Madlen
Sign In

Alignment statement

DfE Generative AI Product Safety Standards

This alignment statement sets out how Madlen, an AI copilot for teachers, aligns with the Department for Education's Generative AI: Product Safety Standards. It gives schools and multi-academy trusts the assurance they need to adopt Madlen with confidence. Madlen is teacher-facing, and pupils do not interact with it. Its tools are designed to work without pupil personal data, and no feature needs a pupil's name, contact details or identification number.

  • Meets all 8 DfE standards for teacher-facing tools
  • Teacher-facing product
  • A-Level · GCSE · IB · and more
  • UK and EU data hosting

A teacher-only copilot, built for safety by design

Madlen supports teachers with lesson planning, curriculum-aligned content and reporting for A-Level, GCSE, IB and more. It drafts rubric-based marks and feedback on pupils' work, which the teacher reviews and decides. Every output is a draft that a teacher reviews, edits, and approves before it reaches a classroom.

Madlen is not a pupil-facing product. It has no open, free-form chat for pupils and no pupil accounts. This architectural choice means many of the risks the DfE's standards are designed to manage, such as inappropriate content or open-ended pupil interaction, are removed by design rather than mitigated after the fact.

Executive summary

Madlen has been assessed against all 13 standards in the DfE's Generative AI: Product Safety Standards. Five of them apply only to learner-facing products, so as a teacher-facing tool Madlen meets the eight that apply. Our alignment rests on three pillars.

Safety by design

No pupil-facing surface and no open generation for pupils. Whole categories of risk the standards address do not arise, rather than being managed after the fact.

Human oversight

Every output is a draft a teacher reviews, edits, and approves before it reaches a classroom. Madlen supports the work; the teacher decides.

Transparency and governance

Published policies, a Data Processing Agreement for every school, and a named contact for data protection questions.

Summary alignment with the 13 DfE standards

Standards 3, 4, 10, 11 and 12 apply to learner-facing products. Madlen is teacher-facing, so they do not apply, and the notes below explain why. The full statement, with detailed evidence for every standard, is available on request.

  • 1

    Stated purpose

    An AI copilot for teachers, covering lesson planning, curriculum-aligned content, rubric-based draft marks and feedback on pupils' work uploaded by teachers, and reporting across key stages 1 to 5 (ages 5 to 18), including GCSE, A-Level and IB. Not a pupil-facing product.

    Met
  • 2

    Educational use cases

    Content creation and delivery, assessment and analytics, digital assistant, and administrative and management (report writing). Teachers plan and prepare, and pupils do not use Madlen.

    Met
  • 3

    Filtering

    No pupil-facing chat or open generation. Every output is a curriculum-grounded draft a teacher reviews and approves before use.

    Not applicable
  • 4

    Monitoring and reporting

    School administrators see teacher usage through the school dashboard, with audit logging of AI use.

    Not applicable
  • 5

    Security

    Encryption in transit (TLS) and at rest (AES-256), role-based access controls, and single sign-on via Microsoft Entra ID and Google Workspace, so the school's own password and multi-factor authentication rules apply. Teacher data is hosted in the UK and EU. Security is tested internally every quarter, with additional tests when needed. New models and versions are tested before release, and the tools have safeguards against attempts to make them produce prohibited content. A model-agnostic architecture avoids single-vendor lock-in.

    Met
  • 6

    Privacy and data protection

    Designed to work without pupil personal data, and teachers are asked to remove names before uploading work. Madlen does not connect to the school's management information system. On a school plan, the school is the controller and Madlen is the processor under a Data Processing Agreement. No data is used to train AI models.

    Met
  • 7

    Intellectual property

    Teachers' content and pupils' work uploaded for marking are not used to train AI models or to develop the product. Content is kept for as long as the account exists, and access and erasure requests are supported.

    Met
  • 8

    Design and testing

    Safety by design, with no pupil-facing generation. Co-designed with teachers and tested across subjects and key stages, and each new model or version is checked against the same tests before release.

    Met
  • 9

    Governance

    A data protection lead and a safeguarding lead, with board oversight. Concerns about AI output can be reported to privacy@madlen.io, and they are acknowledged within 3 working days and resolved within 10.

    Met
  • 10

    Cognitive development

    Pupils do not use Madlen. It supports teachers, who direct learning. Madlen produces drafts for a teacher's judgement; it does not complete pupils' work.

    Not applicable
  • 11

    Emotional and social development

    Out of scope by design. No pupil-facing interaction, no avatar, no relationship with pupils.

    Not applicable
  • 12

    Mental health

    Out of scope by design. No pupil-facing interaction.

    Not applicable
  • 13

    Manipulation

    No advertising, no dark patterns and no engagement-maximising mechanics. AI output is written in a neutral style, without flattery or overstated confidence, and plan limits and upgrade options are stated plainly. A professional tool for teachers.

    Met

Regulations we follow

The legal frameworks that apply to Madlen for UK schools.

UK-GDPR

Met

Personal data is processed under UK-GDPR, following data minimisation and purpose limitation, and the tools are designed to work without pupil personal data. A Data Processing Agreement is signed with every school before onboarding.

EU AI Act

Not high-risk under Article 6(3)(d)

The Act lists AI that evaluates learning outcomes as high-risk (Annex III, 3(b)), but Article 6(3)(d) excludes AI that performs a preparatory task to an assessment. Madlen drafts a suggested mark and feedback on work uploaded without pupils' names. The teacher reviews, changes and decides every mark, and only the teacher shares results with pupils.

KCSIE and safeguarding

Met

Madlen supports teachers in their safeguarding responsibilities and does not monitor, profile, or make decisions about pupils.

WCAG 2.2 AA

Met

Madlen is built to meet WCAG 2.2 AA accessibility standards and is checked with automated accessibility testing.

Your data, AI and security

The questions in the DfE's guidance on procuring EdTech, answered for Madlen.

AI and your data
Is our data used to train AI models?
No. We do not use prompts, uploads or outputs to train AI models, and neither do the AI providers we work with. This applies to every account. It is not a setting a school has to find and turn off.
How are AI outputs checked?
Every output is a draft. A teacher reviews, edits and approves it before it reaches a classroom, and Madlen never sends anything to pupils on its own. AI outputs can still be inaccurate or incomplete, which is why the teacher stays in charge.
How do you reduce errors and bias?
Outputs are grounded in the curriculum, and new tools are co-designed with teachers and tested internally before rollout. Madlen makes no decisions about pupils and does not monitor, profile or rank them.
What controls does our school have?
Administrators see teacher usage through the school dashboard, with audit logging of AI use. Staff sign in with Microsoft Entra ID or Google Workspace, so your own access and multi-factor authentication policies apply. Your school is the controller, and we act only on its documented instructions.
Should teachers enter pupil information?
There is no need to. Madlen's tools are designed to work without pupil personal data, and no feature needs a pupil's name, contact details or identification number. Teachers may still include information about a pupil in what they write or upload, such as a name at the top of a piece of work. We ask teachers to remove names before uploading and to use initials or a pseudonym where a reference is needed.
Hosting and security
Where is our data stored?
Data is hosted in the UK and the European Union, which the UK recognises as providing adequate protection, and our AI providers process it in their UK and EU regions. Some supporting service providers, and our group company in Turkey, process data outside the UK and the EU. Those transfers are covered by the ICO's International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or UK adequacy regulations.
Who processes data on our behalf?
Service providers for hosting, AI models, sign-in, email, analytics, support and payments. We name each one in our sub-processor list, which schools receive with the Data Processing Agreement.
How is data protected?
Data is encrypted in transit with TLS and at rest with AES-256. Access to personal data is limited to staff who need it for their role. We test our security internally every quarter, with additional tests when needed, and the findings are remediated.
What happens if there is a data breach?
On a school plan we tell your school within 24 hours of becoming aware of a breach, so it can meet its own 72-hour duty to report to the ICO. Where the law requires it, we also report breaches to the ICO ourselves.
Retention and contracts
How long do you keep data?
Your data is kept for as long as the account exists. Deletion requests are completed within 30 days, and on a school plan we act on your school's instructions. Deleted data leaves our backups within the normal backup cycle.
What happens when our contract ends?
Your school's data is deleted or returned, as the Data Processing Agreement sets out. Records we must keep by law, such as invoices, are kept for the period the law requires.
Can you help with our DPIA?
Yes. Email privacy@madlen.io and we will send the Data Processing Agreement, our sub-processor list and our answers to the DfE's EdTech questions. We also complete security questionnaires for schools and trusts.

Request the full alignment statement

For your DPIA and due diligence, we send schools these documents on request.

  • Data Processing Agreement
  • Sub-processor list
  • Answers to the DfE's EdTech questions
  • Completed security questionnaires
Request the documents

This page avoids operational details that would undermine security. For additional due diligence, signed copies or security questionnaires, email our data protection contact at privacy@madlen.io.

Madlen supports teachers in their safeguarding responsibilities and does not monitor or profile pupils.

Page last reviewed: October 2026

Get the latest from Madlen

Don't miss what's new

By subscribing you agree to receive emails from Madlen. You can unsubscribe at any time. See our Privacy Notice.

Request a demo

Let us show you Madlen. Leave your details and our team will be in touch.