Filtering, monitoring & assurance

Home › Filtering, monitoring & assurance

The policy sets the rules; filtering and monitoring enforce them. This section names who owns those arrangements, and how assurance reaches your leadership.

What it is

Your filtering and monitoring arrangements as they apply to AI: blocking unapproved services, monitoring in line with your existing duties, and the senior named owner accountable for all of it. The annual review also considers access routes that bypass network controls altogether: personal devices with their own connectivity, including smart glasses and other wearables. It ties into the DfE filtering and monitoring standard and your wider cyber-security position, and it feeds the assurance reporting that trustees or governors receive.

Why it’s important

There’s a name for what happens when this slips: shadow AI. Staff, usually with the best of intentions, start using unapproved tools through personal accounts and devices because the approved route feels slow or unclear. The problems it brings are serious. Personal data ends up in tools nobody has assessed, with no DPIA, no contract and no way of getting it back or deleting it. Outputs feed into planning, reports and decisions with nobody accountable for checking them. And because the activity never touches your systems, the risks are invisible to the very monitoring that’s supposed to catch them.

If unapproved services aren’t actually blocked, the approved list becomes advisory and shadow AI gradually becomes the norm. Blocking and monitoring, in line with your existing duties, prevent that. The DfE standards expect a senior named owner, rather than a shared inbox, so that filtering and monitoring is somebody’s clear responsibility, reviewed and reported, rather than an assumption.