ChildSafe AI — Children's Digital Safety Compliance Demo

📊 ICO “Edtech Examined” · 28 Providers Audited · June 2026

The ICO audited 28 EdTech providers.

0%

misidentified their data controller role — acting as controller without obligations

0%

published privacy notices too vague for schools or parents to understand

0%

could not prove AI training & analytics data use was fair or authorised

596

recommendations issued — but only after the ICO intervened

ChildSafe AI gives EdTech providers a clear, structured view of where they stand — and a prioritised path to close every gap.

📁 Project View — All Documents

EduVault Platform Compliance Review · Q3 2026

🔴 43/100 — RED overall Consolidated Statutory DPIA Consolidated UNCRC CRIA 23 critical findings

Document	Score	Status	DPIA Mapped	CRIA Mapped
Privacy Notice v2.3PDF · EdTech	42%	Critical	✓	✓
Terms of ServicePDF · EdTech	61%	Review	✓	✓
Cookie PolicyHTML · EdTech	38%	Critical	✓	✓
Data Sharing AgreementDOCX · EdTech	55%	Review	✓	✓
SchoolPortal DSA 2025DOCX · Schools	29%	Critical	✓	✓

▶ This walkthrough steps through the Privacy Notice v2.3 assessment end to end — RAG report, DPIA, roadmap, CRIA, certificate and audit log. ⓘ Hover over the What’s happening? button in the bottom bar at any step for a plain-English guide to each output.

🏘 The regulatory journey that made this necessary

2020

UK Children's Code — 15 age-appropriate design standards, championed by 5Rights Foundation & enforced by the ICO

2021

UNCRC General Comment No. 25 — children’s rights extended to the digital environment for the first time

Sept 2026

UNESCO Digital Learning Week — 25+ education ministers demand AI certification before classroom access

2026

EU KIDS Act — reversed burden of proof · companies must prove safety before children access their products

Now
ChildSafe AI — structured assessment across all of these frameworks, generating evidence of compliance in under 2 minutes

📄

EduVault Privacy Notice v2.3.pdf

PDF · 284KB · Uploaded 18 Sept 2026 · EdTech Platform · Primary & Secondary Schools

✓ SELECTED

🔍 Auto-detected document properties

Document Type

Privacy Notice

Assessed Entity

EduVault Ltd

Jurisdiction

🇬🇧 United Kingdom

Document Length

12 pages · ~4,200 words

Child-Directed Service

⚠ YES — indicators detected

Reading Age

⚠ Year 10+ — above recommended

📋 Frameworks: UK GDPR · ICO Children's Code 📊 Clauses: 48 ⏱ Est. time: <2 minutes

✓ UK GDPR · 11 Articles ✓ ICO Children's Code · 15 Standards ✓ UNCRC GC25 Digital Rights

🇬🇧 UK GDPR · 11 Articles

Art. 5 · Data principles

Art. 6 · Lawful basis

Art. 8 · Child consent

Art. 12 · Rights information

Art. 13 · Transparency

Art. 17 · Right to erasure

Art. 22 · Automated decisions

Art. 25 · Privacy by design

Art. 28 · Processors

Art. 32 · Security

Role · Controller classification

🇬🇧 Children's Code · 15 Standards

Std. 1 · Best interests

Std. 2 · Data sharing

Std. 3 · Nudge techniques

Std. 4 · Detriment assessment

Std. 5 · Parental controls

Std. 6 · Default settings

Std. 7 · Data minimisation

Std. 8 · Data sharing

Std. 9 · Geolocation

Std. 10 · Profiling

Std. 11 · Transparency

Std. 12 · Connected toys

Std. 13 · Online tools

Std. 14 · Parental monitoring

Std. 15 · Commercial profiling

🇪🇺 ACTIVE REGULATORY INTEGRATION • COM(2026) 681

EU KIDS Act & EU AI Act 2024: Published 17 Sept 2026. ChildSafe AI is already engineered to evaluate EdTech platforms against the new reversed burden of proof and algorithmic safety-by-design standards before children encounter them.

48 clauses assessed in this walkthrough · 10 total regulatory frameworks supported

DUAA 2025Online Safety ActKCSIE 2024Digital Services Act✓ UNCRC Digital GC25EU AI Act 2024SEND✓ EU KIDS Act COM(2026) 681

AI Scanning EduVault Privacy Notice v2.3…

0 / 48 clauses

0 critical

0 warnings

🇬🇧 UK GDPR — Article Assessment

🇬🇧 ICO Children's Code — Standards

🔴 Live Findings & AI Recommendations

Scanning…

Compliance Assessment Report

EduVault Privacy Notice v2.3 · 2 frameworks · 48 clauses · 18 Sept 2026

Clause distribution

7 Critical 5 Warnings 4 Compliant

0%

AMBER

Overall
Compliance

UK GDPR

0%

⚠️ Requires Attention

ICO Children's Code

0%

🔴 Critical — Urgent Action

🔴 Critical Findings — UK GDPR

Role

Controller/processor misclassification — acting as data controller without fulfilling legal obligations

RED

Art. 8

No age verification mechanism — children’s consent threshold not addressed

RED

Art. 13

Privacy notice uses adult-level language — not accessible to children or parents

RED

Art. 22

AI learning analytics not disclosed — automated decision-making not addressed

🔍 Inspect Clause

RED

🔴 UNDISCLOSED AI PROCESSING • EVIDENCE EXTRACT

EduVault-PN-v2.3 §7.1

📄 Exact Document Clause Extracted:

“Section 7.1 (Research & Analytics): We reserve the right to process pupil engagement telemetry and response velocities through third-party neural prediction models to dynamically calibrate educational pathways and progress reports.”

⚖️ Statutory Non-Compliance:

🇬🇧 UK GDPR Art. 13 & 22 (Automated Decision-Making) 🇪🇺 EU AI Act 2024 (High-Risk AI in Education • Transparency) 🇪🇺 EU KIDS Act Art. 8 (Pre-Deployment Evidence)

✅ Mandatory Remediation:

➤ Disclose AI tutoring sub-processors, conduct an Article 35 DPIA for algorithmic models, and publish plain-English explanation for parents and pupils.

Art. 5

Data minimisation unclear for behavioural analytics — 14 categories, 9 justified

AMBER

Art. 28

2 of 5 processors listed without contractual reference or DPA confirmation

AMBER

Art. 32

Encryption, access controls and security measures adequately described

GREEN

🔴 Critical Findings — ICO Children's Code

Std. 3

Nudge techniques not assessed — gamification and reward loops present

RED

Std. 6

Default settings enable profiling for children under 13 — must be disabled by default

🔍 Inspect Clause

RED

🔴 CRITICAL STATUTORY BREACH • EVIDENCE EXTRACT

EduVault-PN-v2.3 §4.3

📄 Exact Document Clause Extracted:

“Section 4.3 (Personalised Recommendations): 'By default, pupil interaction telemetry, time-on-task velocities, and response patterns are continuously processed to automatically calibrate personalized curriculum pathways for every registered learner.'”

⚖️ Statutory Non-Compliance:

🇬🇧 ICO Children's Code Std. 6 (Default Settings) 🇬🇧 ICO Children's Code Std. 12 (Profiling) 🇬🇧 UK GDPR Art. 22 (Automated Profiling) 🇪🇺 EU Kids Act Art. 8 (Reversed Burden of Proof)

✅ Mandatory Remediation Action:

➤ Reconfigure system defaults so algorithmic profiling is OFF by default for all pupils under 16. Implement verified parental consent mechanism before recommender models are enabled. (Roadmap Item #2).

Std. 10

Behavioural profiling for performance tracking without parental consent mechanism

RED

Std. 11

Transparency notice not age-appropriate — reading level exceeds Year 10

RED

Std. 1

Best interests partially addressed but not formally documented

AMBER

Data Protection Impact Assessment (DPIA)

Statutory Assessment under UK GDPR Article 35 & ICO Children's Code · EduVault Privacy Notice v2.3

3

Critical Statutory Risks

2

High Priority Risks

5

Mitigations Required

1. Scope & Sub-Processors

2. Necessity (3-Part Test)

3. Risk Evaluation (5 Identified)

4. Mitigations Envisaged

5. DPO Advice & Sign-Off

📌 1. Description of Processing & Data Flow Architecture

EduVault processes student performance telemetry, behavioural analytics, device usage patterns, and teacher assessment logs for curriculum personalisation. Data flows: Student Devices → EduVault UK Servers → 5 Sub-Processors. Special Category Data Alert: Implicit learning difficulty and cognitive distress markers are derived from response patterns, triggering enhanced Article 9 safeguards.

🔄 Audited Sub-Processors & Data Residency

AWS eu-west-2 (UK)✓ Compliant

Cloud Infrastructure · UK Data Residency confirmed · ISO 27001 verified

AnalyticsIQ Ltd🔴 No DPA

Telemetry & Behavioral Micro-Metrics · Article 28 Agreement Missing

LearnerGraph Inc🔴 No DPA

Knowledge Recommender · Article 28 Agreement Missing · Profiling risk

SendGrid (Twilio)✓ Compliant

Parent Guardian Email Relays · Standard Contractual Clauses in place

⚖️ 2. Necessity & Proportionality — ICO 3-Part Balancing Test

Lawful basis claimed: Legitimate Interests (Art. 6(1)(f)). ChildSafe AI automated audit verifies the three statutory limbs required by the ICO:

✓ Purpose Test (Passed)

Platform maintains legitimate educational aim in delivering adaptive curriculum sequences to registered schools.

⚠️ Necessity Test (Deficient)

14 data categories collected; 5 categories are disproportionate (hardware GUIDs, social graph metrics, typing velocity).

🔴 Balancing Test (Failed)

Children's fundamental right to privacy overrides commercial analytics; lack of parental consent invalidates Art. 6(1)(f).

🔴 3. Statutory Risk Assessment — 5 Article 35 Breaches Identified Click any risk to inspect analysis

CRITICAL

Profiling of under-13s enabled by default — contravenes Children's Code Standard 6 and UNCRC Article 16. Immediate suspension of default profiling required.

📊 Inherent Risk Evaluation

Likelihood: Definite (100% of accounts) · Severity: Critical (Severe impact on child rights).
Children are subjected to automated behavioral tracking without verified parental knowledge.

⚖️ Statutory Non-Compliance & Mitigation

Violates ICO Children's Code Std. 6 and UK GDPR Art. 21. Reconfigure defaults to profiling: false and gate with parental consent.

✓ Post-Mitigation Residual Risk: LOW · Default disabled, zero profiling without parental opt-in.

CRITICAL

Undisclosed AI automated decision-making (Art. 22) — algorithmic recommendations steer curriculum pacing with no right to explanation or teacher override.

📊 Inherent Risk Evaluation

Likelihood: High · Severity: Critical.
Automated grading algorithms influence academic placement without human verification.

⚖️ Statutory Non-Compliance & Mitigation

Violates UK GDPR Art. 22(1) and EU AI Act (High-Risk Education Tier). Publish Art. 22 disclosure and provide teacher human-in-the-loop override.

✓ Post-Mitigation Residual Risk: LOW · Human teacher oversight mandatory on all grading recommendations.

CRITICAL

Unlawful sub-processor data sharing — AnalyticsIQ Ltd and LearnerGraph Inc. process children's telemetry without Article 28 data processing addendums.

📊 Inherent Risk Evaluation

Likelihood: Active (Continuous processing) · Severity: Critical (Regulatory enforcement risk).
Vendors could re-use pupil data for model pre-training.

⚖️ Statutory Non-Compliance & Mitigation

Violates UK GDPR Art. 28(3). Execute standard addendum prohibiting secondary commercial use.

✓ Post-Mitigation Residual Risk: NEGLIGIBLE · Art. 28 DPAs legally executed and archived.

HIGH

Language accessibility failure — privacy disclosures exceed Year 10 reading level; pupils and parents cannot give informed consent.

📊 Inherent Risk Evaluation

Likelihood: Certain (Flesch-Kincaid Grade 10.4) · Severity: High.
Informed consent legally invalid under Art. 7(2).

⚖️ Statutory Non-Compliance & Mitigation

Violates Children's Code Std. 11. Publish Year 7 child-friendly summary with icons.

✓ Post-Mitigation Residual Risk: LOW · Readability verified at Year 6 reading age.

HIGH

Absence of age verification gate — pupils under 13 can register without verified school-to-parent authorization tokens.

📊 Inherent Risk Evaluation

Likelihood: Probable · Severity: High.
Contravenes Article 8 UK GDPR child consent threshold.

⚖️ Statutory Non-Compliance & Mitigation

Deploy date-of-birth gate requiring school-authenticated guardian email token before activation.

✓ Post-Mitigation Residual Risk: NEGLIGIBLE · Under-13 accounts hard-gated.

🛡️ 4. Risk Mitigation Measures Envisaged (Article 35(7)(d))

1

Disable profiling by default: Telemetry default set to OFF for all pupils under 16 pending verified parental consent.

2

Publish child-friendly privacy notice: Max reading age 12, visual icon-based summary, just-in-time notices.

3

Article 22 AI disclosure: Plain-English explanation of recommendation logic + guaranteed human teacher override.

4

Execute processor DPAs: Art. 28 agreements for AnalyticsIQ Ltd and LearnerGraph Inc prohibiting secondary usage.

5

Age verification gateway: DOB gate with verified parental consent flow for pupils under 13.

✍️ 5. DPO Consultation & Sign-Off Gate (UK GDPR Art. 35(2))

⚖️ Statutory DPO Consultation Requirement

“The controller shall seek the advice of the data protection officer when carrying out a DPIA.” — UK GDPR Art. 35(2).
This draft DPIA is scheduled for verification via the Human-in-the-Loop Certification Gate in Step 8.

90-Day Remediation Roadmap & Recovery Simulator

Dynamic compliance recovery engine · EduVault Privacy Notice v2.3 · Base Score: 43/100

⚡ INTERACTIVE COMPLIANCE RECOVERY SIMULATOR

Simulate 90-Day Remediation Trajectory

Baseline Score

43/100

🔴 High Risk

➞

Projected Recovery

43/100

🔴 0/10 Resolved

Recovery Gain: +0 pts 10 Critical Violations Active

Day 0 (43) Day 30 (76) Day 60 (89) Day 90 (96 ✅)

👉 Interactive Workflow: Click any action card to mark it resolved, or click [Simulate Days 1–30] to watch the compliance score climb. Click [Playbook] on any item for operational guidance and draft contract clauses.

🔴 Phase 1 · Days 1–30 Statutory Breach Mitigation

0/5 Resolved · Target: +33 pts

✓

1

Controller/processor analysis 🇬🇧 UK GDPR Art. 37 👤 DPO / Legal ⏱ 7 Days +7 pts

Establish correct controller/processor classification — appoint DPO and document statutory obligations under Art. 37.

⚙️ Operational Implementation Steps

1. Conduct data flow mapping to prove whether EduVault determines purposes/means of learning telemetry.
2. Formally register named DPO contact with the ICO.
3. Publish designated DPO contact details in privacy notice footer.

📋 Recommended Contract / Policy Clause

“EduVault Ltd acts as Data Controller under UK GDPR Art. 4(7) for direct pupil accounts, with designated Data Protection Officer reachable at dpo@eduvault.co.uk.”

✓

2

Disable profiling by default 🇬🇧 Children's Code Std. 6 ⚙️ Engineering ⏱ 3 Days +8 pts

Suspend default behavioural profiling for all users under 16 pending verified parental consent mechanism.

⚙️ Operational Implementation Steps

1. Update user schema default: profiling_enabled: false for all users under 16.
2. Decouple core learning module access from recommendation telemetry.
3. Implement verifiable parental consent toggle before enabling.

📋 Recommended Contract / Policy Clause

“Section 4.3 (Defaults): Automated learning recommendations and behavioural profiling are disabled by default for all registered pupils under 16, in compliance with Standard 6 of the Age Appropriate Design Code.”

✓

3

Publish child-friendly privacy notice 🇬🇧 Children's Code Std. 11 📝 Product & UX ⏱ 10 Days +6 pts

Rewrite transparency disclosures at maximum reading age 12 with icon-based summary and clear language.

⚙️ Operational Implementation Steps

1. Commission plain-English rewrite tested against Flesch-Kincaid Grade 6 readability benchmark.
2. Add visual icons for data types (Homework, Login times, Teacher feedback).
3. Provide an interactive “Just-in-Time” explainer when pupil features launch.

📋 Recommended Policy Text

“Pupil Summary: We only save your school answers so your teacher can see how you are doing. We never sell your info or share it with advertisers.”

✓

4

Disclose AI analytics & human oversight 🇬🇧 UK GDPR Art. 22 ⚙️ AI / ML Team ⏱ 5 Days +7 pts

Art. 22 disclosure statement + guaranteed right to explanation and human teacher override for automated decisions.

⚙️ Operational Implementation Steps

1. Publish plain-language disclosure detailing model training data, inputs, and confidence scoring.
2. Add a “Request Human Teacher Review” button on all AI recommendation cards.
3. Log teacher overrides in the audit database.

📋 Recommended Policy Text

“EduVault uses algorithmic models to assist revision sequencing. Pupils and parents have the right under UK GDPR Art. 22(3) to obtain human teacher intervention and contest any automated learning pathway.”

✓

5

Implement age verification gate 🇬🇧 UK GDPR Art. 8 🔒 SecOps / Identity ⏱ 7 Days +5 pts

Implement date-of-birth verification gate with verified parental consent flow for pupils under 13.

⚙️ Operational Implementation Steps

1. Integrate date-of-birth capture before credential generation.
2. Block autonomous account creation for under-13s without verified school-to-parent token.
3. Maintain immutable consent records in GDPR Art. 8 verification ledger.

📋 Recommended Policy Text

“Accounts for learners under 13 require parental authorization verified via school-authenticated email tokens prior to account activation, in compliance with Article 8 UK GDPR.”

⚠️ Phase 2 · Days 30–60 Governance & Sub-Processors

0/3 Resolved · Target: +13 pts

✓

6

Execute processor DPAs 🇬🇧 UK GDPR Art. 28 👤 Legal Counsel ⏱ 14 Days +5 pts

Execute Art. 28-compliant data processing agreements with AnalyticsIQ Ltd and LearnerGraph Inc.

⚙️ Operational Implementation Steps

1. Send standard Art. 28 DPA addendum prohibiting commercial re-use or secondary model training on pupil data.
2. Require annual SOC 2 / ISO 27001 audit certificates from both vendors.

📋 Recommended Contract Clause

“Processor covenants that pupil telemetry will not be aggregated, anonymised for external sale, or utilized for generative model training without explicit written controller authorization.”

✓

7

Document Legitimate Interests Assessment (LIA) 🇬🇧 UK GDPR Art. 6(1)(f) 👤 DPO ⏱ 7 Days +4 pts

Formalize 3-part Legitimate Interests Assessment (Purpose, Necessity, Balancing) for core educational analytics.

⚙️ Operational Implementation Steps

1. Complete ICO 3-part balancing test.
2. Document reasonable expectations of children and parents.
3. File signed LIA in ChildSafe AI compliance ledger.

📋 Recommended Policy Text

“Processing of essential session reliability logs is conducted under Article 6(1)(f) UK GDPR pursuant to a formal Legitimate Interests Assessment reviewed and approved by the DPO on 22/09/2026.”

✓

8

Remove 5 unjustified data categories 🇬🇧 Children's Code Std. 7 ⚙️ Data Eng ⏱ 5 Days +4 pts

Decommission collectors for device hardware IDs, social graph telemetry, and micro-session metrics.

⚙️ Operational Implementation Steps

1. Deprecate client-side telemetry hooks for MAC address, hardware UUID, and keystroke timing.
2. Purge historical records from PostgreSQL telemetry tables.
3. Verify database schema against data minimisation audit checklist.

📋 Recommended Audit Evidence

“Telemetry Schema Change Log v2.4: Removed hardware_guid, wifi_bssid, typing_speed_ms from active ingest pipeline. Database purge executed 24/09/2026.”

✓ Phase 3 · Days 60–90 Continuous Assurance & Audit

0/2 Resolved · Target: +7 pts

✓

9

DPIA for AI tutoring module 🇬🇧 UK GDPR Art. 35 🛡️ AI Governance ⏱ 10 Days +4 pts

Produce standalone DPIA for generative AI tutoring feature prior to classroom deployment.

⚙️ Operational Implementation Steps

1. Generate targeted Article 35 DPIA using ChildSafe AI assessment engine.
2. Submit for human-in-the-loop qualified DPO verification.
3. Provide DPIA summary to partner School Trust data governance committees.

📋 Recommended Audit Evidence

“Article 35(1) DPIA completed for EduVault AI Tutor v1.0. Human-in-the-loop sign-off certified by David Anderson, CIPP/E, CIPM (Data Protection Officer) on 28/09/2026.”

✓

10

Schedule annual Children's Code audit 🛡️ Governance & Audit 👤 Qualified DPO ⏱ 7 Days +3 pts

Establish annual audit cadence with named DPO and tamper-evident cryptographic audit trail.

⚙️ Operational Implementation Steps

1. Schedule 12-month recurring assessment in ChildSafe AI.
2. Archive signed compliance package in school procurement portal.
3. Bind audit certificate hash to public ledger.

📋 Recommended Audit Evidence

“Annual Audit Cadence Registered. Next scheduled review: September 2027. Audit Log Hash: SHA-256 e8b32... verified.”

Child Rights Impact Assessment (CRIA)

Statutory evaluation under UNCRC General Comment No. 25 (2021) · Digital Environment · EduVault Privacy Notice v2.3

🔴 2 Critical Violations (Art. 6 & 16)

⚠️ 4 Attention Required

✓ 3 Compliant

👁 Show All 9

🔐

Article 16: Right to Privacy

Protection Against Unlawful Profiling & Data Exploitation

🔴 CRITICAL BREACH 18% Score

📖 UNCRC General Comment 25 Standard

“No child shall be subjected to arbitrary or unlawful interference with their privacy. GC25 explicitly extends this protection to automated profiling, predictive tracking and algorithmic surveillance in digital learning environments.”

⚠️ Identified Platform Practice & Detriment

EduVault captures task velocities and continuous behavioural engagement metrics by default without verified parental consent, generating persistent profiles that infringe children's digital autonomy.

✓ Mandatory Rights-Based Safeguarding Remediation

➤ Reconfigure system defaults so all profiling is OFF by default for under-16s. Implement age-appropriate privacy transparency summaries and remove commercial telemetry processors. (Mapped to Roadmap Action #2).

🛡️

Multi-Academy Trust (MAT) & School Governance Relevance: Under DfE Keeping Children Safe in Education (KCSIE) and UNCRC General Comment 25, Designated Safeguarding Leads (DSLs) and school governors have a positive duty of care to ensure educational software does not undermine children's fundamental rights. A CRIA score below 60% requires formal escalation and mitigation prior to school renewal.

Compliance Certificate & Qualified DPO Sign-Off

Generating tamper-evident audit record…

🏆 STATUTORY ASSURANCE LEVEL: HIGH 🖊️ UK GDPR ART. 35 & 38 VALIDATED

✓ IAPP REGISTERED DPO Qualified Lead Reviewer Credential Verification

Data Protection Officer

David Anderson

Professional Credentials

IAPP CIPP/E (Europe) · CIPM (Management)

IAPP Registry Token

IAPP-UK-2024-91823 · Active

Statutory Independence

✓ UK GDPR Art. 38(3) Direct Board Reporting

🏆

ChildSafe AI Compliance Certificate

Tamper-evident · Qualified Human-in-the-Loop Verified · Privacomply Ltd

✅ DPO SIGNED & SEALED ID: CSA-2026-09-18-0042

Overall Statutory Score

46% / 100

⚠️ Action Plan Mandated

Statutory Findings

7 RED · 5 AMB

Mitigated via 90-Day Plan

HITL Verification Gate

12 / 12 Confirmed

✓ 0 Overridden by DPO

Assessment ID

CSA-2026-09-18-0042

Target Document

EduVault Privacy Notice v2.3

Target Organisation

EduVault Ltd

Frameworks Assessed

UK GDPR · ICO Children's Code · UNCRC GC25

Clauses Assessed

48 clauses · 26 standards · 9 child rights

Assessment Timestamp

18 Sept 2026 · 09:41:51 UTC

Qualified Reviewer

D. Anderson · DPO · IAPP CIPP/E, CIPM · Awaiting PIN authorization

Remediation Roadmap

18 Dec 2026 · 90-day tracker active

SHA-256 Hash

a7f3c219b4e56d8af01c39d8b5e2a714c8f9204b3d67e18a5bc92f0174d3e801

⏳

Awaiting Mandatory HITL Reviewer Sign-Off

Verifying reviewer credentials…

What this certificate evidences
Every AI-generated finding has been reviewed and confirmed by the qualified HITL reviewer before this certificate was issued. The SHA-256 hash makes it tamper-evident — any modification produces a different hash, immediately detectable by the ICO, an auditor, or a procurement panel. This is the verifiable due diligence record the EU KIDS Act reversed burden of proof requires EdTech providers to hold.

Cryptographic Audit Log & Chain of Custody

Immutable statutory evidence ledger · Assessment CSA-2026-09-18-0042 · ISO/IEC 42001 & DfE Algorithmic Transparency Aligned

01 · SOURCE INGEST 📄

Source PDF SHA-256

7b8e1f29…d8a4

EduVault Privacy Notice v2.3

➤

02 · RULE ENGINE ⚖️

Model & Ruleset v2.6

3c90a12e…b5f1

48 UK Statutory Clauses

➤

03 · HITL DPO SIGN-OFF 🖊️

Ed25519 Signature

privacomply-dpo-da

D. Anderson (CIPP/E, CIPM)

➤

04 · MERKLE ROOT 🔑

Sealed Block Hash

a7f3c219…e801

Block Height: #1,842 · Sealed

⚙️

Regulator Tamper-Evidence Simulator:

Verify how ChildSafe AI mathematically detects unauthorized alterations to findings or ratings

privacomply-audit-node-01: /var/log/childsafe/csa-2026-09-18.ledger · SHA-256 Event Stream

TLS 1.3 W3C VC

📜 W3C Verifiable Credential · Cryptographic JSON-LD Manifest

{
  "@context": [
    "https://www.w3.org/2018/credentials/v1",
    "https://privacomply.co.uk/schemas/childsafe-v2.jsonld"
  ],
  "id": "urn:uuid:csa-2026-09-18-0042",
  "type": ["VerifiableCredential", "ChildSafeComplianceAssessment"],
  "issuer": "did:privacomply:uk-dpo-registry:km-iapp-cipp",
  "issuanceDate": "2026-09-18T09:41:51Z",
  "credentialSubject": {
    "organization": "EduVault Ltd",
    "targetDocument": {
      "filename": "EduVault Privacy Notice v2.3.pdf",
      "sha256": "7b8e1f29d385fa801b69c4a8d052d1928374a58b9012f38491823758d8a4"
    },
    "assessmentResults": {
      "overallComplianceScore": 46,
      "riskRating": "AMBER_REQUIRES_ACTION",
      "findings": { "criticalRed": 7, "warningsAmber": 5, "compliantGreen": 4 },
      "dpiaStatutoryRisks": 5,
      "criaUNCRCArticles": 9,
      "hitlVerifiedBy": "D. Anderson (Lead DPO, IAPP CIPP/E, CIPM)"
    }
  },
  "proof": {
    "type": "Ed25519Signature2020",
    "created": "2026-09-18T09:41:51Z",
    "verificationMethod": "did:privacomply:keys:dpo-da#key-1",
    "proofPurpose": "assertionMethod",
    "jws": "eyJhbGciOiJFZERTQSI...a7f3c219b4e56d8af01c39d8b5e2a714c8f9204b3d67e18a5bc92f0174d3e801"
  }
}

🔐

Statutory Audit Trail Compliance: Under ISO/IEC 42001 (Artificial Intelligence Management Systems) Standard A.7.4 and the UK Central Government Algorithmic Transparency Recording Standard (ATRS), educational institutions must maintain verifiable traceability of automated decisions affecting children. ChildSafe AI's cryptographic ledger satisfies Section 106 evidentiary standards for the ICO and Ofsted.

Complete Compliance Package & Stakeholder Dossier

One automated assessment generates five distinct statutory deliverables tailored for regulators, school trustees, and engineering teams

👁 Master Governance Dossier (All 5)

🏛 ICO & Regulatory Pack

🏫 MAT Trustees & DSL Safeguarding Pack

💻 EdTech Vendor Dev Pack

One-Click Governance Dossier Export:

Compile all 5 deliverables + W3C JSON-LD Manifest into a cryptographically sealed archive

Initializing bundle compilation…

📊 UK GDPR · ICO CC

Statutory Compliance Assessment

Comprehensive RAG evaluation across 15 Children's Code standards & EU KIDS Act COM(2026) 681.

Scope: 48 statutory clauses evaluated · 7 Critical (RED) · 5 Warnings (AMBER)

Detailed clause-by-clause legal analysis with statutory cross-references, reading age analysis (Flesch-Kincaid Year 10 breach), and recommended policy text rewrite.

View HTML ↗ PDF ↗

📝 Article 35 UK GDPR

Statutory Article 35 DPIA

Pre-populated Data Protection Impact Assessment identifying high-risk processing operations.

Scope: 5 high-risk processing hazards · Sub-processor registry (2 DPA gaps) · Balancing test

Evaluates data minimisation, sub-processor cross-border data residency (AWS Ireland, AnalyticsIQ US, LearnerGraph US), and DPO Article 38 consultation mandates.

View HTML ↗ PDF ↗

👶 UNCRC GC25

Child Rights Impact Assessment (CRIA)

Statutory evaluation against 9 rights under UN Convention on the Rights of the Child General Comment 25.

Scope: 9 treaty rights · 2 critical violations (Art. 6 & 16) · Best interests determination

Maps automated algorithmic struggle detection detriment to Article 6 (Development) and continuous behavioural telemetry tracking to Article 16 (Privacy & Digital Sanctuary).

View HTML ↗ PDF ↗

🗺️ 90-Day Remediation

Compliance Recovery Roadmap

Prioritised, phased engineering and governance milestones to achieve full compliance certification.

Scope: 10 technical actions · 3 sprint phases (30/60/90 days) · +53 pts projected gain

Contains concrete operational remediation playbooks for age gating, profiling opt-out toggles, Article 28 vendor addendums, and pupil feedback dispute workflows.

View HTML ↗ PDF ↗

🏆 HITL Certified

Compliance Certificate & Proof

Tamper-evident assurance credential signed by qualified Lead DPO with SHA-256 block hash.

Scope: Certificate CSA-2026-09-18-0042 · IAPP CIPP/E, CIPM verified · Merkle block sealed

Cryptographically anchors assessment outputs into an immutable evidence block satisfying the EU KIDS Act reversed burden of proof and ISO/IEC 42001 Standard A.7.4.

View HTML ↗ PDF ↗

🛡️

Multi-Academy Trust (MAT) & Procurement Officer Protection: Under Crown Commercial Service (CCS) Framework RM6103 and DfE Digital Standards, school business leaders and Multi-Academy Trust accounting officers are personally accountable for vendor due diligence. ChildSafe AI's Complete Compliance Package provides the auditable due diligence defense required to approve or condition software procurement without legal exposure.

📚 Statutory Evidentiary Library & Authoritative Sources

15 primary legal instruments, regulatory sandbox filings, and peer-reviewed benchmark reviews underpinning ChildSafe AI

No matching citations found for your filter.

🎓 LSE & 5RIGHTS FOUNDATION • AUGUST 2026 BENCHMARK REVIEW ⭐ Primary Catalyst

LSE Research Online ePrint: 140815

Artificial Intelligence and Children’s Rights: A Narrative Review of the Evidence

Smera Jayadeva & Professor Sonia Livingstone OBE · Digital Futures for Children centre (LSE & 5Rights Foundation)

“Child rights impact assessments (CRIAs) and human rights due diligence make abstract commitments auditable, measurable and transparent... Governance remains reactive where it must become preventive before a system reaches children.”

📖 Read on LSE Research Online ↗ 📥 Download Full Report (.pdf) ↗ ✓ Direct academic foundation for ChildSafe AI’s automated CRIA engine

🇬🇧 UK Legal & Regulatory Framework 7 Sources

🔍ICO EdTech Examined Audit 2026⭐ Catalyst↗

ICO · Systemic audit of 28 providers · 596 recommendations · Direct catalyst for ChildSafe AI

🔭ICO Tech Futures: Agentic AI — Innovation OpportunitiesSTRATEGY↗

ICO · Dec 2025 · Benchmarks, auditing & explainability for AI agents — ChildSafe AI addresses 4 of the 6 opportunities identified

👤ICO Children's Code (Age Appropriate Design Code)UK LAW↗

ICO · 15 standards for online services likely accessed by children · Core framework

🏭UK GDPR & Data Protection Act 2018UK LAW↗

legislation.gov.uk · Primary data protection legislation underpinning all statutory DPIAs · Art. 35 & 38

📊Data (Use and Access) Act 2025UK LAW↗

UK Parliament · Reforms to automated decision-making safeguards, digital verification, and intermediary registries

🔒Online Safety Act 2023UK LAW↗

legislation.gov.uk · Ofcom codes of practice · Child safety duties and age assurance mandates

🏫Keeping Children Safe in Education (KCSIE) 2024GUIDANCE↗

Department for Education · Statutory safeguarding guidance governing school digital filtering, monitoring, and MAT accounting officer liability

🇪🇺 EU, International & Research 7 Sources

🧠EU AI Act 2024 (Regulation 2024/1689)EU LAW↗

European Union · High-risk educational AI classification · Transparency, human oversight, and Article 14 HITL gates

💻Digital Services Act (Regulation 2022/2065)EU LAW↗

European Union · Direct platform obligations to protect minors, ban targeted behavioral profiling, and eliminate dark patterns

🌟EU KIDS Act — Safety-by-Design 2026EU LAW↗

European Commission COM(2026) 681 · Reversed burden of proof · Mandatory pre-market independent certification

🌐UNCRC General Comment No. 25 (2021)INTERNATIONAL↗

UN Committee on the Rights of the Child · Extends 54 treaty articles into the digital sphere · Core basis for ChildSafe AI CRIA

☝5Rights FoundationCIVIL SOCIETY↗

Baroness Beeban Kidron · Childhood Redrawn campaign · Leading global advocacy for digital safety-by-design standards

🎓25+ Countries Call for AI Certification Before ClassroomsRESEARCH↗

5Rights Foundation · UNESCO Digital Learning Week 2026 · 25+ education ministers call for certified AI assurance before classroom deployment

🏛ICO Regulatory SandboxENGAGEMENT↗

PrivaComply has submitted a formal Expression of Interest · Active correspondence with the ICO Sandbox Innovation Team

🛡️

Statutory Admissibility & Evidentiary Rigor: All 15 frameworks and benchmark reviews are continuously indexed and cryptographically bound to each assessment output. Outputs conform with Section 106 evidentiary standards of the Data Protection Act 2018 and the UK Central Government Algorithmic Transparency Recording Standard (ATRS).

🏆 Ready to explore live deployment or request an executive briefing?

Review full operational deployment, pilot parameters, and Lead DPO certification credentials.

ⓘ ChildSafe AI is not affiliated with any of the regulatory bodies or NGOs listed. Links open primary authoritative sources directly.

🏆 Demonstration Complete — ChildSafe AI is Available for Live Deployment

Conduct full-portfolio statutory assessments across your software products, school procurement tenders, or policy documents in under 2 minutes

🏆

Demonstration Complete — ChildSafe AI is Available for Live Deployment

Conduct full-portfolio statutory assessments against your own software products, school procurement tenders, or policy documents in under 2 minutes — backed by cryptographic audit proofs and Lead DPO certification.

▶ Launch Live Assessment ✉ Request Executive Briefing 📖 Full Walkthrough Guide ↗ 📥 Download Sample Pack (.pdf)

👤 David Anderson, CIPP/E, CIPM (Data Protection Officer)

·

🏛 Privacomply Ltd · Registered in England & Wales

·

✉ admin@privacomply.co.uk

📚 Grounded in 15 Primary Statutory & Academic Authorities

Every assessment output complies with Section 106 DPA 2018 evidentiary standards and draws directly upon the August 2026 LSE / 5Rights Benchmark Review by Prof. Sonia Livingstone OBE.