The 5 Most Common Compliance Gaps We See in School AI Audits

When I built the AI Literacy Audit Tool, I expected to see variety. Every school is different: different contexts, different resources, different starting points. What I did not expect was how consistent the gaps would be. After processing hundreds of audits from schools across the Middle East, Europe, Asia, and beyond, the same five compliance gaps appear again and again.

These are not obscure technical failings. They are structural blind spots; places where schools think they are covered but are not. And they matter because when a regulator, an accreditation body, or a concerned parent asks "what is your school's approach to AI?", these are the gaps that leave you exposed.

Gap 1: No Documented AI Tool Register

Ask most schools what AI tools they use and you will get a vague answer. "We use some tools for marking." "A few teachers use ChatGPT." "I think the English department tried something."

This is not good enough. Every international framework that addresses AI governance, from the EU AI Act to UNESCO to the OECD, expects organisations to know what AI systems they are using and to have documented that inventory. The EU AI Act is particularly explicit: high-risk AI systems must be registered, and their use must be documented with evidence of human oversight, transparency measures, and data protection compliance.

In our audit data, fewer than 15% of schools have a documented register of AI tools in use. Not a spreadsheet of everything the IT department has approved. A comprehensive register that includes tools adopted informally by individual teachers, tools embedded in existing platforms (many learning management systems now include AI features that schools are unaware of), and tools that students are using independently.

The fix is straightforward but requires discipline. Create a central register. Include the tool name, its function, what data it processes, where that data is stored, who approved its use, and when it was last reviewed. Update it termly. Make it a standing item on your AI steering group agenda.

Gap 2: Teacher AI Competency Is Assumed, Not Measured

Almost every school I audit claims to be investing in teacher AI CPD. And almost none of them can tell me what competency level their teachers have actually reached. There is a profound difference between "we ran some training sessions" and "we can demonstrate measurable improvement in teacher AI competency."

UNESCO's AI Competency Framework for Teachers defines specific knowledge areas, skills, and dispositions that teachers need. It provides a progression model from basic awareness through to the ability to critically evaluate and adapt AI tools for pedagogical purposes. It is, in effect, a rubric for teacher AI readiness.

Yet in our audit data, only about 20% of schools use any form of competency measurement for teacher AI literacy. The rest rely on attendance records for training sessions (which tell you nothing about whether teachers understood, retained, or applied what they learned).

This gap matters because teacher readiness is the single biggest predictor of whether AI integration succeeds or fails. A school can have the best AI tools, the most comprehensive policy, and the most supportive leadership; but if teachers do not have the competency to use AI effectively and critically, none of it translates into better outcomes for students.

The fix: adopt a competency framework, UNESCO's is the most thorough, and use it to baseline your staff. Run the assessment at the start of the year, design CPD that targets identified gaps, and reassess at the end. You need data, not assumptions.

Gap 3: No Risk-Differentiated Approach to AI Tools

Schools tend to treat all AI tools as equivalent. The same approval process (or lack of one) applies whether a teacher is using an AI tool to generate quiz questions or whether the school is deploying an AI system that analyses student behaviour data and flags at-risk learners.

These are not equivalent use cases. They have fundamentally different risk profiles, and every serious framework recognises this. The EU AI Act explicitly classifies educational AI that assesses, profiles, or makes decisions about students as high-risk. UNESCO distinguishes between AI used to support teaching and AI used to evaluate learners. The OECD recommends proportionate governance based on the stakes involved.

In our audits, fewer than 10% of schools have a risk-differentiated approach to AI tool governance. Most either apply the same light-touch process to everything or have no process at all.

The fix is to create a simple risk tiering system. I recommend three tiers. Tier 1: teacher productivity tools that do not process student data (low risk, lightweight approval). Tier 2: student-facing tools with limited data processing (medium risk, requires data protection review). Tier 3: tools that assess, profile, or make decisions about students (high risk, requires full compliance review including data protection impact assessment, bias testing, and documented human oversight).

Apply the appropriate governance to each tier and review the classification annually, because tools change; a platform that starts as Tier 1 may add features that push it to Tier 2 or 3.

Gap 4: Assessment Integrity Policies Do Not Address AI

This one surprises me every time, because assessment integrity is arguably the area where AI has the most visible impact. Students are using AI to generate, edit, and improve their work. Teachers know this. Parents know this. And yet most schools' academic integrity policies were written before generative AI existed and have not been updated.

In our audit data, around 70% of schools either have no mention of AI in their assessment integrity policy or have added a single line along the lines of "students must not use AI to complete assignments." This is insufficient. It does not define what constitutes acceptable AI use (is grammar checking acceptable? Is brainstorming?), it does not differentiate between assessment types (a formative reflection piece has different integrity requirements than a summative examination), and it does not provide teachers with guidance on how to respond when they suspect AI-assisted work.

The IB has published detailed guidance on this. Cambridge and Edexcel have updated their regulations. But individual school policies lag far behind.

The fix is to build an assessment integrity framework that specifically addresses AI. Define a spectrum of acceptable AI use, from fully prohibited (formal examinations) through partially acceptable (brainstorming and outlining for coursework) to encouraged (using AI as a learning tool in formative contexts). Provide subject-specific guidance because the implications differ across disciplines. And train teachers in detection approaches that go beyond unreliable AI detection software, process-based assessment, oral defence, and in-class supervised components are all more effective and more fair.

Gap 5: No Regular Review Cycle for AI Governance

AI moves fast. The tool your school approved six months ago may have added new features, changed its data processing practices, or been acquired by a different company. The regulatory landscape shifts constantly; the EU AI Act's provisions are being phased in over several years, and host country regulations evolve in response to the global conversation around AI governance.

Despite this, most schools treat AI governance as a one-time exercise. They create a policy, perhaps conduct an initial audit, and then move on. In our data, only about 25% of schools have a documented review cycle for their AI governance; a scheduled, recurring process for reassessing their AI tool register, updating their policies, and evaluating their compliance posture.

This is particularly dangerous because it creates a false sense of security. A school that audited itself in September and found itself broadly compliant may be non-compliant by March; not because it did anything wrong, but because the environment changed.

The fix is simple: build review into the calendar. I recommend a termly review of the AI tool register (are new tools being used? Have existing tools changed?), a biannual review of the AI policy (does it still reflect your practice and your regulatory environment?), and an annual comprehensive audit against the full framework landscape. This is exactly what the AI Literacy Audit Tool is designed to support: a repeatable, evidence-based assessment that you can run regularly to track your trajectory.

The Pattern Underneath

These five gaps share a common cause: schools are reactive rather than proactive on AI governance. They wait for a problem, a parent complaint, a regulatory inquiry, an assessment integrity incident, and then scramble to respond. Proactive schools build the infrastructure before they need it. They document, measure, differentiate, update, and review on a regular cycle, treating AI governance as an ongoing function rather than a one-off project.

The good news is that none of these gaps are difficult to close. They require attention, discipline, and a willingness to invest time in governance rather than just in tools. The AI Literacy Audit Tool can show you exactly where your gaps are and how they compare to the 33 international frameworks that define good practice in this space. But even without the tool, if you address these five areas, you will be ahead of the vast majority of schools.

And in a landscape where regulators, accreditation bodies, and parents are increasingly paying attention to how schools handle AI, being ahead is exactly where you want to be.