Vendor question bank
Section 7 of the AI policy: approval of a tool.
The document opens on the page; press each bracket and type what goes there, and the finished Word file downloads at the end. Nothing is stored unless you save it to your account.
Download
- Word document (DOCX, 13 KB)
- PDF (PDF, 46 KB)
A4 portrait.
Free to use, adapt and share in education, under CC BY-NC-SA 4.0. No sign-up, no email address. Files are rebuilt from the text on this page at every deploy, so what you download is what you read.
The file, as text
¶ Vendor question bank · Appendix C · [School name]
Sixteen questions before you buy
Ask in writing, require plain-language answers, and treat vagueness as an answer. The bar throughout is the DfE's product safety standards for generative AI and its guidance on procuring edtech. Tick when the answer is in the contract, not the call.
- Exactly what personal data does the tool collect or receive? (A finite list.)
- Where is it processed and stored? (Named locations, in the contract.)
- Is our data used to train, fine-tune, test or improve your models? (An unqualified no, or off by default with proof. The DfE says you must be able to tell us.)
- How long is data kept, and what happens when we leave? (Days, not vibes; certified deletion on exit.)
- Who are your subprocessors? (A published, current list with change notice.)
- How and when do you notify us of a breach? (A contractual period measured in hours.)
- How does the product keep children safe by design? (Specific, age-calibrated mechanisms.)
- What filtering and moderation applies to what the AI generates? (Inside the product, described concretely.)
- How was it tested against jailbreaking and misuse? (Testing described, results shareable.)
- What have you done about over-reliance, emotional dependence and pupils' development? (The standards now ask; most have no answer yet.)
- Are we controller and you processor, in a signed data processing agreement? (Yes, offered unprompted.)
- Who owns prompts and outputs? (We do, and the contract says so. The standards are silent on this, so the contract must not be.)
- How much notice do we get when the model or features change? (Contractual notice, not a changelog.)
- What may you do with prompts, outputs, logs and usage data? (Exhaustive and narrow.)
- What certifications and independent assessments can you show, and have you had a DPIA done on the product? (Recognised, current, independent.)
- What happens to our data if you are acquired or shut down? (Exit and deletion survive the company.)
Outcome, recorded on the register entry: approved / approved with conditions / declined, with the telling answers attached.
The facts behind this template
Every claim above is numbered to one of these records. Each gives the source’s own words where it can, the paragraph or section, and the date it was last read.
- 01
The DfE's product rules for generative AI are now "Generative AI: product safety standards". First published as expectations on 22 January 2025, they were renamed and extended on 19 January 2026 with new standards on cognitive development, emotional and social development, mental health, and manipulation.
“to include new standards on cognitive development, emotional and social development, mental health, and manipulation”
Generative AI: product safety standards, publication page, change history. Dated 19 January 2026. Read 28 September 2026.
- 02
A product must not store, collect or use intellectual property created by learners, teachers or the copyright owner for any commercial purpose, such as training or fine-tuning models, unless the copyright owner consents. The standards say nothing about who owns prompts or outputs.
“must not store, collect or use intellectual property created by learners, teachers, or the copyright owner for any commercial purposes, such as training or fine tuning of models, unless consented to by the copyright owner”
Generative AI: product safety standards, intellectual property. Dated 19 January 2026. Read 28 September 2026.
- 03
A section on procuring educational technology was added on 9 July 2026. It says a DPIA must be completed when processing is likely to result in a high risk, as early as possible, with the DPO's advice, and kept updated as and when the processing changes; suppliers must be able to explain how their tool works, including how AI outputs are moderated and whether data is used to train the model; the DPO and DSL must be consulted before purchase; and tools must be monitored after it.
“Suppliers must be able to explain how their tool works, including: how the AI (artificial intelligence) outputs are moderated; if the data is used to train the AI (artificial intelligence) model”
Data protection in schools: Procuring educational technology (EdTech), the section. Dated 9 July 2026. Read 28 September 2026.
Cite this template
Wes (2026). Vendor question bank. School AI Governance. https://schoolaigovernance.co.uk/templates/vendor-questions
Free to use, adapt and share in education under CC BY-NC-SA 4.0. Each section heading carries its own link, so a reference can point at one part.