The short answer
A workable AI policy for a private school fits on one page and answers five questions: which tools staff may use and on which accounts, what data may never leave the school's systems, who approves anything that reaches a family or touches money, how AI-assisted work is recorded, and who in each office is responsible for the tools. It's a policy for staff, written from how the school actually works, and it's separate from the academic integrity rules for students. Write it before the first tool goes in, and rewrite it after the first semester with the tools running.
Why the staff policy comes first
By the time a school writes any AI policy, its staff are already using AI. A teacher drafts the newsletter in a free assistant on a personal account. An admissions coordinator pastes an inquiry into a chatbot to "clean up the reply." The business office summarizes a contract the same way. None of this is malicious and all of it is unmanaged: school data on personal accounts, no record of what was drafted by whom, and nobody responsible when something goes wrong. The student policy addresses none of it. The staff policy is where the risk actually is, and it's also where the gains are, because the staff work is the clerical load AI is good at.
The five rules
The first rule is approved tools on school accounts. The school lists the tools staff may use, provides them under school accounts, and says plainly that personal accounts are not to be used for school work. The list can be short. What matters is that it exists and that the accounts belong to the school, so the data and the history do too.
The second rule is what never leaves. Student records, health information, financial information, assistance awards, and anything about a family's circumstances stay inside the school's own systems and inside tools that have passed the vendor questions below. Nobody pastes a student's record into a general assistant, and the policy should say so in those words. The school should name the categories rather than rely on judgment, because judgment under deadline is unreliable.
The third rule is approval. Anything that reaches a family, touches money, or changes a student record is drafted or suggested by the AI and approved by a named person before it happens. The policy says who that person is for each office. This one rule is what makes every other use safe, and it's the one to write most clearly.
The fourth rule is the record. When AI drafted a letter, summarized a meeting, or suggested a reconciliation, the system keeps that fact alongside who approved it. This isn't about blame. It's so the school can answer a parent or a board member honestly, and so it can see which uses are working.
The fifth rule is ownership. Each office, admissions, business, front office, communications, names one person who is responsible for the tools in that office: the one who knows what's approved, trains new colleagues, and raises the next use case. Without a name, the policy is a document; with a name, it's a practice.
The student side, briefly
The academic policy, what students may and may not do with AI in their work, belongs with the academic leadership and the honor code, and it's a separate document with a separate audience. The one place the two should meet is data: any tool a student uses that touches their record falls under the same vendor questions as the staff tools. Beyond that, keep them apart. A policy that tries to cover a seventh grader's essay and the business office's reconciliations in one page serves neither.
Questions to ask every vendor
Where does our data run, and in which country? Is any of it used to train your models or anyone else's? How long do you keep prompts, uploads, and outputs, and can we delete them? Who at your company can see our data? Can you export everything we've put in, in a usable format, when we leave? What happens to our data if your company is sold or shuts down? A vendor who answers all six in writing, plainly, can be considered. One who answers with a link to a general privacy page should not see student data. This applies to the AI bolted onto systems you already own as much as to new tools, and most schools have never asked their existing vendors.
A one-page outline
Purpose, two sentences: what the school uses AI for and the principle that a person stays responsible. Approved tools: the list, the accounts, and who adds to it. Data that never leaves: the named categories. Approval: for each office, what requires a person's approval and who that person is. Records: what's logged and where. Ownership: the AI lead in each office. Vendors: the six questions, and the rule that no tool sees student data until it has answered them. Review: the date this policy is next reviewed, no more than a year out. That's the whole document, and a school can draft it in an afternoon from this outline.
Keeping it alive
The first version will be wrong in places, because it's written before the tools are running. Plan to rewrite it after one semester of use, with the office leads in the room, based on what actually happened: the use case that saved the most time, the near miss, the tool nobody opened. A policy reviewed once a year with real examples stays short and stays followed. One written once and filed becomes the document people cite after something has gone wrong.
Want the policy written from how your school actually works?
EnrollmentGenius writes staff AI policies alongside the training and the tools, so the rules match the practice. The audit maps where school data goes today, which is where most policies need to start.
Schedule a Call →Frequently asked questions
What should a private school's AI policy include?
Approved tools on school accounts, the categories of data that never leave the school's systems, who approves anything that reaches a family or touches money, how AI-assisted work is recorded, an AI lead in each office, the questions every vendor must answer, and a review date.
Should the staff AI policy be separate from the student policy?
Yes. The student policy is about academic integrity and belongs with the honor code. The staff policy is about data, approval, and responsibility in the offices. They share only the vendor rules for tools that touch student records.
Can staff use free AI tools on personal accounts for school work?
They shouldn't, and the policy should say so. School work happens on school accounts so the data and the history belong to the school and can be managed and exported.
What data should never go into an AI tool?
Student records, health information, financial and assistance information, and anything about a family's circumstances, unless the tool runs inside the school's systems and has answered the vendor questions in writing.
Who should be responsible for AI in a school?
One named person in each office, plus a senior leader who owns the policy. The office leads know what's approved, train colleagues, and raise new use cases. Responsibility that isn't named isn't real.
How often should an AI policy be reviewed?
After the first semester with tools in use, then at least once a year, with the office leads and real examples in the room. Short policies that get reviewed stay followed.