Sovereign AI for schools and multi academy trusts

By AiVACO · 28 October 2026 · 7 minute read

In short

Schools and trusts hold children's data and carry safeguarding duties, so they cannot treat AI as an ordinary software purchase. Sovereign AI means the trust decides where data is processed, which models can touch it, what learners are shown and how long the record is kept, and can show governors and parents what the AI did.

Why education is different

A school is not an ordinary customer of AI. Pupil data deserves the highest level of protection. What a learner is shown must be accurate, age appropriate and traceable to approved material. And a school has duties that no software supplier shares, most obviously safeguarding. A tool that is perfectly acceptable for adults at work can be unacceptable in a classroom.

What sovereignty means for a trust

Data. The trust decides where pupil and staff data is processed and stored, who can see it, and that it is not used to train a supplier's models.
Model. The trust chooses which models are permitted and can change them without rebuilding everything. It is not locked to one vendor's product or pricing.
Evidence. Every question asked and every answer given is recorded in a log the trust controls, including the occasions when the AI declined to answer.
Decision. AI assists. A named member of staff remains accountable for anything that affects a pupil.

Answers from approved content only

A learning assistant that draws on the whole internet will sometimes be wrong, and will not always say where an answer came from. A safer pattern is to ground the assistant in content the trust has approved, such as the curriculum, schemes of work, policies and published guidance, so every answer cites a source a teacher can check. When the approved material does not contain the answer, the right behaviour is to say so rather than guess.

Safeguarding is routed, not handled

If a pupil says something that touches safeguarding, the assistant should not try to deal with it. Any matter of that kind should be routed to the designated safeguarding lead, with a record of the exchange. This is a design requirement, and it should be enforced in the system rather than left to a policy that depends on the model behaving.

Governance across a trust

A multi academy trust has a useful advantage: it can approve content, rules and models once, centrally, and let each school use them. That keeps one standard across the trust and gives trustees one place to look for evidence. It also means a decision to change a model, or to add a new use, is made once, with a record of who approved it.

Questions for governors and the data protection officer

Where is pupil data processed, and is any of it sent outside the UK?
Is any pupil or staff data used to train or improve the supplier's models?
Has a data protection impact assessment been completed for this use?
Does the product meet the Department for Education's product safety expectations for generative AI?
What happens when a pupil raises a safeguarding concern?
Who can see the log of what was asked and answered, and for how long is it kept?
If we change supplier or model, what do we lose?

Frequently asked questions

Does a school need a data protection impact assessment before using AI?

In most cases, yes. Processing children's personal data with new technology is the kind of activity where UK GDPR expects a DPIA. Speak to your data protection officer, and use the ICO's guidance.

Can pupil data leave the UK when an AI tool is used?

UK GDPR restricts transfers of personal data outside the UK unless appropriate safeguards are in place. A sovereign deployment keeps processing inside an environment the school or trust controls, which removes the question.

Is AI in education regulated by the EU AI Act?

For organisations covered by the Act, certain education uses, such as assessing learning outcomes or admissions, are listed as high risk. UK schools should check whether the Act reaches them, for example through EU based suppliers or operations, and take advice if unsure.

Sources and further reading

This article is general information, not legal or regulatory advice. Regulatory texts change, and some discussed here are drafts: check the current official text before relying on any detail.