory exists and the leadership team has read the coverage check.
On the register
AI is a risk category with an appetite statement, the risks written for a school with controls and treatments, and a named owner on each.
You cannot go back when AI risk is on the register with a name beside it and the board has seen it.
- This engagement lands here
Endorsed
The AI policy set is approved by the board and held with owners and review triggers. Decision rights say who approves a tool and on what basis. Staff AI training is on the matrix.
You cannot go back when the board has approved the AI policy set and the first staff completion is recorded.
Governed
The termly pulse and tool review run. The first AI legislative change is actioned through the policy set. The board sees the AI position in every pack.
You cannot go back when the first legislative change has been actioned and the board has read two AI reports in a row.
Six to eight weeks in four bands, starting with the day. The board decision is the gate.
- Day one
The AI governance day
A day with the leadership team, away from the 8:40 call: the threats and opportunities as they show up in your school, where AI touches duty of care, privacy and compliance, and who decides and what is logged. The AI Risk Register lands in your inbox that morning.
- Weeks 1 to 2
Diagnose
The staff AI pulse. The AI tool inventory. The policy coverage check against the obligations PolicyAI has tagged.
Gate. The pulse number, the inventory and the coverage check are on the executive's table.
- Weeks 3 to 4
Design
The AI governance framework: decision rights, a logging standard, a board reporting line. The AI policy set drafted against the relevant Acts. AI as a risk category with controls. Training matrix additions by role.
- Weeks 5 to 6
Deliver
An executive briefing, a board briefing, a staff PD session recorded once and kept, and a policy drafting workshop with the owners in the room.
Gate. The board has approved the AI policy set.
- Weeks 7 to 8
Embed
The policy set held with owners and review triggers. AI on the register with an appetite statement and a named owner. Training tracked. The pulse baseline stored for comparison.
- Each term
Keep it governed
The pulse and the tool review re-run. The annual policy currency check. Every AI legislative change lands on the policy it touches.
The staff room, the executive table, the boardroom. Three rooms, one question.
- In the staff room: what staff are already using, said out loud, recorded once and kept.
- At the executive table: which duties AI now touches, and who decides what is allowed.
- In the boardroom: the AI position the board will see in every pack, and the motion to endorse the policy set.
A governing body, the chair listening, the pack short enough to read.
Run at any scale. From one campus to a diocese, with every entity reporting the same way.
- Switch
- from your existing platform, for a low cost
- 25
- policy domains help you make sense of the policies you have, and the ones you need
- Every regulator
- in Australia and New Zealand supported
- Safe
- data, processing and AI based in Sydney and Melbourne via AWS
Coverage spans the eight Australian states and territories, with Commonwealth law applying across all of them, and separately New Zealand. Domain figures come from the PolicyAI Research Atlas, refreshed weekly.
“School governance and risk is a complex area without a clear solution, a time-poor disconnect with governance and risk management that relies on Frankenstein models of electronic and paper-based reporting and measuring.”
David RuggieroPrincipal, Blackfriars Priory School- Stored in AustraliaAWS Sydney and Melbourne, one database per school
- AI stays in the country tooAmazon Bedrock; never trained on your content
- Published, not describedTrust Centre · ISMS policy · How we handle your data
PolicyAI answering the prompt “Draft me an AI Acceptable Use Policy.”, then working through: Reading the AI-engaged obligations; Matching privacy, records, child safety; Drafting against your existing library.
Solutions for every school’s AI challenge.
There is no AI-specific legislation in force in Australia or New Zealand. The duties your school already carries are the ones AI engages.
Governing AI, before your board asks again.
“The board asked what our position on AI is, and we did not have one.”
An AI policy is not a new rulebook, it is a lens over duties your school already carries: privacy, records, discrimination and child safety, engaged by an AI-shaped set of facts. Which is why a downloaded template does not survive contact with a regulator.
We have tagged the duties AI activity in a school engages, so the conversation starts from the obligations you already hold rather than from a blank page. Almost none of them say “AI”.
Try Draft with AI.Five paragraphs against the obligations of your State, with the provision beside each. Free, no login.
The six we are asked every time.
Still weighing something up? Thirty minutes with us, on your own registers, answers the rest.
Take the AI maturity assessment01Does a school need an AI policy?
A school needs its existing policies to say what happens when AI is involved. A standalone AI policy that is not tied to child safety, privacy, records, WHS and staff conduct answers the board's request and leaves the duties untouched. The amendments are the policy; the register and the board line make it governance.
02What should the board ask about AI?
Who decides which tools staff may use, what is logged when they do, which existing duties are touched, and what the school would show a parent or a regulator who asked. Those four questions, on a standing cadence, are most of the board line.
03Where does EthosOne's AI run?
Frontier AI, hosted via Amazon Bedrock in AWS Sydney. Retrieval stays in EthosOne's Australian environment, the model is stateless, and no school data trains any model. The security page has the detail.
04Can we run the day without buying anything?
Yes. The day requires no licence, and the licence itself runs from January 2027. Schools that go no further keep the register and the notes.
05The board wants an AI position. Where do we start?
There is no AI-specific legislation in force in Australia or New Zealand. An AI policy is therefore not a new rulebook, it is a lens over duties your school already carries: privacy, records, discrimination and child safety, engaged by an AI-shaped set of facts. Which is why a downloaded template does not survive contact with a regulator.
We have tagged 266 obligations in our corpus by how AI activity in a school engages them: 153 data privacy, 72 algorithmic bias, 14 synthetic media, 12 automated decisions, 8 records governance and 7 surveillance. The conversation starts from the duties you already hold rather than from a blank page.
From there it is ordinary governance: named threats, controls with owners and due dates, evidence attached, and staff trained and on record as having read the policy. Your teachers are already using AI. The work is documenting it, not banning it.
06AI governance for schools, in full: what does it cover?
It runs in four bands over six to eight weeks: Diagnose (a staff AI pulse, an AI tool inventory and a policy coverage check), Design (the AI governance framework, the AI policy set, AI as a risk category with controls, and additions to the training matrix), Deliver (an executive briefing, a board briefing, a recorded staff PD session and a policy drafting workshop) and Embed (the policy set with owners and review triggers, AI on the register with an appetite statement and a named owner, and staff AI training tracked). It starts with an AI governance day, which needs no licence, and is delivered by Dave Yeates and Pete Holliday, with the CulturePathAI framework and pulse where a school engages James Field. It is a maturity model, focused on organisational complexity and built on our work with Meta Agility, and the assessment tells a school where it sits before the day begins.
What are the AI paragraphs you are currently missing from your policies? Watch how we do it.
Free, under ten minutes, and yours to keep whether or not you talk to us.
“It meets all of the real frustrations of business directors in one place.”
“School governance and risk is a complex area without a clear solution.”
Begin withthe day.
AI governance service: a systems-based response for schools, from an AI governance day to policy, risk and board reporting.