What can staff paste into AI?
Public or synthetic information may be low risk. Internal work needs checking. Pupil, safeguarding, health, HR, financial information, passwords and secrets stop at the gate unless an authorised route exists.
Appendix H companion · All things AI in schools
Use the opportunity.
See the service risk.
Guidance for technicians supporting staff, pupils and AI-written applications, with current detail kept online and the school’s policy kept in charge.
Before an AI-written app goes live
Purpose, owner, source, data, access, tests, monitoring, cost, recovery and retirement.
Open the production guide →Safeguarding does not change
Stop exploring, preserve only what procedure requires and pass the concern to the DSL. Technical curiosity is not an investigation.
The service exposed a secret
Contain access without destroying evidence, tell the security owner and DPO, record facts, use the workaround and recover from a known version.
From prompt to production
The work begins after the first useful answer.
An idea and a first draft
Synthetic data; one creator
Named owner; controlled users
Tests, monitoring, support and exit
A working screen proves that one route worked once. It does not prove security, capacity, recovery or supportability.