AI Governance Audit: Review the AI Your School Uses

Short answer

How to run an AI governance audit in your school

An AI governance audit is a calm review of the AI already in use in a school. It finds every tool staff and students actually use, checks each one has an approval, suitable privacy terms and sensible access, looks at how concerns were handled, and notes documentation gaps. Most schools run a full audit yearly and a lighter check each term.

Use this page as part of a connected review: understand the purpose, consider the people affected, check the relevant safeguards, and follow the related routes for practical next steps.

Setting up governance is about deciding how things should work. An audit asks a different question: is that what is actually happening? AI tools arrive quietly, through new features in familiar software, a teacher's helpful discovery or a student's recommendation. A regular audit helps the school see the real picture without blame.

How an audit differs from setting up governance.

When a school first sets up AI governance, it decides who owns what, how tools are reviewed and how staff are trained. That work looks forward. An audit looks at the present. It asks whether the tools in use match the tools that were approved, whether people are using them as agreed, and whether the records the school promised to keep actually exist. Both kinds of work matter, and each makes the other easier.

The gap between the two is normal. Familiar software adds AI features after it was approved. A teacher finds a helpful tool over the summer and starts using it before asking. Staff leave but keep accounts. None of this means governance has failed. It means the school is busy and the tools keep changing, which is exactly why a regular, friendly audit is worth the time.

It also helps to be clear about scope from the start. An audit might cover every AI tool used by staff and students across the school, or it might focus on one area, such as student-facing tools, in its first year. A smaller, finished audit is more useful than a large one that stalls halfway. The scope can grow each year as the habit settles in.

Finding the AI that is already in use.

The hardest part of an audit is building an honest list. Start with what the school already knows: the approved tools list, purchase records and the apps connected to the school sign-in. Then look for AI features that have appeared inside tools the school already uses, such as writing help in a document editor or automatic suggestions in a learning platform. These are easy to miss because nobody had to request them. Ask the IT team which AI features can be switched on or off centrally, since that affects what the school can control.

Next, ask people directly. A short staff survey works well if it is clearly framed as no-blame: which AI tools do you use for planning, feedback, communication or admin, and which do your students use? Imagine a middle school that sends this survey and learns that several teachers use the same unapproved tool for rubrics. That is not a problem to punish. It is a sign of a real need.

Students are a useful source too. A few informal conversations, or a short question in a class discussion, often reveal tools adults had not noticed. Combine every source into one list, noting who uses each tool, for what, and whether it involves student information. That list becomes the base for every check that follows. Keep the list in one shared place so the next audit can start from it instead of from scratch.

What to check for each tool on the list.

Work through the same short set of questions for each tool. First, is there a recorded approval, and does current use match what was approved? A tool cleared for teacher planning may now be used directly by students. Second, do the privacy terms still fit the school's rules? Check what student information the tool collects and keeps. Laws such as FERPA and COPPA may apply, so confirm details with your privacy reviewer or counsel.

Third, look at access. Who has accounts, are they still at the school, and do students have access only where it was intended? Former staff accounts and shared logins are common, quiet findings. Fourth, review how concerns were handled. If a family or teacher raised an issue about a tool this year, was it answered, and did it lead to a change? A concern with no recorded outcome is worth following up. Check, too, whether younger students can reach tools meant only for older students or staff.

Finally, note documentation gaps. Some tools will be fine in practice but have no written approval or reason behind them. Others will have an approval that no longer reflects how they are used. Record each gap plainly, so the follow-up is a simple to-do list rather than a vague sense that things are untidy. Some gaps can be closed in minutes, simply by writing down a decision that was already made sensibly.

How often to audit and what to do with findings.

A full audit once a year suits most schools, often before the start of a new school year when tool lists are being refreshed. A lighter check each term can cover new requests, new features in major tools and any concerns raised. An extra review makes sense if an important tool changes its terms or after a significant concern. Put the dates in the school calendar so the audit does not depend on anyone remembering it.

Sort each tool into one of four groups: keep, keep with conditions, pause while questions are answered, or retire. Keep the reasons short and recorded. When a tool is paused or retired, tell the staff who use it directly, explain why and suggest an approved alternative where one exists. If several teachers chose the same unapproved tool, consider reviewing it properly rather than simply removing it. Staff are more likely to report tools in the next audit if this one feels fair.

End with a short report for leaders and staff: what was found, what changed and when the next audit will happen. Feed the lessons into the next policy review and training session. School-managed tools with usage visibility and audit trails, such as Ethos Educate, can make the access and use checks quicker, but the judgment about what to keep and why stays with the school. Thank the staff who took part, because their honesty made the audit possible.

Set the scope. Decide whether the audit covers staff tools, student tools or both, and which schools.

Choose a no-blame approach. Tell staff the aim is an accurate picture, not catching anyone out.

Agree the checks. Use the same short set of questions for every tool so findings can be compared.

Plan the follow-up. Decide in advance who acts on findings and how quickly.

What to check for each tool:

Is there a recorded approval?

Do privacy terms fit school rules?

Who has access, and should they?

Were concerns handled and recorded?

Where to look for AI in use:

A short, friendly staff survey.

New AI features in approved tools.

Purchase and sign-up records.

Conversations with students.

Discover. Gather a full list of AI tools and features in use from several sources.

Check. Review each tool for approval, privacy terms, access, concerns and documentation.

Sort. Place each tool in keep, keep with conditions, pause or retire.

Report. Share a short summary with leaders and staff and schedule the next audit.

Use this guide to plan and run an AI governance audit of the tools and practices already in use at your school.

Common questions

Quick answers to what schools and families ask most about this topic.