Assessed in full. Published with the gaps.
Designed against all thirteen. Evidenced on the one component far enough along to assess, gaps left where they are.
Version 0.2, published 26 August 2026. Last reviewed 23 September 2026. This mapping has not yet had independent review, and we say so rather than imply it has.
2 met
7 in development
4 not applicable
Section 01
Summary and scope
An honest account of where the marking component stands today, before the standard-by-standard detail.
This page carries two different things, and it keeps them apart on purpose. The whole Aevum family is designed against all thirteen DfE generative AI product safety standards, and further down we set out that design intent standard by standard. Only one component, Teacher Manager’s marking component, is far enough along to be assessed, so only that component has an assessed position, published with its gaps.
Design intent is not evidence. An assessed result is not a certification either: the DfE standards are not a certification scheme, and responsibility for assurance sits with the supplier, which is us. Where we have measured something we say what we measured. Where we have only designed for it, we say that instead, and we do not soften a partial line into a full one.
Aevum Teaching Manager is teacher-facing. It helps a teacher do the work and it does not replace the teacher’s judgement, and pupils do not log in to it. Aevum Learn, the pupil-facing tutor, is a separate product with its own assessment, published when it ships. The four learner-facing standards, Filtering, Cognitive development, Emotional and social development, and Mental health, apply to that tutor in full. This page assesses only the teacher-facing marking component, where those four are not present. The tutor is assessed separately, and that assessment is not yet published.
One line we never blur-sm: “no training on your data” is not the same as “no training”. Aevum trains a shared base model itself, before any customer arrives, on curated, licence-clean data, never on pupils’ or teachers’ work. What learns from a school’s use is a local configuration, and the data stays in the building with you.
- Scope
- Aevum Teacher Manager — marking component
- DfE use case
- 1 — Content creation and delivery; 3 — Assessment and analytics
- Facing
- Teacher-facing. Pupils do not log in to it.
- Assessed against
- DfE standards as updated 19 January 2026
- Last reviewed
- 23 September 2026
- Fully met
- evidence exists and supports the claim
- Not applicable
- not accessible to pupils, so the concern does not apply here
- In development
- some evidence, and a named gap
What we can evidence today
| Standard | Applies | Status |
|---|---|---|
| 01Stated purpose | Yes | In developmentproduct version identifier outstanding |
| 02Educational use cases | Yes | Fully met |
| 03Filtering | No | Not applicabledesigned out here; applies to the Learn tutor, assessed separately. |
| 04Monitoring and reporting | Partly | In developmentevery mark is auditable; retention and report format outstanding |
| 05Security | Yes | In developmentred-team report outstanding; our weakest applicable standard |
| 06Privacy and data protection | Yes | In developmentDPIA published |
| 07Intellectual property | Yes | Fully metsubject to contract wording |
| 08Design and testing | Yes | In developmenthuman-gold and real-classroom testing outstanding |
| 09Governance | Yes | In developmentindependent review and complaints route outstanding |
| 10Cognitive development | No | Not applicabledesigned out here; applies to the Learn tutor, assessed separately. |
| 11Emotional and social development | No | Not applicabledesigned out here; applies to the Learn tutor, assessed separately. |
| 12Mental health | No | Not applicabledesigned out here; applies to the Learn tutor, assessed separately. |
| 13Manipulation | Yes | In developmentanti-sycophancy engines built, measurement outstanding |
01Stated purpose
Applies: Yes
In development
product version identifier outstanding
In development, product version identifier outstanding02Educational use cases
Applies: Yes
Fully met
Fully met03Filtering
Applies: No
Not applicable
designed out here; applies to the Learn tutor, assessed separately.
Not applicable, designed out here; applies to the Learn tutor, assessed separately.04Monitoring and reporting
Applies: Partly
In development
every mark is auditable; retention and report format outstanding
In development, every mark is auditable; retention and report format outstanding05Security
Applies: Yes
In development
red-team report outstanding; our weakest applicable standard
In development, red-team report outstanding; our weakest applicable standard06Privacy and data protection
Applies: Yes
In development
DPIA published
In development, DPIA published07Intellectual property
Applies: Yes
Fully met
subject to contract wording
Fully met, subject to contract wording08Design and testing
Applies: Yes
In development
human-gold and real-classroom testing outstanding
In development, human-gold and real-classroom testing outstanding09Governance
Applies: Yes
In development
independent review and complaints route outstanding
In development, independent review and complaints route outstanding10Cognitive development
Applies: No
Not applicable
designed out here; applies to the Learn tutor, assessed separately.
Not applicable, designed out here; applies to the Learn tutor, assessed separately.11Emotional and social development
Applies: No
Not applicable
designed out here; applies to the Learn tutor, assessed separately.
Not applicable, designed out here; applies to the Learn tutor, assessed separately.12Mental health
Applies: No
Not applicable
designed out here; applies to the Learn tutor, assessed separately.
Not applicable, designed out here; applies to the Learn tutor, assessed separately.13Manipulation
Applies: Yes
In development
anti-sycophancy engines built, measurement outstanding
In development, anti-sycophancy engines built, measurement outstanding
Two fully met, four met by design, seven in development. None yet evidenced to the point where an unqualified conformance claim would be honest.
Four standards are met by design. Filtering, cognitive development, emotional and social development, and mental health govern risks that only arise when a pupil uses a product directly. The marking component is not accessible to pupils, so those concerns are removed by design rather than managed. They apply in full to the Learn tutor, which is pupil-facing and assessed separately, and that assessment is not yet published.
Source: Department for Education, Generative AI: product safety standards, published 22 January 2025, updated 19 January 2026. Crown copyright, Open Government Licence v3.0.
Section 02
Each standard in full. Including the named gap.
Open any row for what the DfE expects, our position, and — where one exists — the gap we have not yet closed.
01Stated purposeIn development
What the DfE expects
A clear statement of intended purpose and use cases, including the target demographic and SEND status, and the learning focus. Purpose is reviewed when features change. Suppliers must not exaggerate capability, and claims must be supported by evidence.
Aevum's position
Teacher Manager's marking component is teacher-facing, part of an assistant for UK schools: planning, differentiating, resourcing, and the paperwork around them. Pupils do not log in to the marking component. It drafts; the teacher decides. We publish what it must not be used for as plainly as what it is for. It is not a safeguarding system, not a counsellor, and not a replacement for a teacher's judgement.
Named gap
The published product version identifier. A purpose statement without a version cannot be checked against a build, so a reader cannot tell which one this describes.
Design intent across the family
States each product's purpose and users plainly, and designs the learner-facing tutor SEND-first, for symbol-supported communication (AAC) users, as its primary frame rather than a footnote. Every public claim is tied to checkable evidence; we do not pre-announce capabilities or dates, and “designed to, being tested” is stated as exactly that until a measurement exists.
02Educational use casesFully met
What the DfE expects
Developers select their intended use cases from the DfE's list of eight, make them clear to users, educators and purchasers, and provide sufficient evidence that the product satisfies its stated purpose.
Aevum's position
Use case 1, content creation and delivery, and use case 3, assessment and analytics. Aevum Teacher Manager is not a digital assistant, not a research or writing aid, not a learner-engagement surface, and not an administrative tool. Selecting fewer is the honest act, because every use case claimed is a set of obligations accepted.
Design intent across the family
Teacher Manager maps to content creation and delivery, assessment and administration; the learner-facing tutor maps to personalised learning and accessibility, and digital assistant, with learner engagement as a bounded, moderated element; the operations layer maps to analytics and administration, applied to evidence a school already holds.
03FilteringNot applicable
What the DfE expects
A learner-facing standard. Filtering embedded in the product that reliably prevents users generating or accessing harmful or inappropriate content, sustained across a conversation, adjusted for age and for SEND, effective across languages and modalities, and maintained on personal devices.
Aevum's position
This standard does not apply to the marking component. No pupil interacts with the marking component, so there is no conversational surface a child can reach and nothing to filter at the point of use.
Why it does not apply
No pupil uses the marking component. What we still carry is a related risk the standard does not cover here: the tool drafts material a teacher may put in front of a class. The control is that a teacher reviews everything before it reaches a pupil. Adversarial testing of what the tool generates sits under Security and under Design and testing, not here.
Design intent across the family
The learner-facing tutor is a closed, curriculum-grounded system rather than an open-internet chatbot: it does not free-roam the web or free-generate unvetted content, which removes whole categories of risk by construction. Filtering is designed to adjust to the learner's profile and hold throughout a session. Evidence at trial.
04Monitoring and reportingIn development
What the DfE expects
A learner-facing standard. Activity logging of prompts and responses, alerts to local supervisors when harmful content is accessed or a safeguarding disclosure is made, capture and confirmation of the school's Designated Safeguarding Lead, real-time age-appropriate notification to the user, and reports on access and trends that a non-specialist can read.
Aevum's position
The safeguarding-alert machinery is scoped to products a pupil uses. The marking component has no pupil user to alert, no session to time, and no disclosure channel to monitor. We do not claim that machinery and a school should not expect it from the marking component. What is met in substance is reportability: what the tool produces carries its reasoning with it, so a teacher or a school leader can see why a suggestion was made rather than trusting a black box.
Named gap
Retention periods, and the format of reports for a school leader. Logging anything about children creates its own duty under Privacy and data protection, and the two have to be answered together rather than each solved alone.
Design intent across the family
Aevum keeps a full, auditable record by design, the same record that lets a teacher inspect the reasoning behind an answer. Safeguarding-lead capture, real-time notifications, alert routing and readable reporting are committed learner-facing features; we will not claim them live until they are.
05SecurityIn development
What the DfE expects
The product is secured against malicious use, prioritising reliability, security and robustness under unexpected conditions and adversarial attack. This includes resistance to jailbreaking, prevention of unauthorised modification, permission levels for different users, prompt patching, testing of new versions before release, authentication, and compatibility with the Cyber Security Standards for Schools and Colleges.
Aevum's position
Running on the school's own hardware changes the threat model rather than removing it. There is no central store of school data for anyone to breach, which is a better starting position than most. The exposure moves instead to the device, the model artefact, and the update channel, and those are the things we have to secure.
Named gap
This is our weakest applicable standard and we would rather say so than bury it. Outstanding: jailbreak resistance measured rather than asserted; model artefact integrity and protection against unauthorised modification; permission levels and authentication in the product shell; a documented patching cadence; and a stated position against the Cyber Security Standards for Schools and Colleges. Our security overview page tracks this work.
Design intent across the family
Local-first and on-premise-capable, so the most sensitive data need never leave the building. Role-based permissions, tested releases, encryption in transit and at rest, least-privilege access and audit logging are designed in. Full evidence, including penetration testing, is published as products reach trial.
06Privacy and data protectionIn development
What the DfE expects
Compliance with UK GDPR and the Data Protection Act 2018. A clear privacy notice in age-appropriate language, presented at intervals. A Data Protection Impact Assessment during development and across the product's life cycle. Workable controller and processor responsibilities. Compliance with the ICO's Children's code. No personal data used for commercial purposes, including further training or fine-tuning, without a confirmed lawful basis.
Aevum's position
Children's work is personal data. Aevum Teacher Manager is built to run on the school's own hardware, so the default is that it never reaches us at all. We do not train on customer data, which is a narrower claim than 'we do not train', and we make the narrower one because it is the true one: Aevum trains a shared base model on curated material before any school sees it, and the learning that happens on your hardware stays there. Because a model that has learned from personal information is itself a kind of record, we treat it accordingly.
Named gap
The DPIA is published as a working draft at /trust/dpia, and it is late against the DfE's during-development expectation, which we say rather than hide. What remains outstanding is independent review and sign-off, the age-appropriate privacy notice, the controller and processor split written down, retention periods, and our published position on whether a locally post-trained model is itself personal data.
Design intent across the family
Data is local-first and not processed outside the UK by default; the shared model is never trained on customer data. A DPIA is published for the marking component, and a further DPIA is committed for each learner-facing module before trial. Erasure of a person's or a source's influence is a research commitment, not a shipped mechanism, and we say so on the DPIA page.
07Intellectual propertyFully met
What the DfE expects
The product must not store, collect or use intellectual property created by learners, teachers or the copyright owner for commercial purposes such as training or fine-tuning, unless the copyright owner consents, or their parent or guardian where the owner is a child. For teachers, the copyright owner is likely to be their employer.
Aevum's position
This is the standard we are strongest on, and the answer is architectural rather than contractual. Work is processed on the school's own hardware and is not collected by us, so there is no route by which a pupil's or a teacher's work could enter a training set. Beyond what the standard asks, a licence firewall governs what may enter any Aevum corpus at all, in three tiers enforced in code: training-clean material we hold the rights to use, evaluation-only material we may measure against but never train on, and quarantined material we may not use until permission is confirmed.
Named gap
The commitment has to be written into the school contract in terms a data protection officer can rely on. An architectural guarantee that is not in the contract is a promise rather than a commitment. Tracked on our Data Processing Agreement page.
Design intent across the family
Aevum trains its shared model only on licence-clean data, before any customer arrives, never on pupils' or teachers' work and never on scraped exam papers. Local adaptation happens on the school's hardware, under the school's lawful basis, and is never harvested for Aevum's commercial model. Prompts and outputs remain the school's.
08Design and testingIn development
What the DfE expects
Transparency and children's safety prioritised in design, including child-centred design and operation, technical and operational mitigations for identified risks, sufficient testing with a diverse and realistic range of users and use cases, testing of new versions before release, and consistent performance as intended.
Aevum's position
The design principle is to decide deterministically whatever can be checked by computation, and reserve the model for genuine judgement, routing anything uncertain to the teacher rather than guessing. Accessibility is a first-principles design question here rather than a late addition, because Aevum is designed by a neurodivergent founder with lived experience of disability. We report our negative results, and the most recent one corrected an earlier version of this page. We had said that a fine-tune trained on synthetic handwriting performed worse on real pupil handwriting than the model we started with. Measuring it properly showed something less flattering and more useful. The base model does not win on faithfulness, it declines the task: across sixty-one pages of children's writing it produced three edit markers and reproduced one of a hundred and four real revisions. Character error rate, the usual measure, structurally rewards a model for not annotating at all, which is why the original comparison looked like a win. When we built a measure that counts invented edits rather than missing ones, every model we tested failed it, including one four times larger: around nine in ten of the crossings-out they reported were not on the page. So we have not shipped edit annotation. The marking tool transcribes faithfully and tells the teacher when a page appears to carry revisions, without claiming to know which words they are. A flag that is sometimes unnecessary costs a teacher ten seconds. An invented crossing-out puts a mistake in a child's record that the child never made. We publish this because the standard asks for evidence, not for good news, and because the corrected version is the more useful finding.
Named gap
Testing with a diverse and realistic range of users means real teachers in real classrooms, and the honest answer today is that we have tested the system, not the deployment. Also outstanding: agreement with human markers measured on human-marked work, and a fairness audit disaggregated by group with SEND as the primary axis. Also outstanding: the same measurement for insertions rather than crossings-out, where no public benchmark exists at all, and a version of the test with paired controls, the same page with and without an edit, since a model has to be right on both to have shown it is reading the page rather than the prompt.
Design intent across the family
Aevum is designed so every answer shows its working: the source it drew on, the reasoning, and the conclusion. The learner-facing tutor is SEND-first, which is child-centred by construction. Testing with a diverse, realistic range of users, including SEND learners, is published at trial.
09GovernanceIn development
What the DfE expects
The product is operated with accountability: a clear risk assessment for every product, a formal complaints mechanism setting out how safety issues are escalated and resolved quickly, and published policies and processes governing AI safety decisions.
Aevum's position
Our safety case is the risk assessment. It is structured as a narrow, scoped claim broken into sub-claims, each carrying both its evidence and the arguments against it, because a case that only supports itself is advocacy rather than assurance. It is versioned and updated whenever a model, a policy, a mitigation or an incident changes, so it is post-market monitoring rather than a launch artefact.
Named gap
Independent review, which is a house rule on the ground that an assurance case is not self-marked. A formal complaints mechanism with a named route and a resolution timescale. And publication of the safety policies themselves, which today exist as internal working documents rather than published policy.
Design intent across the family
Named accountability (Aevum Foundry AI Ltd, hello@aevumfoundry.ai), a risk assessment per product, a complaints and escalation route, and published safety positions. Because Aevum's answers are inspectable, its decision-making is unusually legible to a school or a regulator. Independent review is outstanding.
10Cognitive developmentNot applicable
What the DfE expects
A learner-facing standard, and one of four added in January 2026. Products should mitigate cognitive deskilling: no full solutions or complete worked examples by default, progressive disclosure starting with hints, prompting the learner to attempt a step first, friction before switching between coaching and answer-giving modes, detection and reporting of cognitive offloading, expert oversight, and a published child-development impact plan.
Aevum's position
This standard does not apply to the marking component.
Why it does not apply
No pupil uses the marking component. One honest note, because the concern behind the standard is a real one: it is aimed at products that hand learners finished answers and erode the work of thinking. The marking component hands drafts to a teacher, who decides what a child sees, so the mitigation here is the teacher rather than the architecture. Any future release that puts material in front of a pupil directly re-opens this, and it would need progressive disclosure designed in rather than added as a setting.
Design intent across the family
This describes how the learner-facing tutor is designed to teach: Socratic by design, scaffolding and withholding the full answer until there has been a real attempt. Progressive disclosure is the default rather than a setting. Offload tracking, the reporting surface and the published expert-oversight and impact records are committed.
11Emotional and social developmentNot applicable
What the DfE expects
A learner-facing standard added in January 2026. Products must not be anthropomorphised or imply emotion, consciousness, personhood or agency. No I-statements or personas outside bounded pedagogical roleplay. No cultivating personal relationships or eliciting emotional disclosure. Default time limits with hard limits a learner cannot bypass, resettable only by a teacher. Monitoring of emotional disclosure, with notification to the Designated Safeguarding Lead.
Aevum's position
This standard does not apply to the marking component.
Why it does not apply
There is no persona, no session to limit, and no child on the other side of the conversation. We are not going to claim conformance with a standard governing risks the marking component does not create.
Design intent across the family
Aevum is decision-support, not a companion: every product leaves the human deciding. The learner-facing tutor uses function-based framing, keeps interactions task-bounded, points learners back to teachers and peers, and includes usage limits and healthy-use prompts. It does not use engagement-maximising mechanics, and we deliberately do not build a personhood avatar.
12Mental healthNot applicable
What the DfE expects
A learner-facing standard added in January 2026. Products should detect signs of learner distress, including crisis patterns, references to mental health conditions, mentions of suicide or self-harm, night-time usage spikes and isolation phrasing. They should follow a tiered response, signposting to age-appropriate support and raising a safeguarding flag. Response language must be non-validating and non-pathologising and must always direct the learner to human help. Developers should involve child mental health expertise and publish a crisis protocol.
Aevum's position
This standard does not apply to the marking component.
Why it does not apply
No pupil uses the marking component, so there is no learner whose distress it could detect or mishandle. The marking component is a planning tool, not a safeguarding system and not a counsellor. Where a safeguarding matter is in scope it signposts to the school's own people and processes, and does not attempt to handle it itself.
Design intent across the family
Distress-signal detection with a tiered, human-in-the-loop response and safeguarding escalation is a committed feature, designed with appropriate expertise, with a published crisis protocol. The tutor signposts to a trusted adult first, then age-appropriate support, once and clearly, without pretending to be a counsellor. Being closed and task-bounded, it avoids the open-ended companion dynamic these rules target.
13ManipulationIn development
What the DfE expects
Applies to learner and teacher-facing products, and was added in January 2026. Products must not use manipulative or persuasive strategies, including sycophancy and flattery, deceiving or misleading the user, portraying absolute or unjustified confidence, applying social conformity pressure, stimulating guilt or fear, threatening loss or punishment, or promising inappropriate rewards. Nor exploit users through engagement-prolonging design, steering towards paid options, blending assistance with promotional content, or dark patterns.
Aevum's position
Two limbs of this bind a teacher-facing tool, and they are where our research meets a regulatory duty directly. Unjustified confidence: a tool that states something wrong with confidence is precisely the failure the standard names, and our answer is calibration, where the confidence attached to a judgement decides whether it stands or goes to the teacher. Sycophancy: a tool that changes its answer because someone pushed back is sycophancy, and we build probes designed to catch exactly that drift. On exploitation, there is nothing to disclose because there is nothing there: no engagement-maximising design, no advertising, no dark patterns, no upsell surfaces. We carry no advertising and sell no attention, because the school is the customer rather than the product.
Named gap
The measurements on the served product. The probe engines exist and are tested; the published results do not exist yet, and a calibration curve rather than a single operating point is still to come. One instance of unjustified confidence is now measured rather than anticipated. Asked to mark a pupil's crossings-out, our models reported edits that were not there, in well-formed and entirely convincing notation, which is exactly the failure this standard names and the reason the feature is withheld.
Design intent across the family
Aevum's products are ad-free by design and do not sell attention: no countdowns, streak anxiety or weekly engagement nudges. Anti-sycophancy is built into the marking engine, and the system shows its evidence and declines or escalates rather than guessing. Measurement of that behaviour is published at trial.
Design-intent key
- Designed in the architecture already reflects the standard; it is a design decision, not yet an assessed result.
- Committed a feature or document we have promised and not yet built.
- At trial evidence published when the relevant product reaches trial.
Each row also shows our design intent for the whole family. That is intent, not evidence: where it disagrees with the assessed status, the assessed status is the one that counts.
Where Aevum goes beyond the baseline
- Aevum trains its own model on UK national research infrastructure (Dawn, the AIRR supercomputer at the University of Cambridge), on licence-clean data. Not a wrapper on someone else's model.
- Local-first, data in the building: the strongest available answer to the privacy, data-residency and security standards.
- Answers that show their working: source, reasoning and conclusion on every answer.
- Research into removing a person's or a source's influence with evidence, rather than retraining the whole model. Research, not a shipped mechanism.
What we will publish as products reach trial
Completed DPIAs, learner-facing first; independent penetration-test results; expert-oversight records and the child-development impact plan for the learner-facing tutor; test records covering a diverse, realistic range of users including SEND learners.
Section 03
Version and review
Version 0.2
First published 30 July 2026 as version 0.1. Current version 0.2, 23 September 2026, reviewed on every model, policy, mitigation or incident change.
Independent review is outstanding.
Request
Ask us about a standard
Write to hello@aevumfoundry.ai and we will answer with the evidence we hold, or tell you we do not hold it yet.