When an AI service changes, what reopens the school’s approval?

01 / The starting record

Make the original permission intelligible before looking for change

For each use, retain a concise account of the purpose, users, information boundary, selected service, permissions and responsible person. Link to the evidence and the conditions that limited approval. A reviewer should be able to distinguish a staff drafting activity from a pupil-facing interaction or an integration authorised to act. The same product name may cover those different uses, but one permission should not silently authorise them all.

Include the important limitations. The school may have approved a restricted use pending further evaluation, prohibited a particular information category or required a human check before a result is used. If those conditions are missing from the entry, a later reviewer cannot reliably assess the consequence of a change. Reconstruct the decision where necessary, using the first-decision guide. Do not fill the gap by assuming that a previous product purchase settled every future use.

02 / What reopens it

Look for a change in purpose, information, people or authority

A material event might involve a new task, another user group, different information, an added integration, changed processing terms or a feature that can take actions. A known model or service-plan change may also affect the evidence relied on earlier. Assess the consequence in context. A minor interface alteration and an expansion from drafting suggestions to acting on school systems do not need the same response merely because both appear in an update notice.

DfE’s product standards make intended purpose and changes relevant assurance questions, but the school still needs to examine the actual use. For autonomous capabilities, NCSC’s interim advice offers a proportionate lens on authority, observation and the ability to stop. Ask what the service can now reach or do, whose interests could be affected and whether the original controls remain adequate. Do not apply an autonomous-system checklist indiscriminately to every low-stakes staff aid, or overlook new authority because the subscription name is familiar.23

03 / How it reaches the school

Join formal notices with what users are actually doing

Identify who receives contractual, technical and service notices and how relevant information reaches the use owner. Check that those messages are not confined to a purchasing inbox or the original project sponsor. Include staff reports of changed behaviour and new uses. People often discover a feature through ordinary work before it becomes visible in a central review. Give them a clear way to ask whether the activity is still within the approved boundary.

A school may not receive a complete explanation of every underlying model change. Record that limitation rather than inventing a level of visibility the organisation does not have. Seek appropriate information where the uncertainty matters to the use. If a consequential activity depends on assurance that cannot be established, the owner needs a decision about restriction, further investigation or pause. The register should make that uncertainty visible to someone authorised to act, instead of presenting a current-looking date as evidence that nothing material has changed.

04 / The receiving team

Send the changed fact to the people who can assess its consequence

Create a short review item: the approved use, changed fact, source and date, possible consequence, receiving owner, interim position and evidence required. Involve the DPO for relevant information-processing questions, the safeguarding lead for pupil-risk questions and the appropriate IT, curriculum or assessment colleague for their responsibilities. One use owner should keep the route joined up. Specialist contributions need a common decision, not several unconnected replies that leave nobody responsible for the result.

DfE’s school AI privacy guidance remains relevant when information or purpose changes. The review should establish whether the current activity still falls within the assessed boundary and whether additional advice or assessment is needed. An entry marked for review is not a general permission to continue unchanged. State what remains allowed while the question is resolved, who authorised that interim position and when it ends. Where the conditions cannot safely be maintained, use the agreed pause route.4

05 / Close with a judgement

Decide whether the original permission still holds

The result may be confirmation that the existing use remains appropriate, approval with revised conditions, a narrower scope, further evaluation or a stop. Record why that result follows from the changed fact and evidence. If the service’s behaviour has changed, ask whether earlier benefit or quality findings still apply. The separate task-evaluation guide explains how to examine that question. A previous positive comparison should not be carried forward automatically to a materially different activity.

Transfer any revised condition into the implementation record. Check that the people using or supporting the service can understand what changed and perform the new action. If a feature must remain disabled, verify the relevant configuration or operating control. If a new user group is approved, arrange the appropriate briefing and support. Closing the review means completing the decision and its necessary handoff, rather than changing a status field while ordinary practice continues on the old assumptions.

06 / Keep it manageable

Show leaders the exceptions that require their attention

A useful governing view can remain concise: the use, reason for review, unresolved consequence, interim position, owner and next decision point. Prioritise according to the significance of the change and the people affected, not simply the date the item entered the queue. Retain access to detailed evidence for the colleagues who need it, with appropriate protection. Avoid circulating personal information or commercially sensitive records more widely than the review requires.

Use the queue to identify repeated weaknesses in the school’s own process. Notices may reach the wrong inbox, permissions may expand without an owner or a review may wait for expertise that has no allocated time. Those are organisational decisions worth escalating. A scheduled review can complement the event route, but it cannot guarantee that every material change was detected between meetings. The positive outcome is a register that directs attention and supports action, with honest limits on what the organisation can observe.

Leadership questions

Questions that turn the development into a governing conversation.

What we are monitoring next

Publication is the beginning of the watch.

• Material changes in purpose, users, information, authority, terms or service behaviour.
• Official guidance that changes a condition of the original approval.
• Repeated review delays or missed notices that require an organisational response.

Continue the evidence trail

Follow the question through the series

• The original decision: the evidence behind buy, trial or stop ↗
• The operating route: ownership, restrictions and pause authority ↗
• Recheck benefit when the comparison no longer fits ↗
• Specialist follow-up: rights, complaints and meaningful human review ↗