Every week a school leader asks me which AI tool they should buy. It's the wrong first question. The right one is: which tools won't put your students' data somewhere it shouldn't be?
I've advised schools, trusts and government bodies across the UK, US and internationally, and the pattern is consistent. AI adoption rarely fails on pedagogy. It fails in procurement, when nobody asked the boring questions before the excitement took over.
How This Guide Was Built
I run aieducator.tools, an independent directory of 120+ AI tools for education. Every listing records safety and compliance data alongside independent reviews from real educators. I don't take payment for inclusion, and I don't recommend tools I wouldn't put in front of a class.
Start With the Data, Not the Demo
Under UK GDPR, your school is the data controller. Not the vendor. If a tool mishandles student data, the accountability sits with you. The Department for Education's guidance on generative AI in education says the same thing in politer language: use professional judgement, and build data protection and safeguarding into any use.
The ICO's Children's Code adds another layer. Any online service likely to be accessed by children must be designed with their best interests and privacy at the centre. Most consumer AI chatbots were not.
Five Questions to Ask Before You Sign Anything
Where is the data stored? Is student data used to train the vendor's models? Is there a signed data processing agreement? Can you request deletion at any time? And is the tool designed for education, or just dressed up for it?
Some tools make this easier than others. SchoolAI builds real-time teacher monitoring into its student learning spaces. Acuity AutoRedact exists purely to handle DSAR redaction for schools. Honest caveat: compliance features don't guarantee good pedagogy. They're the entry ticket, not the prize.
The Free-Tool Trap
The most common data breach I see isn't a rogue vendor. It's a well-meaning teacher pasting student work into a free consumer chatbot. If a free tool offers no school-level controls, no clear data terms and no age-appropriate safeguards, it should not be approved for learner use. However good the output looks. Even in an established area like lesson planning and resource creation, where the directory lists 46 tools, compliance postures vary enormously.
How to Choose
My rule is simple: outsource the doing, not the thinking. Due diligence is thinking work, and it can't be delegated to a vendor's marketing page. Shortlist from the full directory, filter by safety compliance, then put the five questions above to every vendor left on the list.
What I would do
Safe AI adoption isn't slower AI adoption. Schools that do the compliance work once, properly, move faster afterwards because the trust is already built. Start with the safety data, not the sales deck.
Your DPO will thank you. So will your students.
Dan Fitzpatrick is a Forbes contributor, three-time bestselling author and founder of The AI Educator. He has trained more than 150,000 educators worldwide and advises school leaders, MAT CEOs and government bodies on AI strategy. Explore independently reviewed tools at aieducator.tools. Last updated: 20 August 2026.