{"resourceId":"cst-governing-ai-in-school-trusts-202610","versions":[{"version":"external-cdd9edb7266de612b2ab9b158d718e83700cf9dda4a8ee266fb2b9315a48d64f","resource":{"id":"cst-governing-ai-in-school-trusts-202610","title":"Confederation of School Trusts: AI is a board governance issue; keep an AI use-case register, find shadow AI, and test supplier claims against evidence","organization":"Confederation of School Trusts (CST)","sector":"Public-sector association for school trusts / K-12 governance","geography":"England (academy trusts); transferable to U.S. district boards and charter networks with limits","publishedAt":"October 2026 (PDF dated October 6, 2026)","publicationDate":"2026-10-06","eventDate":null,"sourceName":"Confederation of School Trusts","sourceLabel":"National sector body governance guidance for school trust boards","sourceUrl":"https://cstuk.org.uk/system/files/paragraphs/cw_file/2026-10/Governing%20AI%20in%20school%20trusts%20-%202026-10-06.pdf","evidenceClass":"public-sector-association","outcomeClass":"emerging","topics":["governance-procurement","data-security","operating-model","accessibility-workforce"],"finding":"CST's 20-page guide (Sadeghi and Wathen, October 2026) argues AI is a governance issue, not just technology, because suppliers embed AI into products trusts already use. It says boards need stewardship, strategic oversight and assurance rather than technical expertise, and proposes an assurance framework within existing structures. Steps include defining AI scope (generative AI, agents, AI in existing platforms), finding 'shadow AI' through a low-stakes, no-judgement staff survey, and keeping a proportionate AI use-case and systems register (purpose, owner, users affected, data, supplier, human oversight, risks, assessments, approval status, review date) cross-referenced with the information asset register and Record of Processing Activity. Use cases are classified by impact, AI is integrated into existing policies, and supplier claims must be tested against research evidence, data security and pedagogical priorities. It references DfE generative AI product safety standards and filtering and monitoring standards, and includes procurement questions. Why now: published this month and not previously archived.","sledRelevance":"Board-level governance mechanics (register, shadow-AI discovery, proportional classification) map directly to U.S. school boards and charter management organisations that lack AI policies, as recent archived state surveys show.","evidence":"Sector guidance from a membership body representing trusts educating more than four million children; not an evaluation. No data on adoption or effectiveness of the framework.","architectureImplications":"Register cross-referenced with data asset registers and processing records; suggests using existing office-suite sensitivity labels to inform AI use. Interpretation: register data should come from SSO, app catalogue and DPA systems rather than a standalone spreadsheet.","governanceImplications":"Boards seek assurance through existing structures; continuous assurance as suppliers change functionality or model providers; independent challenge via peer review, external assurance or benchmarking.","securityPrivacyImplications":"Board attention to personal data sharing, supplier data use and storage, cyber controls, incident response and supplier assurance; alignment with UK data protection and safeguarding standards.","caveats":"English legal and regulatory context (DfE standards, UK GDPR, KCSIE); U.S. transfer requires mapping to FERPA, COPPA and state laws. Guidance, not evidence of outcomes.","streamIds":["k12"],"roles":{"sales":"Sales framing: CST gives boards a way to govern AI without new bureaucracy: register material uses, surface shadow AI, and demand evidence behind supplier claims. For U.S. boards and charter networks, position a bounded AI assurance engagement that runs a no-judgement staff survey, builds the register, and adds AI questions to procurement. Avoid promising efficiency gains; CST provides governance structure, not outcome data. The value is visibility and defensible approvals as suppliers embed AI by default.","engineering":"Engineering framing: the register is only as good as its data sources. Populate it from SSO app catalogues, network discovery, DPA records and vendor change notices, and use existing sensitivity labels to gate AI access to protected data. Pre-sales should verify vendors notify customers when they change AI functionality or model providers. Proof of value is a register that reconciles survey responses with observed app usage and flags unsanctioned tools.","delivery":"Delivery framing: run CST's sequence: define AI scope, survey staff safely, build and classify the register, integrate AI into existing policies, and set continuous review when suppliers change. Owners are the board's risk or audit committee with the operations or data protection lead. Acceptance criteria include a populated register with review dates and procurement questions in use. Risks include survey answers that understate use if staff feel judged, and register decay."},"roleDetails":{"sales":{"customerProblem":"Boards cannot see or assure AI use as suppliers embed AI into existing products and staff use unsanctioned tools.","stakeholders":["Board chair and risk/audit committee","CEO / superintendent","Data protection officer","IT director","Procurement lead"],"discoveryQuestions":["Do you know which tools staff use, including unsanctioned ones?","Is there a register of material AI uses with owners and review dates?","How are supplier AI claims tested before purchase?","Who is notified when a supplier changes AI functionality or model provider?"],"valueHypothesis":"A register and assurance cycle could give boards visibility and proportional control over AI risk; efficiency or learning gains are not established.","potentialEngagement":"AI assurance setup: shadow-AI survey, use-case and systems register, impact classification, and AI procurement questions for the board.","unsupportedClaims":["No outcome or savings data in the source.","Framework effectiveness not evaluated.","English standards do not establish U.S. compliance."]},"engineering":{"fit":"Fits SSO, app-discovery, DPA management and data-classification tooling that can feed a governance register.","architectureIntegration":"Feed the register from SSO catalogues, network or CASB discovery, DPA records and vendor change notices; apply sensitivity labels to restrict AI processing of protected data.","prerequisites":["SSO coverage of key apps","Data asset register / processing records","Sensitivity labels in office suite","Staff survey channel"],"constraints":["UK framework, U.S. law mapping needed","Discovery misses personal-device use","Vendors may not disclose model changes"],"security":"Supplier assurance on data use and storage, cyber controls and incident response; classify use cases by data sensitivity.","proofOfValue":["Register reconciles survey and observed usage","Unsanctioned tools identified and triaged","Sensitivity labels block AI on protected data in tests","Supplier change notices captured"]},"delivery":{"work":"Build an AI assurance cycle within existing board structures: scope, survey, register, classification, policy integration and continuous review.","dependencies":["Board sponsorship","Data protection lead time","IT discovery data","Staff trust for honest survey"],"ownership":"Board risk/audit committee with data protection officer and IT director.","skillsAdoption":"Board and leader briefings on AI governance; staff guidance on approved, permitted and prohibited uses.","governanceCheckpoints":["Register review dates","Approval for high-impact use cases","Procurement AI questions applied","Independent challenge or external assurance periodically"],"acceptanceCriteria":["Staff survey completed with target response rate","Register populated for all material uses with owners and review dates","Use cases classified by impact","AI procurement questions adopted"],"risks":["Under-reporting in survey","Register becomes stale","Supplier changes unnoticed","Governance seen as box-ticking"]}},"retrievedAt":"2026-10-14T21:59:59-05:00","enrichedAt":"2026-10-14T22:05:14-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Boards should consider AI's impact on staff roles and ways of working and ensure psychological safety for staff disclosing AI use; workload reduction is noted as a motivation.","procurementImplications":"Supplier claims tested against research evidence, data security and pedagogical priorities; appendix procurement questions, including alignment with DfE product safety and filtering standards; value-for-money and sustainability considerations.","operatingModelImplications":"Governance embedded in existing assurance structures with continuous review, not a one-off approval.","sourceVerification":{"openedUrl":"https://cstuk.org.uk/system/files/paragraphs/cw_file/2026-10/Governing%20AI%20in%20school%20trusts%20-%202026-10-06.pdf","referenceExcerpt":"Supplier claims must be tested against research evidence, data security and pedagogical priorities.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}