Every week, another AI tool lands in front of a school board for sign-off. A new lesson-planning assistant. A marking tool. A chatbot bundled into an existing platform update. Dr. Craig Hansen, founder of Summit Institute, has trained more than 1,000 schools across Aotearoa New Zealand on AI in education — and the question he hears most often from board members isn’t “should we use AI?” It’s “how do we know this particular tool is actually safe to approve?”
That’s a compliance and risk question, not just a philosophical one. And it deserves a clear, repeatable answer — not a one-off conversation that gets forgotten by the next meeting.
“This is valuable to everyone within a kura — boards, kaiawhina, kaiako, whānau.” — Principal, Northland school
Why “we already have an AI policy” isn’t the same as risk and compliance
Many school boards now have a general AI policy in place. That’s real progress. But a policy that sets out principles for acceptable use is different from a process for assessing risk each time a new tool shows up.
Board responsibilities for AI in schools go further than adopting a values statement. They include asking, tool by tool: What data does this collect? Where is it stored? What happens if something goes wrong? A policy answers “what do we believe.” A risk and compliance process answers “how do we check, every time.”
The core questions your board should be asking
These six questions form a simple, repeatable AI policy framework for schools that any board can apply — whether the tool is a paid platform, a free chatbot, or something a staff member has found and wants to trial.
1. What data does the tool collect, and where does it go? Ask specifically about student names, work samples, images, and any special category data (learning support needs, attendance, behaviour records). Data privacy and AI risk assessments tailored to kura and schools should always start here, because this is where the sharpest risks sit.
2. Is the vendor’s data handling compliant with New Zealand privacy law? Many AI tools are built overseas, and their default terms may not meet New Zealand expectations. Boards should ask whether student data is used to train the underlying model, how long data is retained, and whether it can be deleted on request.
3. Who has approved this for use with students, and who hasn’t? Some tools are approved for staff admin use only. Others are approved for supervised classroom use. Being clear about which tier a tool sits in — and documenting that decision — protects both students and staff.
4. What happens if the tool produces something inaccurate or inappropriate? AI tools can generate incorrect information or content that isn’t appropriate for the classroom. A short, agreed process for reporting and escalating these incidents should exist before the tool is approved, not after something goes wrong.
5. Does this tool align with our commitment to culturally responsive practice? Boards should ask whether a tool has been checked for bias in its outputs and whether it reflects the languages, contexts, and values of the school’s community. This is as much a governance question as a pedagogical one.
6. How will we review this decision? AI tools update constantly. A tool approved as low-risk six months ago may have changed its data practices since. Building a review date into every approval — six or twelve months out — keeps the board’s oversight current rather than a one-off tick.
“Enjoyed the pace of delivery and provision of valuable tools that will enable all of us to work with more ease and flow in our roles. Such value and high level presentation.” — Principal, Waikato school
Building this into your existing governance rhythm
None of this requires reinventing your board’s meeting structure. Most boards can fold AI risk and compliance into existing agenda items:
- Add “new AI tools since last meeting” as a standing item alongside other risk reporting.
- Ask the principal or senior leader responsible for AI to bring a short risk summary — not a technical deep-dive, just the six questions above answered plainly.
- Keep a simple log of approved tools, their tier of use, and their next review date. This becomes your school’s practical AI policy framework in action, not just words in a document.
Where Ministry and NZQA expectations fit in
Ministry of Education guidance on AI and NZQA’s expectations around data and assessment integrity both assume schools are actively managing AI risk, not passively hoping it sorts itself out. A board that can point to a clear, working risk and compliance process — six questions, a log, a review cycle — is well placed to demonstrate that oversight if asked.
“This is an amazing opportunity for leaders and teachers, towards an equitable learning environment for learners.” — Senior leader, Auckland school
A simple starting point for your next board meeting
You don’t need to solve this all at once. A practical first step:
- Pick one AI tool already in use somewhere in your school.
- Work through the six questions above as a board.
- Use what you learn to build your standing “AI risk” agenda item going forward.
That one exercise usually surfaces exactly where the gaps are — and gives your board a genuine head start on governance PLD on AI in education, rather than starting from a blank page.
About the author Dr. Craig Hansen is an AI in education specialist and founder of Summit Institute, a New Zealand private training provider. He works with teachers, school leaders and school boards across Aotearoa New Zealand — from primary through secondary — to develop practical, culturally responsive approaches to AI in education.
Want to walk your board through this process directly? Contact to schedule an introductory chat: craig@summitinstitute.ac.nz
Craig has also developed the AI Policy Creator and Reviewer, available as both a ChatGPT GPT and a Gemini Gem, which can help draft or review the AI policy sitting behind your board’s risk and compliance process:
