AI Strategy vs AI Policy: Why Your School Needs Both

I was in a meeting with a senior leadership team last term when the head said something that stopped me: "We have an AI policy. We are covered." I hear some version of this in almost every school I visit. A policy has been written, sometimes a page, sometimes ten, and the school considers the AI question answered.

It is not answered. It has barely been asked. Because a policy is not a strategy, and most schools have confused the two.

The Difference

An AI policy tells people what they can and cannot do. It sets boundaries. It defines acceptable use for students and staff, addresses data protection, and outlines consequences for misuse. It is, by nature, reactive; it responds to the existence of AI by establishing guardrails.

An AI strategy tells the school where it is going. It sets direction. It defines how AI will support the school's educational mission over the next two to five years, what investment is required, what capabilities need to be built, and what success looks like. It is proactive; it shapes the school's relationship with AI rather than merely managing it.

Both are necessary. Neither is sufficient on its own.

A school with a policy but no strategy has guardrails but no destination. Teachers know what they are not allowed to do but have no vision for what they should be doing. AI adoption becomes ad hoc; individual teachers experiment in isolation, with no coherence across departments, no shared language, and no institutional learning.

A school with a strategy but no policy has ambition but no governance. It knows where it wants to go but has not established the rules of the road. This creates risk: data protection oversights, assessment integrity issues, inconsistent practice; these can undermine the strategy itself.

What an AI Strategy Actually Contains

Most school strategic plans mention technology. Many now mention AI specifically. But mentioning AI is not the same as having an AI strategy. A genuine AI strategy includes several key components that most school plans lack.

A vision statement that connects AI to educational outcomes. Not "we will embrace AI" or "we will be an AI-ready school." Those are slogans, not vision. A real vision statement articulates what AI enables for your students; for example: "AI will be used to personalise learning pathways, free teacher time for high-impact activities, and equip students with the critical thinking skills to thrive in an AI-augmented world." That is specific enough to guide decisions.

A capability audit. Before you can build a strategy, you need to know where you stand. What AI tools are currently in use? What is the current level of teacher AI competency? What governance structures exist? What is your data infrastructure capable of supporting? The AI Literacy Audit Tool was designed to provide exactly this baseline, mapping your current readiness against 33 international frameworks. But even a manual audit is better than assumption.

Prioritised initiatives. A strategy that tries to do everything at once will accomplish nothing. Effective AI strategies identify two or three priority areas (perhaps teacher CPD and assessment redesign in year one, student AI literacy curriculum development in year two, and advanced AI integration in year three). Each initiative has clear outcomes, timelines, resource requirements, and accountability.

Investment and resourcing. AI integration is not free. It requires investment in professional development, in technology infrastructure, in governance capacity, and potentially in new roles (an AI lead, a data protection officer, or external consultancy). A strategy that does not address resourcing is a wish list.

Success metrics. How will you know if your strategy is working? Define measurable indicators such as teacher competency assessment scores, student AI literacy survey results, the number of AI tools that have passed your governance review, and the frequency of assessment integrity incidents. Without metrics, you cannot evaluate progress or justify continued investment.

What an AI Policy Actually Contains

A strong AI policy is more operational than strategic. It translates the strategy's direction into daily practice. Key components include:

Acceptable use definitions for students. These should be differentiated by context. What is acceptable in a formative learning activity may not be acceptable in a summative assessment. Use a tiered system, green (encouraged), amber (conditional), red (prohibited), and provide subject-specific examples.

Acceptable use definitions for staff. Teachers need to know what they can and cannot do with AI in their professional practice. Can they use AI to generate lesson resources? To draft reports? To provide feedback on student work? Define the boundaries clearly and review them regularly.

Data protection requirements. Any AI tool that processes student data must be approved through a defined process that includes a data protection review. Specify who approves new tools, what criteria they must meet, and how compliance is monitored.

Assessment integrity provisions. Define how AI affects academic integrity across different assessment types. Address detection, response, and prevention, not just punishment. Include provisions for assessment redesign that reduce the relevance of AI assistance.

Governance and review. Specify who owns the policy, how often it is reviewed, and what triggers an out-of-cycle review (for example, the adoption of a significant new AI tool or a change in the regulatory environment).

Bridging the Two

The strategy and the policy must talk to each other. The strategy sets the direction; the policy operationalises it. If your strategy says "we will build teacher AI competency to UNESCO framework standards by 2027," your policy should include provisions for mandatory CPD, competency assessment, and accountability mechanisms.

Here is a practical way to bridge them. Create a one-page summary that shows, for each strategic priority, the corresponding policy provisions. If a strategic priority has no policy support, you have an implementation gap. If a policy provision has no strategic rationale, you have governance overhead without purpose.

Review both documents together, not in isolation. The strategy should be reviewed annually by the board or governing body. The policy should be reviewed termly by the AI steering group. But at least once a year, both should be on the same agenda, with the explicit question: does our policy still serve our strategy?

The Common Mistakes

Writing the policy first. Many schools start with policy because it feels more urgent: parents are asking questions, teachers are uncertain, incidents are happening. But policy written without strategic context tends to be reactive and restrictive. It says "don't" more than "do." Start with at least a draft strategy, even a rough one, so your policy serves a purpose beyond risk management.

Copying another school's documents. I see this constantly. A school gets hold of another school's AI policy or strategy and adapts it with a find-and-replace on the school name. This does not work because every school's context is different. Your community, your jurisdiction, your resources, your starting point are all unique. Use other schools' documents as reference points, not templates.

Treating both as static documents. AI moves too fast for annual-review-only governance. Your policy should have a mechanism for rapid updates when circumstances change (a new AI tool goes viral among students, a regulatory change takes effect, an incident reveals a gap). Your strategy should have built-in review points where you assess whether your priorities are still correct.

Leaving teachers out. Policies and strategies written by senior leadership in isolation from classroom practitioners tend to be disconnected from reality. Teachers know what AI tools students are actually using, what challenges arise in practice, and what support they need. Include them in the development of both documents.

Where to Start

If you currently have neither, start with a capability audit. Use the AI Literacy Audit Tool or conduct your own assessment of where your school stands. Then draft a strategy; it does not need to be long. A two-page document that defines your vision, identifies three priorities, and sets a timeline is more useful than a twenty-page document that sits in a drawer.

Once your strategy exists, build your policy to support it. Make sure every policy provision has a clear connection to a strategic objective. And then, critically, communicate both to your community. Teachers need to know the direction. Parents need to see the governance. Students need to understand the expectations.

A policy without a strategy is a cage. A strategy without a policy is a dream. Your school needs both, working together, reviewed regularly, and owned by the whole community.