# Principal / Leadership Three-Set

> **For:** Principals, vice-principals, curriculum coordinators, IT coordinators, Incorporated Management Committee (IMC) representatives
> **Distributed via:** Follow-up email after the 29 May webinar / Principals' Roundtable
>
> **Contents of the Three-Set:**
>
> 1. **School AI governance awareness self-check list** (17 self-check items)
> 2. **School-based AI development reference framework** (3 dimensions, 9 issues)
> 3. **Initial recommendations for a school AI use policy** (8 core clauses)

---

## From ZtoA MasterAI Academy

**Organiser:** ZtoA Group · MasterAI Academy
**Speakers:** Kenny Tang (ZtoA Group CEO · AIPPA Founding President) · Edward Lam (WEPRO CEO · AI Consultant)
**Website:** [academy.ztoagroup.com](https://academy.ztoagroup.com)
**Contact:** WhatsApp +852 6285 0456

---

# Before you use the Three-Set — important notes

> ⚠️ **What the Three-Set is: a quick reflection tool, not a full consultancy report**
>
> The checklist, framework and model clauses in this document are **quick self-check tools** that help school leaders scan the overall picture of AI governance in their school in a short time. This document **is not a full consultancy proposal and does not constitute professional advice on legal, compliance or technology-selection matters**.
>
> If your school has any questions about specific cases, legal liability, compliance procedures, technology procurement or policy implementation, **we recommend consulting professional advisers in the relevant field** (legal advisers, IT consultants, education policy advisers), or contacting ZtoA MasterAI Academy to arrange a school-based consultation.
>
> What the Three-Set is really for is **prompting reflection and keeping issues in view**:
>
> - **Prompting reflection** — use the checklist as a conversation starter, so that the principal, vice-principal, curriculum coordinator and IT coordinator examine blind spots together
> - **Keeping issues in view** — AI governance is not a one-off project but a long-term process of monitoring, reviewing and adjusting
> - **Gradual transformation** — a long-term path from initial awareness to formal policy, training and culture-building
>
> Don't treat this document as a tick-box questionnaire. **Behind every "No" is a real issue worth taking the time to discuss.**

---

**Suggested process:**

| Stage | Tool | Estimated time |
|---|---|---|
| 1. Start the internal conversation | Tool 1: AI governance awareness self-check list | 30 minutes |
| 2. Plan the development path | Tool 2: School-based AI development reference framework | 60 minutes |
| 3. Draft the policy document | Tool 3: Initial recommendations for a school AI use policy | 90 minutes |
| 4. IMC resolution | Consolidate the Three-Set and submit it for the agenda | Depends on the meeting schedule |

---

# Tool 1 — School AI governance awareness self-check list

> **How to use:** We suggest that the principal work through the list together with the IT coordinator and the curriculum coordinator. For each question, tick "Yes ✅" or "No ❌" according to your school's current situation. Put any "No" item on the agenda of the next school administration meeting for in-depth discussion — **what matters is not how many "Yes" answers you tick, but the real situation behind each "No".**
>
> **Important red-flag warning:** If you answer "No" to any of items 4, 6 or 8 (new numbering), we recommend dealing with it within two weeks — these three items cover the core risks in protecting students' personal data and are key areas of concern for the Office of the Privacy Commissioner for Personal Data (PCPD) under the Personal Data (Privacy) Ordinance. For the basis, see the PCPD's "Artificial Intelligence: Model Personal Data Protection Framework".

## A. Management (3 items)

| # | Item | ✅ Yes | ❌ No |
|---|---|---|---|
| 1 | Has the IMC passed a formal resolution on the school's position on using AI? | ☐ | ☐ |
| 2 | Has a teacher at senior-teacher level or above been designated to coordinate and drive "school-based AI development and promotion"? | ☐ | ☐ |
| 3 | Does the school have a clear policy and direction on the use of AI (covering all three areas: teaching, administration and home-school communication)? | ☐ | ☐ |

## B. System security (4 items)

| # | Item | ✅ Yes | ❌ No |
|---|---|---|---|
| 4 | When using AI tools, do all staff use only school-issued accounts? | ☐ | ☐ |
| 5 | Are the AI tools the school uses of Education / Enterprise grade (with clear data protection commitments)? | ☐ | ☐ |
| 6 | Are teachers prohibited from entering students' names, HKID numbers, health records or other personal data into personal AI accounts? | ☐ | ☐ |
| 7 | Is the school clear about which staff have which level of access to AI tools? | ☐ | ☐ |

## C. Information and sensitive content management (4 items)

| # | Item | ✅ Yes | ❌ No |
|---|---|---|---|
| 8 | Is it prohibited to enter non-public school information (results, health conditions, assessment reports, the content of parent complaints) into personal AI accounts? | ☐ | ☐ |
| 9 | Is there a human review process for AI-generated content (report comments, notices, reports)? | ☐ | ☐ |
| 10 | In the past six months, has AI-generated content from any teacher led to a parent complaint? If so, has the case been reviewed? | ☐ | ☐ |
| 11 | Do the school's contracts with third-party vendors (e.g. e-learning platforms) include clauses on AI use and data handling? | ☐ | ☐ |

## D. Learning, teaching and assessment (3 items)

| # | Item | ✅ Yes | ❌ No |
|---|---|---|---|
| 12 | Does the school have a policy on students using AI to complete homework? (Whether it bans it, allows it or requires it to be declared) | ☐ | ☐ |
| 13 | Has assessment design (tests, reports, projects) been adjusted to include a "process-based assessment" dimension? | ☐ | ☐ |
| 14 | Have teachers received at least one training session on using AI tools and their risks? | ☐ | ☐ |

## E. Home-school communication (3 items)

| # | Item | ✅ Yes | ❌ No |
|---|---|---|---|
| 15 | Have parents received an explanation of the school's AI policy through a formal notice? | ☐ | ☐ |
| 16 | Does the school have a consistent position for responding when parents ask about AI? | ☐ | ☐ |
| 17 | Has the school held at least one AI-themed sharing session for parents in the past year? | ☐ | ☐ |

---

## Reading your self-check results

| Number of "Yes" answers | School AI governance maturity | Recommended action |
|---|---|---|
| 14-17 items | 🟢 **Leading** | Ready to share experience with other schools; we suggest joining the ZtoA Principals' Roundtable to exchange experience |
| 9-13 items | 🟡 **Developing** | Foundations in place; we suggest focusing on the remaining "No" items and closing them within six months |
| 4-8 items | 🟠 **Exploring** | Needs systematic building; we suggest using Tool 2 to plan a 1-2 year path |
| 0-3 items | 🔴 **Beginning** | Strongly advised to start building systems as soon as possible; consider seeking professional support |

> 📌 **How to read this:** The result above is only a rough guide, not a judgement of your school's quality. The reality is far more complex than the boxes ticked; **what matters is using this result as the starting point for internal discussion**, not the end point.

---

# Tool 2 — School-based AI development reference framework

> **How to use:** This framework helps school leaders build a school-based AI development roadmap step by step over 1 to 3 years. It is organised into three dimensions and nine issues.
>
> We suggest that the principal + curriculum coordinator + IT coordinator fill it in together, marking each issue with one of three statuses: "Not started / In progress / Done". **Filling it in is itself an internal conversation.**

## Dimension 1: Institutional level (governance + compliance)

### Issue 1.1 — AI policy and guidelines

| Item | Details |
|---|---|
| **Goal** | Draw up a school-based AI use policy (first edition → reviewed and updated every school year) |
| **Owner** | Principal + IMC + school-based AI coordinator |
| **Suggested timeline** | First edition completed in Term 1 |
| **Resources** | Tool 3 of this Three-Set, "Initial recommendations for a school AI use policy"; PCPD "Artificial Intelligence: Model Personal Data Protection Framework" |
| **Current status** | ☐ Not started ☐ In progress ☐ Done |

### Issue 1.2 — Data protection and account management

| Item | Details |
|---|---|
| **Goal** | Upgrade to a Google for Education or Microsoft 365 Education account plan and enable AI modules with data protection |
| **Owner** | IT coordinator |
| **Suggested timeline** | Within Term 1 |
| **Resources** | Google for Education / Microsoft 365 Education plans; PCPD "Artificial Intelligence: Model Personal Data Protection Framework" (2024); "Checklist on Guidelines for the Use of Generative AI by Employees" (2025) |
| **Current status** | ☐ Not started ☐ In progress ☐ Done |

### Issue 1.3 — IMC resolution

| Item | Details |
|---|---|
| **Goal** | A formal resolution at IMC level on the school's position on AI use, recorded in the meeting minutes |
| **Owner** | Principal + IMC Chairperson |
| **Suggested timeline** | Within Year 1 |
| **Resources** | Relevant chapters of the Education Bureau (EDB) School Administration Guide |
| **Current status** | ☐ Not started ☐ In progress ☐ Done |

## Dimension 2: Teaching level (teachers + students)

### Issue 2.1 — Teacher AI training

| Item | Details |
|---|---|
| **Goal** | Every teacher completes at least 6 hours of AI training each school year (including in-school + external) |
| **Owner** | Curriculum coordinator + school-based AI coordinator |
| **Suggested timeline** | Ongoing |
| **Resources** | ZtoA school-based workshops; EDB teacher professional development courses; HKU / CUHK / HKBU teacher professional development centres |
| **Current status** | ☐ Not started ☐ In progress ☐ Done |

### Issue 2.2 — Building school-based AI assistants

| Item | Details |
|---|---|
| **Goal** | Build at least 3 shared AI assistants for the whole school (e.g. a parent-notice assistant, a report-comment assistant, a meeting-minutes assistant) |
| **Owner** | IT coordinator + heads of department |
| **Suggested timeline** | Completed in Year 1 |
| **Resources** | "10 Practical Teaching Prompts" toolkit for teachers (a separate ZtoA handout) |
| **Current status** | ☐ Not started ☐ In progress ☐ Done |

### Issue 2.3 — Student AI literacy curriculum

| Item | Details |
|---|---|
| **Goal** | Embed five-stage AI literacy teaching in the existing curriculum (Know → Ask → Verify → Revise → Apply) |
| **Owner** | Curriculum coordinator + subject panel heads |
| **Suggested timeline** | From Year 2 |
| **Resources** | 29 May webinar, Section 04 slides; ZtoA school-based consultation can help develop plans for integrating this into subjects |
| **Current status** | ☐ Not started ☐ In progress ☐ Done |

## Dimension 3: Cultural level (parents + community)

### Issue 3.1 — Parent micro-learning

| Item | Details |
|---|---|
| **Goal** | Send parents one AI literacy message each month (via parent WhatsApp groups / school website / Parents' Day) |
| **Owner** | Parent-Teacher Association (PTA) + Principal's Office |
| **Suggested timeline** | Ongoing from Year 1 |
| **Resources** | 12 sample topics (see the 29 May webinar, Section 05 slides); PCPD "Abuse of AI Deepfakes: Toolkit for Schools and Parents" (2025) |
| **Current status** | ☐ Not started ☐ In progress ☐ Done |

### Issue 3.2 — In-school research and sharing

| Item | Details |
|---|---|
| **Goal** | At least one in-school AI teaching workshop or sharing session each school year |
| **Owner** | Curriculum coordinator + school-based AI coordinator |
| **Suggested timeline** | Ongoing |
| **Resources** | Led by the school-based AI coordinator; ZtoA speakers can be invited |
| **Current status** | ☐ Not started ☐ In progress ☐ Done |

### Issue 3.3 — Inter-school exchange

| Item | Details |
|---|---|
| **Goal** | Exchange AI implementation experience with other schools (e.g. by joining the ZtoA Principals' Roundtable) |
| **Owner** | Principal |
| **Suggested timeline** | From Year 2 |
| **Resources** | ZtoA Principals' AI Roundtable / Hong Kong AI Professional Association (AIPPA) |
| **Current status** | ☐ Not started ☐ In progress ☐ Done |

---

## Three-year roadmap at a glance

| Period | Key tasks | Milestone |
|---|---|---|
| **Term 1** | First edition of the policy + account upgrades + IMC resolution | The whole school has stopped using personal accounts for work involving student data |
| **Year 1** | Teacher training begins + 3 school-based AI assistants go live + first notice to parents | AI use is visible in teachers' daily work |
| **Year 2** | Student AI literacy curriculum launched + monthly parent micro-learning | Students routinely declare AI use in their work |
| **Year 3** | Inter-school exchange + full policy review + second edition of the policy issued | A school-based AI culture has formed and can be shared with other schools |

---

# Tool 3 — Initial recommendations for a school AI use policy

> **How to use:** Below are model clauses for a school AI use policy. Schools may adapt the wording to their own circumstances, but we recommend including at least the following eight core clauses.
>
> ⚠️ **Important disclaimer:**
>
> This template is an **initial draft recommendation** and **does not constitute legal advice**. Before formally issuing the policy, the school **must** have it reviewed by its legal adviser (or a source of legal advice appointed by the IMC).
>
> Schools differ in their school sponsoring body, student profile, facilities and technical environment; this template can only serve as a starting point and must not be adopted wholesale.

---

## Model school AI use policy

**[School name]**
**Artificial Intelligence Use Policy**
**Date established: [Drafting date]**
**Effective date: [30 days after date established]**
**Review cycle: at least once every school year**

---

### Clause 1 — Scope

This Policy applies to all staff and students of the School, and to any person handling school affairs on its behalf. It covers all publicly and commercially available artificial intelligence tools, including but not limited to conversational AI (e.g. Gemini, ChatGPT, Claude), image-generation tools, voice-generation tools, automated assistants and AI-powered search tools.

### Clause 2 — Use of accounts

When handling work related to school affairs, staff of the School shall use only school-issued AI accounts with education- or enterprise-grade data protection. **Personal accounts must not be used for any work involving students' personal data, non-public school information or commercially confidential information.**

### Clause 3 — Protection of students' personal data

No member of staff shall enter personally identifiable data such as students' names, HKID numbers, student numbers, health conditions, family backgrounds, academic results, behaviour records or counselling records into any AI tool that does not provide education-grade data protection.

Where such data must be entered to complete teaching or administrative work, a school-issued account with a corresponding level of protection must be used; where this is not strictly necessary, real names should be replaced with codes (Student A, Student B, etc.).

### Clause 4 — Teachers' responsibilities when using AI

Any content a teacher produces with AI tools (including but not limited to lesson plans, worksheets, report comments, notices and reports) **must ultimately be professionally reviewed and revised by the teacher, who remains responsible for it.** AI-generated drafts must not be issued to students or parents without the teacher's review.

For written communications involving disciplinary action, counselling cases or requests made of parents, AI-generated drafts must be reviewed personally by the vice-principal or principal before they are sent.

### Clause 5 — Rules for students' use of AI

Students using AI tools at school must follow the specific instructions of their subject teachers. When students use AI tools to help with homework, reports or projects, they must indicate the extent of AI use as required by the teacher (e.g. "AI helped with brainstorming", "AI helped with grammar checking", "Fully drafted by AI, rewritten by me"), and must be able to explain their own thinking process orally in class.

### Clause 6 — Home-school communication

Where AI is used to help write communications to parents (notices, replies, reports), **the teacher concerned must review the full text before it is sent**, confirming that the content is accurate, the tone is appropriate and there are no facts fabricated by AI.

Communications involving disciplinary action, sensitive cases or requests made of parents **must not be sent on the basis of an AI draft alone**; they must be reviewed by three parties: the class teacher + the head of discipline or guidance + the vice-principal / principal.

### Clause 7 — Handling of breaches

Breaches of this Policy by staff will be handled in accordance with the School's existing personnel policies. Breaches by students (e.g. improper use of AI to complete homework without indicating it as instructed) will be handled under the School's existing academic integrity policy; first breaches will be handled mainly through education and guidance.

### Clause 8 — Amendment and commencement

This Policy is established jointly by the Principal and the Incorporated Management Committee (IMC) and will be reviewed at least once every school year. It may be amended at any time in the event of significant changes in AI technology or in relevant Education Bureau (EDB) guidelines. This Policy takes effect 30 days after the date of the resolution; this period is used for whole-school staff training and for notifying parents.

---

## Suggested process for issuing the policy

| Step | Action | Time needed |
|---|---|---|
| 1 | Principal + school-based AI coordinator complete the first draft | 1 week |
| 2 | Seek legal or advisory opinions within the school | 1 to 2 weeks |
| 3 | IMC review | 1 month (depending on the meeting schedule) |
| 4 | Share at a staff meeting + collect feedback | 2 weeks |
| 5 | Formal resolution after revision | 1 IMC meeting |
| 6 | Within 30 days of the resolution: staff training + notifying parents | 1 month |
| 7 | Policy formally takes effect | — |
| 8 | Annual review | Once per school year |

---

## Companion actions (recommended to be issued together with the policy)

### Accompanying notice to parents (template)

> **Subject:** Arrangements for the use of AI teaching tools at our school
>
> **Dear Parents,**
>
> To help our students become responsible learners with sound judgement in the AI era, the school will designate the following AI tools as curriculum support tools from [date] and introduce them into lessons step by step:
>
> [List of tools and their uses]
>
> **Our commitments to parents:**
>
> 1. All AI accounts used by students are issued by the school and have education-grade data protection; what students enter will not be used for model training.
> 2. Before using AI, teachers will explain to students the context of use, its limits and their responsibilities.
> 3. For work completed with AI, students will clearly indicate on their homework at which step(s) AI tools were used.
> 4. The school has drawn up an AI use policy and will present it to you in full on Parents' Day.
>
> If you have any questions about the AI tools, you are welcome to join the AI-themed sharing session at the next Parents' Day, or to contact your child's class teacher directly.
>
> Yours faithfully,
> **[Principal's signature]**

### Accompanying notice to all staff

> **Subject:** Our AI Use Policy formally takes effect — important notice
>
> Dear teachers and administrative colleagues,
>
> Following the IMC resolution of [date], the school's AI Use Policy will formally take effect on [effective date]. Please complete the following preparations before that date:
>
> 1. **Read the full policy carefully** — the full text is attached; please finish reading it by [date]
> 2. **Check your accounts** — if you are still using a personal AI account for school work, please contact [IT coordinator] to switch to a school-issued account
> 3. **Attend training** — a 60-minute briefing will be held on [date + time]; attendance is compulsory
> 4. **Consultation** — please email any questions or suggestions about the policy to [school-based AI coordinator] by [date]
>
> Our aim is not to restrict teachers' innovation, but to let us use AI tools with greater confidence on a compliant and secure footing.
>
> Thank you for your cooperation.
>
> **[Principal's signature]**

---

# Closing thoughts — AI is unstoppable; Human in the Loop is always at the core

AI's entry into schools is an irreversible trend. The key choice for school leaders has never been "embrace or resist", but "what stance to take as we enter this transformation".

Every checklist, framework and clause in this Three-Set ultimately serves one basic belief:

> **Human in the Loop — no matter how advanced AI becomes, final judgement, responsibility and decisions about values always remain in human hands.**

This principle matters especially for schools. We are dealing not with corporate employees but with students who are minors; not with business clients but with parents who have entrusted their children to us. On that basis:

- AI is an extension of teachers' professionalism, not a replacement for it;
- AI is a tool for administrative efficiency, not the decision-making itself;
- AI is a helper in students' learning, not the driver of it.

What schools need to do today is not to build a flawless AI policy, but to take the first step — making sure that in every scenario where AI is used, a clearly identifiable "human" stands at the final checkpoint.

| When | Action |
|---|---|
| Review after one year | Have the foundations of account governance been laid? |
| Refine after two years | Has a student AI literacy curriculum been embedded? |
| Establish after three years | Has it become part of the school's culture? |

This is the real homework of school governance in the AI era.

**Perfectionism is the enemy of compliance.** Get a first version out, then keep revising; let the whole school know first, then train in depth; lay the foundations of account governance first, then pursue teaching innovation. That is how to bring AI into school responsibly and sustainably.

---

# Further support

**School-based consultation:** If your school needs support with AI policy-making, seeking legal advice, teacher training or parent talks, please contact ZtoA MasterAI Academy on WhatsApp +852 6285 0456 to arrange a school-based consultation.

**Principals' AI Roundtable:** A principal-level exchange forum co-organised by ZtoA and the Hong Kong AI Professional Association (AIPPA). If you are interested in taking part, please contact ZtoA.

**Reference links:**

- ZtoA MasterAI Academy: [academy.ztoagroup.com](https://academy.ztoagroup.com)
- ZtoA Group main site: [ztoagroup.com](https://ztoagroup.com)
- PCPD, "Artificial Intelligence: Model Personal Data Protection Framework" (2024)
- PCPD, "Checklist on Guidelines for the Use of Generative AI by Employees" (2025)
- PCPD, "Abuse of AI Deepfakes: Toolkit for Schools and Parents" (2025)

---

## About ZtoA MasterAI Academy

ZtoA Group has **20 years of cross-sector experience**, serving more than **200 government departments, leading universities, international brands and social welfare organisations**:

- **Government and public bodies:** ICAC, Home Affairs Bureau, Constitutional and Mainland Affairs Bureau, Correctional Services Department, Highways Department, Hong Kong Productivity Council (HKPC), Vocational Training Council (VTC), Employees Retraining Board (ERB), Hong Kong Housing Society, Hong Kong Tourism Board
- **Academic institutions:** HKU, CUHK, CityU, HKBU, HKU School of Public Health (LKS Faculty of Medicine), Hong Kong Shue Yan University
- **International brands:** P&G, Pandora, AXA, Amway, Microsoft, Hitachi, Tommy Hilfiger, Four Seasons, Dragonair
- **Local and international accreditation:** AI certificates awarded in partnership with HKUST and the University of Sunderland (UK)
- **Founded by us:** AIPPA, the Hong Kong AI Professional Association (Founding President: Kenny Tang)

**Promoting wider access to AI education across three continents over the past three years:** Cambodia (2023), Africa and the UK (2025), Hong Kong (2026 Q1)

---

> **© 2026 ZtoA Group · MasterAI Academy.** This Three-Set is distributed free of charge to participants of the 29 May webinar and the leadership teams of their schools, as a reference for policy-making. **This template does not constitute legal advice**; before a school formally issues its AI policy, it must be reviewed by a legal adviser.