AI tool summary for DPOs and governors

Moodle (AI subsystem)

Moodle HQ / your institution's host · Facts last checked 2026-10-23 · Printed 23 October 2026

AI Prefect

Staff: Amber · Use with caution

Training depends on plan or settings
Processor/controller role depends on how it is used
Data may be stored outside the UK/EU; safeguards not stated

Pupils: Amber · Use with caution

Training depends on plan or settings
Processor/controller role depends on how it is used
Data may be stored outside the UK/EU; safeguards not stated

Supplier	Moodle HQ / your institution's host
Category	learning platform (VLE)
Pupil-facing	depends - admins control by role
Processor or controller	institution configures the AI provider (OpenAI or Azure OpenAI); provider terms apply
Where data is stored	depends on the provider your institution connects
Trains AI models on inputs	depends on provider - Azure OpenAI does not train on prompts
How long inputs are kept	not stated
Data processing agreement (DPA)	not stated
Signs individual DPAs with schools	not stated
UK GDPR representative / DPO	not stated
Minimum age	not stated
Key safety note	AI providers are disabled by default; users accept an AI usage policy on first use; risk depends entirely on how your Moodle is configured
Main use	VLE and learning platforms

Better-rated alternatives for the same use: Aula (Amber), D2L Brightspace (Lumi) (Amber), Gemini in Google Classroom (Amber)

Before using it: check the minimum age fits your pupils, confirm a data processing agreement is in place, switch off AI training where possible, and record the decision in your DPIA.

Sources: https://docs.moodle.org/500/en/AI_providers · https://moodle.com/us/news/taking-your-first-ai-steps-about-api/
Full entry: aiprefect.co.uk/tools/moodle. Rating is a rules-based summary of the supplier’s published terms. “Not stated” means we could not find it in their documents. This is not legal advice and does not replace your DPIA.