Lesson 2: Approved Tools and Your School's AI Policy

Before you type a single prompt

In Level 1 we looked at what AI can and can't do in your classroom. Today's question is quieter, and it matters just as much: which tool are you using, and which account are you signed in with?

Here's an analogy. You can probably drive the school minibus, and you can drive your own car. Both get you from A to B. But only one is insured, checked and signed off by the school for taking pupils on a trip. If you use your own car without asking, it might go fine, right up until something goes wrong.

AI tools work the same way. Your school's approved tool is the minibus. A free app on your phone is your own car.

Step one: find your setting's AI policy

So where do you look? Start with the staff handbook or the policies folder on the shared drive or intranet. Sometimes AI has its own policy. Often it's tucked inside the acceptable use policy, the data protection policy or the staff code of conduct. If you work in a multi-academy trust or a college group, the policy may be set centrally.

When you find it, sum it up in three short lines:

1. Which tools are approved for staff?
2. Which tasks are allowed, such as planning, resources or drafting emails?
3. What's off-limits?

What if you can't find anything? That's a policy gap, and it's useful to know. One rule here, though: silence isn't permission. Lots of settings are still writing their policies, so not having one yet doesn't mean anything goes.

Who should you ask? Try your line manager or head of department, the senior leader responsible for digital or AI, your IT or network manager, and your data protection officer (DPO). Ask by email, so you have the answer in writing.

Work account versus personal account

This is the part that surprises people. The same brand can come with a very different deal on data, depending on how you sign in. Here are some examples, checked against the vendors' own help pages in October 2026:

• Microsoft 365 Copilot Chat, when you sign in with your work or school account, comes with enterprise data protection. Microsoft says your prompts and Copilot's responses aren't used to train its foundation models. They are logged, and your IT admin can search and audit them.
• Gemini with a Google Workspace for Education account: Google says these chats aren't used to train its models and aren't reviewed by humans. With a personal Google account it's different. Google says some Gemini chats are read by human reviewers, and it asks you not to enter confidential information.
• ChatGPT Free or Plus on a personal account can use your conversations for training unless you switch off "Improve the model for everyone" in Data controls. OpenAI says it doesn't train on data from ChatGPT Edu or its business plans by default.
• Claude Free, Pro and Max have a "Help improve Claude" setting that decides whether your chats are used for training. Organisation plans run on separate commercial terms.

Now you might be thinking: "So if I switch the training setting off on my personal account, I'm fine, aren't I?" Not quite.

An approved tool is more than a privacy setting. Your school has looked at the terms, agreed them and set the tool up. It controls the accounts, can check what's happening and can close your access when you leave. A personal account has none of that, however carefully you set it up.

Here's a quick habit worth building. Before you start, look at the account name or email shown in the corner of the tool. Is it your school address? Good. Is it your personal Gmail? Stop and switch.

"Can I use this tool for this task?"

Let's make the decision simple. Ask yourself three questions:

1. Is this tool approved by my setting?
2. Am I signed in with my work account?
3. Does the policy allow this kind of task, and does the task involve any information about pupils, colleagues or families?

If any answer is "no" or "I'm not sure", pause and ask. (We'll go through exactly what must never go into a prompt in a later level.)

Let's try one. Priya teaches Year 8 geography. She wants to make a quiz on volcanoes with the free ChatGPT app on her phone. There are no pupil details involved. But her school's policy says Microsoft 365 Copilot Chat is the approved tool for staff. So what should she do? She uses Copilot with her school login. It's the same task with the right tool, and the problem's gone.

Here's another. Sam, a teaching assistant, has approved Gemini through the school's Google account and wants help drafting notes that mention a named pupil. The tool passes question one. Question three, though, is a "not sure". So Sam checks with the DPO before going ahead.

Check the help page, and write down the date

Here's something that catches people out: AI tools change all the time. Features appear, move and disappear, and data terms change too. In 2025, for example, Anthropic changed how chats on consumer Claude accounts can be used for training and asked users to choose a setting.

So before you rely on a feature at work, check it at the source. That means the vendor's own official help or privacy pages. A YouTube video, a colleague's memory or the chatbot's own answer about itself doesn't count.

Then write a one-line note: the tool, what you checked, the web address and the date you checked it. For example: "Copilot Chat, work account, prompts not used for training, support.microsoft.com, checked 22 Oct 2026." If someone asks later, you can show them exactly what you relied on, and when.

Your turn

This week, find your setting's AI policy, or confirm that there's a gap. Write your three-line summary. Then pick one task you'd like AI's help with and run it through the three questions. Finally, look up one feature on the vendor's help page and log it with today's date.

Checklist:

• I've found the policy, or named who I'll ask about the gap
• I know which tools are approved
• I've checked which account I'm signed in with
• I've run one real task through the three questions
• I've logged one help-page check, with the date

Key takeaways

• Find your setting's AI policy. If it doesn't have one, don't treat that as permission. Ask, in writing.
• A school-managed account and a free personal account can handle your data very differently, even when the brand is the same.
• Switching off training on a personal account doesn't make it approved.
• Use the three questions: approved tool? Work account? Allowed task, with no risky information?
• Check features on the vendor's official help pages and record the date, because things change.