From Panic to Policy: A 90-Day AI Roadmap for Schools

If your school does not yet have a coherent approach to AI, you are not alone. Many schools recognise that AI is already affecting teaching and assessment but have not yet built the structures to govern it. Teachers may be experimenting in isolation, parents may be asking questions and senior leaders can find themselves caught between enthusiasm and anxiety.

The good news is that you can move from panic to a functional, defensible AI governance position in 90 days. Not a perfect position. Perfection in a fast-moving space is a mirage. But a position where you have visibility over what is happening, structures to manage it, and a plan for where you are going.

Here is the roadmap I use with schools. It is designed for a school starting from near-zero, and it is deliberately sequenced so that each phase builds on the last.

Days 1-30: Discovery and Baseline

The first month is about understanding where you are. You cannot build a strategy or a policy without knowing your starting point, and most schools have a very incomplete picture of their current AI landscape.

Week 1: Conduct an AI tool audit. Send a brief survey to all staff asking three questions: What AI tools do you currently use in your professional practice? What AI tools do you know students are using? What AI tools are embedded in the platforms you use (your LMS, your assessment system, your communication tools)? Compile the results into a central register.

You will be surprised by what comes back. In my experience, schools typically discover three to five times more AI tool usage than leadership was aware of. Some of it will be benign: a teacher using ChatGPT to brainstorm lesson ideas. Some of it will need attention; AI tools processing student data without any formal approval or data protection review.

Week 2: Establish an evidence baseline. Review the policies, professional learning, curriculum material and implementation evidence you actually hold. Use a versioned framework and explicit audit questions, record what each source establishes and protect any judgement where coverage is incomplete. The aim is a defensible starting position for prioritisation, not an impressive score.

Week 3: Identify your regulatory landscape. Map the data protection and AI regulations that apply to your school. If you are a UK school, this is UK GDPR plus any sector-specific guidance. If you are an international school, it may include host country data protection law, curriculum authority requirements, and potentially the EU AI Act. Document this map; it forms the compliance foundation for everything that follows.

Week 4: Briefing to SLT. Present your findings to the senior leadership team. Include the AI tool register, the audit results, and the regulatory map. Frame it not as a crisis but as an opportunity; you now have data that most schools do not, and you can use it to build a proactive approach rather than a reactive one. Use this meeting to secure SLT buy-in for the next phase.

Days 31-60: Structure and Policy

The second month is about building the governance architecture and the policy framework.

Week 5: Establish the AI steering group. I have written a detailed guide on this elsewhere, including composition, remit, and a template terms of reference. The key point here is speed; do not spend months deliberating over membership. Identify five to seven people, issue the terms of reference, and schedule the first meeting. The group can refine its own structure over time; what matters now is that it exists.

Week 6: Draft the AI policy. With the steering group in place, draft the school's AI policy. It should cover acceptable use for students and staff, data protection requirements, assessment integrity provisions, the AI tool approval process, and governance and review mechanisms. Do not aim for perfection; aim for a working document that can be iterated. The steering group should review and approve the draft.

Week 7: Prioritise quick wins on the tool register. Review the AI tool register from Week 1 and identify any tools that present immediate compliance concerns: tools processing student data without approval, tools with unclear data storage locations, tools that make decisions about students without human oversight. Address these first. In some cases, this may mean pausing use of a tool until a proper review can be conducted. In others, it may mean conducting a rapid data protection review and formalising approval.

Week 8: Design the CPD baseline. Before you plan training, you need to know where your staff are. Use a self-assessment survey or, ideally, a competency assessment aligned to UNESCO's AI Competency Framework for Teachers. This gives you a baseline that you can measure progress against. Group staff into broad competency bands: awareness (knows AI exists and has basic familiarity), application (can use AI tools effectively in their practice), and evaluation (can critically assess AI tools, adapt them for pedagogical purposes, and support colleagues).

Days 61-90: Communication and Momentum

The third month is about embedding your new structures and communicating them to the wider community.

Week 9: Launch teacher CPD. Based on your Week 8 baseline, design and launch your initial CPD programme. Start with the highest-impact, lowest-risk content: how to use AI tools effectively for lesson planning and resource creation, what the school's new policy says and what it means for daily practice, and how to spot potential AI use in student work. Keep it practical. Teachers disengage from abstract training. Give them tools they can use on Monday morning.

Week 10: Communicate to parents. Write a clear, jargon-free communication to parents about the school's approach to AI. Cover what AI tools the school uses and why, how student data is protected, what the school's expectations are for student AI use, and how parents can support responsible AI use at home. This is not just good governance; it is proactive reputation management. Parents who hear about AI from the school, on the school's terms, are far less likely to be alarmed than parents who hear about it from their children or the media.

Week 11: Communicate to students. For secondary and sixth form students, run assemblies or tutor-time sessions that explain the school's AI policy, with a particular focus on assessment integrity. Be direct about what is acceptable and what is not, and explain the rationale; students respond better to transparent reasoning than to unexplained rules. For primary students, the approach will be different, but the principle is the same: age-appropriate communication about how AI is part of their learning environment.

Week 12: Review and plan forward. Convene the AI steering group for a review meeting. Assess what has been achieved, what gaps remain, and what the priorities are for the next term. Draft a brief report for the governing body summarising the 90-day journey: where the school started, what structures are now in place, and what the plan is going forward.

What You Will Have After 90 Days

By the end of this roadmap, your school will have a documented AI tool register with a process for ongoing maintenance, a formal AI readiness audit with a baseline against international frameworks, a functioning AI steering group with clear terms of reference, a working AI policy covering acceptable use, data protection, and assessment integrity, an initial teacher competency baseline with a CPD programme underway, and communications to parents and students establishing your school's approach.

This is not a finished product. AI governance is an ongoing function, not a project with an end date. Your policy will need updating. Your tool register will grow. Your CPD programme will evolve. Your audit should be repeated annually to track progress.

But you will have moved from panic to a defensible, structured position; one that demonstrates to your community, your regulators, and your accreditation bodies that your school takes AI seriously. And in a landscape where most schools are still in the panic zone, that positions you ahead of the curve.

Ninety days. That is all it takes to get started. The question is not whether you have time. The question is whether you can afford to wait.