AI Tool Due Diligence
Before deploying an AI tool across your institution, you need documented evidence that it meets your data protection obligations, handles personal data appropriately, and does not create unacceptable risk. That evidence matters to your DPO, your governing body, and potentially the ICO.
For schools and multi-academy trusts, there is an additional dimension. Tools that process children’s data must be assessed against the Age-Appropriate Design Code as well as UK GDPR. Many EdTech suppliers selling into education are aware of their data protection obligations but not how to apply the law in practice. The institution that deployed the tool is the Controller, so it carries the compliance risk regardless of what the supplier has certified.
Clark & Company assesses AI tools and EdTech products against a structured due diligence framework and provides a clear, documented outcome. This service is available to institutions procuring tools and to EdTech suppliers who need to demonstrate compliance before entering the education market.
Note: AI Tool Due Diligence is a data protection and UK GDPR assessment. It is distinct from an AI Security Review, which addresses the security risk profile of AI tools from a cyber security perspective. Both are available as separate services and can be conducted independently or together.
Pricing
| Service | Published Price |
|---|---|
| Single tool assessment | £600 + VAT |
| Suite assessment (up to five tools) | £2,200 + VAT |
| Rolling due diligence retainer | From £500 per month + VAT |
What an Assessment Covers
Each assessment applies a structured framework to the AI tool or EdTech product under review. The scope includes the following.
Data protection and UK GDPR compliance. Whether the tool processes personal data in a lawful, fair, and transparent manner in line with the data protection principles. Covers lawful basis, purpose limitation, data minimisation, retention, and data subject rights handling.
DPIA requirement. Whether a Data Protection Impact Assessment is required before deployment and, where it is, whether one has been conducted. For high-risk AI tools, a DPIA is mandatory under UK GDPR Article 35.
Age-Appropriate Design Code. For tools that may process children’s data, assessment against the ICO’s Children’s Code. This applies to all schools and MATs and to HEIs where student-facing tools could reach under-18s.
Third-party processing and sub-processors. Whether the supplier acts as a processor, whether a compliant data processing agreement is in place, and whether sub-processors are disclosed and appropriately contracted.
International transfers. Whether the tool involves transfers of personal data outside the UK or EEA, and whether appropriate transfer mechanisms are in place.
Model transparency and training data. What the supplier discloses about how the model was trained, whether personal data is used to train or improve the model, and whether that use is covered by the terms of the agreement.
Contractual protections. Whether the supplier’s standard terms provide sufficient contractual protections for the institution, or whether bespoke provisions are needed.
What is Included
Structured assessment. A consistent, documented framework applied to every tool, covering all areas listed above.
Supplier engagement. Clark & Company engages with the supplier on your behalf where additional information is needed. You do not need to manage that correspondence.
Evidence review. Assessment is based on documentation and evidence, not supplier self-certification alone. We review privacy notices, terms, DPAs, certifications, and transparency disclosures.
Risk rating. Each assessment concludes with a clear risk rating: Acceptable, Acceptable with conditions, or Not acceptable in current state. Where conditions are attached, they are specific and actionable.
Written assessment report. A structured report recording the scope, the evidence reviewed, the findings, and the risk rating. This is the document filed as your due diligence record.
Remediation guidance. Where a tool falls short, the report includes specific guidance on what needs to change before the risk rating can be revised.
Frequently Asked Questions
Who is this service for?
Institutions procuring AI tools or EdTech products, institutions with tools already deployed that have not been formally assessed, and EdTech suppliers who need to demonstrate data protection compliance to education customers. All three are common scenarios.
Can you assess tools we are already using?
Yes. Retrospective assessment is common. Many institutions have tools in use that were adopted before a formal due diligence process was in place. The assessment establishes the current compliance position and identifies what needs to change.
What if the supplier refuses to cooperate?
That is itself a finding. A supplier unwilling to provide the information needed for a meaningful assessment creates a significant risk flag. We will record it, advise on the risk position, and help you decide whether to escalate or exit.
How does this differ from an AI Security Review?
AI Tool Due Diligence is a data protection assessment, it examines how the tool handles personal data against UK GDPR and related obligations. An AI Security Review is a cyber security assessment it examines the security risk profile of the tool, including prompt injection, data exfiltration, and model dependencies. The two are complementary and can be conducted together.
How long does an assessment take?
A single tool assessment is typically completed within five to seven working days, depending on the responsiveness of the supplier. Suite assessments and rolling retainer programmes are agreed at scoping.