The Framework Gap: What Australian Schools Need to Know About AI Governance

The principles exist. The playbook doesn't.

In October 2023, Australian education ministers approved the Australian Framework for Generative AI in Schools. It was reviewed in June 2025 and sets out six core principles: Teaching & Learning, Human & Social Wellbeing, Transparency, Fairness, Accountability, and Privacy, Security & Safety.

The framework is a strong foundation. It defines what responsible AI in schools should look like. But it was designed to be aspirational — not a step-by-step operating manual.

It tells schools why they should govern AI. It doesn't tell them how to build the governance, policies, risk registers, or controls that make it real.

The numbers tell the story

The gap between AI adoption and AI governance in Australian schools is stark. The ASBA AI Preparedness Survey (2025) found:

• 61% of schools have no AI-specific policy at all.
• 75% of school boards haven't been properly briefed on AI.
• 69% haven't considered the ethical implications of AI.
• 60% have no executive owner designated for AI governance.
• 55% have not integrated AI into their risk management frameworks.
• 47% of leadership teams don't feel well-informed about AI.

AI tools are already widely used across Australian classrooms — they are powerful, improving quickly, and in most schools, they are being used with little or no formal governance.

Why this matters now

Two regulatory changes due in December 2026 add urgency:

• The Children's Online Privacy Code — once in effect, this will strengthen privacy protections for children in digital environments, including AI-powered education technology used in schools. It will place clearer expectations on how student data is collected, used, and shared.

• New Privacy Act requirements for automated decision-making — schools that use AI to make or significantly support decisions affecting students (for example, in assessment, wellbeing, behaviour, or timetabling) will need to disclose those practices in their privacy policies.

The window between "we should do something" and "we're legally required to have done something" is closing.

What schools actually need

The national framework gives schools principles. Most schools now need implementation infrastructure:

• AI risk registers that map where AI is being used and where things could go wrong.
• Control frameworks that tie specific safeguards to each risk.
• Clear, practical policies that staff and students can actually follow.
• Vendor assessment processes to evaluate AI tools before they are adopted.
• Maturity benchmarks so schools can see where they stand relative to peers — see what mature AI governance actually looks like.
• Incident-response plans for when something goes wrong with AI.

None of this is provided in the national framework. And there is no other vendor currently offering an end-to-end AI governance stack tailored specifically to education.

The path forward

The good news is that moving from zero governance to a structured, operational framework does not need to take months. Schools we work with typically achieve a baseline governance posture within 30 days — and it starts with something as simple as listing your top 10 AI risks and who owns them.

The framework gap is real. But it is closable. The schools that close it first will be the ones best positioned to harness AI's educational potential — not just manage its risks.

See where your school stands

Want to know how prepared your school really is? Take Arvoe's free AI governance self-assessment at www.arvoe.ai. It takes 5 minutes and gives you an instant maturity score across 8 dimensions, so you can see where to start and what to prioritise next.

If you're ready to move from principle to practice, www.arvoe.ai is where governance for AI in schools begins.