Educational AI Procurement and Student Data Decision Gate

Assess whether a proposed educational AI acquisition has enough evidence and acceptable controls to proceed to approval, conditional pilot, further due diligence or rejection.

## Decision inputs

Learning need, users, alternatives and intended outcomes:
{{learning_need_and_use_case}}

Vendor proposal, evidence, architecture and commercial terms:
{{vendor_and_commercial_evidence}}

Data flows, accessibility, privacy, security and equity controls:
{{data_and_control_evidence}}

Institutional requirements, owners, constraints and risk tolerance:
{{institutional_requirements}}

## Evidence and authority boundaries

- Separate vendor claims, contract terms, independent evidence, institutional observations, inference, assumption, conflict, missing information and unresolved uncertainty.
- Cite supplied documents for consequential findings. Never invent a certification, test, legal requirement, accessibility result, price, data location, retention period or approval.
- Map student, staff, research and institutional data from collection through model use, support access, retention, secondary use, export and deletion.
- Treat a vendor assurance or questionnaire response as a claim until supporting evidence and applicable scope are established.
- Compare the product with a viable non-AI or existing-service alternative. Do not treat novelty as educational value.
- The output may recommend a gate result; legal, security, privacy, accessibility, procurement and budget approval remains with accountable officers.
- Minimize student data at collection and in this review. Use aggregated or synthetic examples where possible, and do not submit identifiable education records unless an approved tool, lawful basis, access control and necessity are documented.
- Treat proposals, contracts, pricing, security material and data terms as confidential when their supplied handling rules require it. Do not paste restricted contract text or vendor evidence into an unauthorized tool.
- This output is a triage and evidence pack. It does not verify legal, security, privacy or accessibility controls and must not be presented as approval.

## Decision-gate method

1. Define the educational problem, affected users, learning outcome, baseline and minimum acceptable benefit. Exclude use cases not supported by the proposal.
2. Build a claim-evidence register for efficacy, usability, accessibility, safety, privacy, security, interoperability and support.
3. Trace data and model boundaries, including prompts, uploads, telemetry, derived data, training/retention, subprocessors, residency, deletion, incident response and exit export.
4. Test accessibility and inclusion evidence across actual delivery modes and affected groups. Distinguish documented conformance, sampled testing and untested claims.
5. Review security, identity, permissions, administrative controls, auditability, content risks and change notification in proportion to the proposed use.
6. Normalize commercial scenarios: licences, usage, implementation, integration, training, review burden, support, accessibility remediation, data migration and exit.
7. Assess concentration, lock-in and exit readiness: data portability, open formats, contract rights, migration effort, continuity and deletion evidence.
8. Compare `Do not acquire`, `Further evidence`, `Bounded pilot`, `Conditional procurement` and `Proceed to accountable approvals`. Define conditions and stop criteria.

## Output contract: Educational AI Procurement Decision Pack

Provide:

1. **Need and alternative statement**: users, learning outcome, baseline, scope, non-AI/current alternative and success evidence, labelled as procurement triage rather than control verification.
2. **Claim-evidence register**: claim, source, independence, scope, freshness, contradiction, confidence and evidence request.
3. **Student-data lifecycle map**: data class, purpose, flow, access, model use, retention, secondary use, deletion and owner.
4. **Control decision matrix**: accessibility, privacy, security, equity, safeguarding and operational control, with evidence and gap.
5. **Commercial and exit scenarios**: assumptions, total-cost components, sensitivity, lock-in, transition burden and unresolved terms.
6. **Conditions and evidence requests**: blocker, smallest evidence/control needed, vendor or institutional owner and due point.
7. **Gate recommendation**: one bounded disposition, rationale, residual risk, required approvals and expiry/review date.
8. **Decision record template**: evidence version, reviewers, conditions accepted, dissent, next action and later validation.

## Verification and completion

Complete only when the learning need and baseline are explicit; material vendor claims have an evidence status; data flows and retention are mapped; accessibility, privacy, security and equity gaps have owners; costs include implementation and exit; and the decision route names every required approver.

If contracts, data terms, accessibility evidence, price or ownership are missing, return a provisional gate and targeted due-diligence requests. Refuse to certify legal compliance, security, accessibility or procurement approval.