13 questions to ask any AI edtech provider 

The DfE’s Generative AI Product Safety Standards give schools and trusts a practical way to assess whether an AI product is safe and suitable for use in education. They are aimed at the developers and suppliers building these tools, but school leaders can use them too when comparing products and asking how safety, data protection and governance have been handled. The current DfE version, updated on 19 January 2026, sets out 13 standards. 

Taken together, the standards cover a product’s purpose, filtering, monitoring, security, data protection, design and governance. The latest update also considers how AI may affect children’s development and wellbeing. This includes cognitive offloading, emotional dependence and the response when a pupil in distress confides in a tool, including how the designated safeguarding lead (DSL) is notified. 

The DfE standards cover everything from a product’s intended use to data protection, governance and its effect on children. We’ve turned them into plain questions you can use when assessing a generative AI product for a school or trust or speaking to a supplier. Some apply to products used by staff or pupils, while others matter most when pupils interact with the AI directly or when it can affect their learning, wellbeing or behaviour. A supplier should be able to explain which questions apply to its product and be able to answer them. 

The 13 standards can be grouped into four main areas: 

• What the product is for, and whether its claims stand up 
• How it protects pupils 
• Who is responsible for data and decisions 
• Whether it supports learning without undermining it 

1. Stated purpose: what is the product designed to do, and who is it for? 

Ask the supplier to tell you, in plain terms, who the product is for, which ages, subjects or tasks it supports and where its boundaries lie. If it is designed for teachers or admin staff rather than pupils, that difference should be explicit. 

2. Educational use cases: what is the product meant to improve? 

Ask which of the DfE’s use cases the product covers, for example content creation and delivery, personalised learning and accessibility, assessment and analytics, or a digital assistant. Then ask for evidence that the claimed benefit is happening in practice, rather than just a list of features. 

3. Filtering: what happens when the product meets harmful content? 

For pupil-facing features, ask the supplier to show how the product deals with harmful or inappropriate text, images and requests, including content in other languages and use on personal devices outside the school network. Ask how they were tested and how they are monitored. 

4. Monitoring and reporting: who knows when there is a concern? 

Find out what the product records, what it treats as a concern and how that information reaches staff. If a pupil encounters harmful content or says something worrying, the report should give non-specialist staff enough context to understand what happened and what to do next. Agree the route to the designated safeguarding lead (DSL) before the product is used. 

5. Security: how hard is it to bypass the safeguards? 

Ask the supplier to demonstrate how the product protects its settings, permissions and safety controls from being bypassed. This includes attempts to “jailbreak” the product, tamper with its settings, change its behaviour or reach functions reserved for another user group. You should also know whether you have the ability to set different permissions so that pupils, teachers and administrators have different levels of access. 

6. Privacy and data protection: what happens to pupil data? 

Ask for the information you would need to complete or review a data protection impact assessment (DPIA), an age-appropriate privacy notice and a clear explanation of the data lifecycle. If pupils’ data is used to train or improve a model, the supplier should explain the legal basis, the purpose and the controls around that use. 

7. Intellectual property: what happens to pupils’ and teachers’ work? 

Ask whether pupils’ or teachers’ work is retained, reused or used to improve the product and how consent would be obtained. The supplier should explain the permission or licence it relies on and how that position is communicated to users.  

8. Design and testing: who was the product tested with? 

Safety is easier to assess when a supplier can show how it shaped the product before launch. Ask who tested it, whether children or the user group were involved in testing and with a realistic range of users, what risks were found and what changed as a result. A published policy is useful, but it is not the same as evidence from testing. 

9. Governance: who owns the response when something goes wrong? 

Look for a clear route to deal with any issues. A supplier should be able to show its risk assessment and safety policies and explain how a school can raise and track a concern. They should be able to explain the process from how to make a complaint, who receives this, who records the incident and who reviews what happened and makes a decision.  

10. Cognitive development: is the pupil still doing the thinking? 

Ask how the product supports independent thinking and learning. Hints, prompts and partial steps can leave room for a pupil to reason; an instant answer may not. Find out whether the product can detect or report patterns that suggest a pupil is handing too much of the task to it. 

11. Emotional and social development: could a pupil become too attached to it? 

Pupils should be able to tell they are using a tool, not speaking to a person. Ask how the product avoids encouraging attachment or dependence, what limits it places on use and how staff are alerted if a pupil appears to be relying on it too heavily. The supplier should explain the choices behind its tone, persona and interaction design. 

12. Mental health: what happens when a pupil needs human help? 

Ask the supplier to walk through a safeguarding scenario. If a pupil shows signs of distress, what does the product say, what does it refuse to do, what support does it point the pupil towards and how is the concern passed to the designated safeguarding lead (DSL)? The escalation route should be clear before the product is used, including who receives the alert and what information they see. 

13. Manipulation: is the product trying to keep pupils engaged? 

Ask the supplier how they ensure the product is free from manipulative design. Check for flattery, pressure, empty praise or prompts that push pupils towards longer sessions, paid options or behaviour that benefits the provider. The product should support the task it was designed for, rather than steer the pupil, or member of staff towards a commercial outcome.

Access GCSEPod is a curriculum and revision platform for secondary schools. It supports teachers and pupils with classroom teaching and independent revision, alongside teacher-facing AI tools such as the AI Marking Assistant for marking and feedback. 

The DfE standards reinforce the expectation that teachers remain in control of final decisions around marking and feedback. Teaching staff have told us how important that is too, and we built the AI Marking Assistant around it. Teachers accept its suggestions 99.1% of the time, but no feedback is released to pupils until a teacher has reviewed and approved it. The teacher makes the final call, every time. Read more about how teachers are responding to AI assisted marking. 

When it comes to pupil-facing AI, we are designing those tools against all 13 DfE standards from the start, including the standards on cognitive development, emotional and social development and mental health. The tools are still in development, and we are speaking with teaching staff about what pupils need and how we should meet our responsibilities as a supplier. 

Data and Governance 

Access GCSEPod is ISO 27001 certified and holds Cyber Essentials, an externally audited baseline a procurement lead can verify. Pupil data is held in UK and EEA data centres, with UK GDPR safeguards in place. It is encrypted in transit and at rest, and each school’s records are logically separated. We do not make automated decisions about pupils, and where our AI suggests marking or feedback, a teacher makes the final decision. When a contract ends, personal data is deleted or anonymised according to a set schedule. The school remains the data controller and Access acts as the processor, with the information needed for a DPIA documented and available for review.

We recommend putting these questions to every new software supplier you are considering, including us. If a supplier says its product does not use AI, ask it to confirm whether any AI features or third-party services sit behind the software, and which of the questions apply. A supplier should be able to answer plainly and show the evidence behind its claims. 

If you want to see how Access GCSEPod approaches these questions, speak to our team or request a demo of the software, including the AI Marking Assistant.