Part Nine

Governing AI in Education

Based on the paper "Governing AI in Education: Uneven Rules, Thin Evidence and Procurement as Policy, 2026" by Paul Penfold (Proceedings of Future Science Archives, 2026).

Part Eight asked how a school leader should act. This part steps back to ask who governs AI in education at all. It follows a busy year of rules and statements, shows how thin the evidence is behind them, and argues that much of the real governance happens in contracts.

Chapter 42 Who governs AI in a school?

Ask who governs AI in a school and the answer depends on where you look. At the top sit intergovernmental statements of principle. Below them, a few binding laws and statutory duties. Below those, national and district policy. Then institutional governance: who in a school approves a tool, who handles a concern, who reviews outcomes. And at the bottom, where most of the real decisions are made, procurement: the contract a school signs with a vendor, which settles what data is collected, where it goes, what the tool does with a student's work, and what it costs.

This part looks at how those layers developed during 2026 and how well they connect. My central claim is that they don't yet connect well. Principles have become clearer and more ambitious, but binding duties are patchy and in one major jurisdiction have been delayed. The evidence that would allow schools to choose well remains thin. The result is that much of the governance of AI in education is being done by contract, often without anyone treating it as governance at all.

Three questions guide the part:

• What changed in the governance of AI in education during 2026?
• Where are the gaps between principles, rules, evidence and practice?
• What can schools and systems do now, without waiting for those gaps to close?

Where the material comes from

This is a policy analysis based on documents published or adopted in 2026, read alongside the research and policy literature. Its starting point is a set of newsletters on policy and governance that I wrote for school leaders between May and October 2026 (Penfold, 2026) [134, 101, 111, 123, 115, 146, 137]. They include summaries of UNESCO's collection The algorithm in the room (UNESCO, 2026) [189] and of the World Economic Forum's report on education readiness for AI. For this book I revisited the primary documents and news sources and checked them, and confirmed dates against official or legal sources where I could. Policy in this area moves quickly, so check anything you rely on against the current position.

Chapter 43 A year of rules: what changed in 2026

Stronger international principles

In March, UNESCO, UNICEF and ITU launched a Charter for Public Digital Learning Platforms, setting out principles for publicly governed platforms based on open standards and interoperable architecture, designed in part to avoid lock-in to a single vendor (UNICEF, 2026) [194]. In May, the Council of the European Union adopted conclusions on teachers in the era of AI, the first time the relationship between AI and teaching had been addressed in EU education policy (Council of the European Union, 2026) [28]. The conclusions call for an ethical, safe and human-centred approach, warn of the risk that AI undermines teachers' autonomy and sustainable working conditions, and ask that teachers help design and evaluate the AI tools used in their classrooms (Penfold, 2026) [134]. Chapter 36 looks at what this means for teachers.

In June, the World Economic Forum published an AI readiness framework for education built on enabling foundations, institutional capacities, pedagogical practices and learning experiences (World Economic Forum, 2026) [205]. In September, education ministers meeting at UNESCO's Digital Learning Week adopted a statement calling for education to remain a common good in the age of AI (UNESCO, 2026) [188].

A statutory duty in England

On 7 July 2026, England's Department for Education published Keeping Children Safe in Education 2026, the statutory safeguarding guidance for every school and college in England, in force from 1 September (Department for Education, 2026 [33]; EdTech Innovation Hub, 2026 [39]). The definition of making or sharing nudes and semi-nudes now explicitly includes images that are digitally altered or wholly generated by AI, so a fabricated image of a pupil is handled through existing child-on-child abuse procedures rather than falling into a policy gap. The guidance directs schools to the department's product safety expectations for generative AI, applies filtering and monitoring duties to AI tools, and sets an expectation that schools be mobile phone-free by default.

This is the first time a national system has placed generative AI inside a binding safeguarding duty rather than alongside it in advice (Penfold, 2026) [101]. Advice can be read and shelved. A statutory duty attaches to a named role.

A delay in Europe

The EU AI Act classifies AI systems used in education for admissions, assessment of learning outcomes, steering of learning and monitoring of students during tests as high-risk (European Union, 2024) [44]. Those systems must meet requirements for risk management, transparency and human oversight, and deployers that are public bodies must carry out a fundamental rights impact assessment.

In July 2026, however, the AI Omnibus, Regulation (EU) 2026/1744, came into force and moved the date from which these high-risk obligations apply from 2 August 2026 to 2 December 2027 (National Law Review, 2026 [79]; Gibson Dunn, 2026 [49]). The prohibited-practice rules and transparency duties for AI systems kept their original dates, so the delay is narrower than headlines suggested. But it covers exactly the uses schools and universities are deploying now: grading, admissions and exam monitoring (Penfold, 2026) [111].

The effect is that one system tightened the safeguarding end of AI in schools in the same month that another loosened the assessment end. School leaders, especially in international schools that answer to more than one system, sit between them.

From strategy to delivery

In the same fortnight, the World Bank opened a Global EdTech Policy Academy on AI in Seoul, with the theme of moving from policy to implementation at scale (World Bank, 2026) [201]. Taken together with the UNESCO statement and the English guidance, three separate institutions signalled that the strategy-writing phase is ending and the delivery phase has begun (Penfold, 2026) [101].

Chapter 44 The evidence gap

Governance depends on evidence about what works. Here the picture in 2026 was thin. A review by Stanford's AI Hub for Education examined more than 800 studies on AI in education but found only about 20 high-quality causal studies capable of showing whether AI tools directly change student outcomes (GovTech, 2026) [52]. Its consistent finding was that students often perform better while using AI and struggle to reproduce those results without it, which matches the pattern found in a large field experiment in high school mathematics (Bastani et al., 2025) [11]. The review also found real benefits for teachers, with time spent on grading, planning and feedback reduced by as much as 30% without loss of lesson quality. Its authors described the overall picture as mixed and early.

Practice is running well ahead of this evidence. NPR reported in September 2026 on US districts buying tools first and asking questions later, including a social-emotional chatbot purchased for vulnerable students at an alternative school and a humanoid robot pilot dropped after parents raised privacy concerns (NPR, 2026 [85]; Penfold, 2026 [123]). Teachers are cautious about the general-purpose tools they're using. A survey of more than 20,000 teachers in 14 European countries found that 63% used AI to prepare learning materials, but only 16% believed general-purpose AI improves learning outcomes, and between 75% and 93% said educational AI tools should be designed specifically for education (Sanoma Learning, 2026) [166].

The gap between adoption and evidence is itself a governance problem. Where evidence is thin, the decision about whether a tool is worth using is effectively made by its vendor's marketing and the buyer's hopes.

Chapter 45 Procurement: the hidden layer of governance

My newsletters returned repeatedly to one point: procurement decisions are governance decisions, whether institutions treat them that way or not (Penfold, 2026) [115]. When a school adopts an AI platform, the contract settles questions that would otherwise belong to policy: what student data is collected, where it's stored and for how long, who can see how the tool reaches its decisions, whether the tool's pedagogy fits the school's, what happens when the contract ends, and what it costs over time.

Whose systems are they?

Contributors to UNESCO's The algorithm in the room make the wider argument. Amiel, Cox and de la Higuera argue that handing educational content to an algorithm hands oversight to a black box, and that open education is the practical route to systems answerable to educators rather than shareholders (Amiel et al., 2026) [5]. Fabo argues that nation-states have traditionally decided curriculum and what counts as reliable knowledge, but that AI companies are taking on more of that role simply by controlling the infrastructure schools depend on (Fabo, 2026) [45]. A ministry can sign a statement about public accountability. Whether it controls the systems the statement is about is another matter.

Who pays, and for what

Appoldt and Gong apply Baumol's cost disease to teaching (Appoldt & Gong, 2026) [8]. Baumol (1967) [12] showed that labour-intensive services become relatively more expensive over time because, unlike manufacturing, their core activity can't easily be automated. Teaching is a classic case: the human interaction is the product. Appoldt and Gong's warning is that when the rising relative cost of education is framed as a problem for AI to solve, the pressure moves towards cuts to staff and privatisation presented as innovation, rather than towards the harder political choice of funding education properly as a public good (Penfold, 2026) [115].

Costs that don't appear on the invoice

Some costs of AI never appear on a school's budget. A United Nations University report published in June 2026 projected that global data centres could consume 945 terawatt-hours of electricity by 2030, up from about 448 terawatt-hours in 2025, together with about 9.3 trillion litres of water a year and more than 14,500 square kilometres of land (United Nations University, 2026) [196]. These are projections on current trends rather than forecasts that account for efficiency gains, so treat the figures as indicative and check them against the report. They do show the scale of the physical infrastructure that education's AI subscriptions depend on. O'Sullivan and Kelly describe the resulting contradiction for higher education, whose public mission now rests partly on infrastructure with environmental costs it doesn't account for (O'Sullivan & Kelly, 2026 [93]; Penfold, 2026 [146]).

There's an access dimension as well. UNESCO's 2023 Global Education Monitoring Report asked of technology in education: a tool on whose terms? (UNESCO, 2023) [183]. Infrastructure and connectivity remain an equity fault line, and the WEF readiness report warns that institutions with weak infrastructure risk falling further behind, not because their educators are less capable but because the basic plumbing isn't there (World Economic Forum, 2026 [205]; Penfold, 2026 [137]). Part Ten takes up equity directly.

Chapter 46 A governance stack, its gaps, and a protocol for schools

Five layers

Bringing these strands together, the governance of AI in education can be understood as a stack of five layers. Each answers a different question, and each depends on the layers around it.

• 1. International principles. What should AI in education be for? In 2026: the UNESCO ministerial statement, the EU Council conclusions and the Charter for Public Digital Learning Platforms. State: stronger and more specific.
• 2. Binding law and statutory duty. What must institutions do, and who is accountable? In 2026: the EU AI Act high-risk rules and KCSIE 2026 in England. State: uneven, tightened in England and delayed in the EU.
• 3. System policy. How will this system implement AI? Examples: national curricula, district moratoria and procurement frameworks. State: fragmented and fast-changing.
• 4. Institutional governance. Who in this school decides, reviews and answers for AI use? Examples: approval routes, named roles and review cycles. State: often informal or missing.
• 5. Procurement and practice. What exactly does this tool do with our students and their data? Examples: vendor contracts, pilots and classroom use. State: where most real decisions are made.

Three gaps

The binding gap, between layers 1 and 2. Principles have moved faster than law. The EU delay leaves sixteen months in which, for the uses that matter most in education, the main protection between a student and an automated admissions or grading decision is institutional policy (Penfold, 2026) [101].

The capacity gap, at layer 4. The WEF report frames institutional capacity as more than a policy document. It means clear decision-making structures, a route for staff to raise concerns, and governance distributed across leadership, teachers, technical staff and, where appropriate, students and families, rather than concentrated in one person who becomes a bottleneck (World Economic Forum, 2026) [205]. In most schools, a teacher who finds a promising tool on a Saturday doesn't know who to ask on Monday (Penfold, 2026) [135].

The evidence gap, at layer 5. Procurement decisions are being made with very little evidence about learning outcomes, and with little attention to data terms, pedagogy or environmental cost.

Procurement as governance: six tests

Schools can't close the binding gap, but they can close much of the gap at layers 4 and 5 now. I propose that every significant AI procurement be treated as a governance decision and pass six tests before a contract is signed. The protocol draws on the newsletters' recommendations and on the principles in the EU Council conclusions and the public platforms charter.

• Evidence. Independent evaluation, not case studies, and results on learning measured with the tool switched off (Penfold, 2026) [123].
• Pedagogy. Teachers who will use the tool are involved in choosing and evaluating it, and its design prompts thinking rather than handing over answers (Council of the European Union, 2026) [28].
• Data. Clear terms on what student data is collected, where it's stored, who can access it and what happens to it when the contract ends.
• Accountability. A named role in the school owns the tool, its incidents and its review, and can explain how it reaches decisions about students. Under KCSIE 2026, AI incidents involving pupils are safeguarding incidents and should sit with an existing accountable role (Penfold, 2026) [101].
• Exit. Data can be exported and the school can leave without losing its students' work or records, in line with the public platforms charter's concern with interoperability and lock-in (UNICEF, 2026) [194].
• Hidden costs. The vendor discloses its energy and water footprint, as it would disclose its safeguarding arrangements, and the school considers whether the tool's benefit justifies them (Penfold, 2026) [146].

A small pilot with a comparison group and a review date should follow. As I put it to school leaders, a vendor who won't accept that has told you something (Penfold, 2026) [123].

What to do

For school leaders. Treat AI incidents involving pupils, including fabricated images, as safeguarding incidents owned by an existing role, and rehearse the response with staff rather than publishing a policy that won't be remembered. Don't treat the EU delay as a reason to shelve readiness work: human oversight, transparency and staff AI literacy were sensible before they were deadlines. Apply the procurement protocol to every significant AI purchase and renewal.

For system leaders and ministries. Close the binding gap for high-risk educational uses rather than relying on institutional goodwill. Fund independent evaluation of the tools schools are buying, including outcomes measured without the tool. Support public, interoperable platforms that reduce lock-in, as the 2026 charter proposes.

For international and multi-jurisdiction schools. Map which binding duties apply to you and adopt the stricter standard where systems diverge. A school that can say plainly how it uses AI in assessment and who checks it is in a stronger position with its community than one waiting to see what regulators eventually enforce (Penfold, 2026) [111].

What this part can't tell you

The analysis covers a single, unusually busy year and focuses on documents from Europe, England, the United States and intergovernmental bodies. It doesn't examine regulation in Asia, Africa or Latin America in comparable depth. Some claims rely on secondary reporting of primary documents, and policy in this area changes quickly. The procurement protocol hasn't been tested systematically and is offered as a practical starting point, not a validated instrument.

A closing thought

The governance of AI in education in 2026 was marked by a widening gap between what international bodies say AI in schools should be for and what binding rules, evidence and institutional capacity can currently deliver. In that gap, contracts are doing the work of policy. Schools don't need to wait for regulators to close it. By treating procurement as governance, giving AI incidents a named owner, and asking for evidence of learning with the tool switched off, they can govern the part of the stack they control. The question for any school leader isn't whether AI is being governed in their institution. It already is, by whoever drafted the last contract.