The AI-native classroom: where AI proposes, and a human decides

A design methodology for putting AI into marking without giving up the things that make marking trustworthy.

By Saqub Hussain · author of an exam-mapped Reception→Year 11 computing curriculum (plantbotcomputing.co.uk) · builder of the working prototype linked above.

When a capable model can read a pupil’s answer and produce a fluent, plausible judgement about it in seconds, the temptation is obvious: point it at the pile and let it mark. The question that actually matters is harder, and it is the one worth answering carefully: where does AI genuinely help with assessment, where is a human non‑negotiable, and how does that line move as the models get better?

I have had to work that out concretely rather than in the abstract. I authored a complete, exam‑mapped computing curriculum — Reception to Year 11, published openly — and built the assessment estate that sits under it: papers, mark schemes, and a moderation protocol. When I started designing AI into the marking of that work, I had to decide exactly where the machine helps and where a person must stay accountable, against real regulation and a live, safeguarding‑sensitive school context. What follows is the design pattern I use. I call it the “Legal Spine”: a small set of load‑bearing rules that let AI accelerate assessment without quietly transferring accountability from a person to a system.

One thing up front, so no later paragraph has to walk it back: this framework is validated in shadow mode only. It has never been the thing that decided a pupil’s outcome, and I make no claims that it has.

The core move: the model proposes, a human remains the marker of record

The single most important design decision is also the simplest to state and the easiest to erode: a named human being is the marker of record. The model can draft, surface, flag, and suggest. It does not award, and it does not decide what is correct. The accountable judgement — the mark that goes on the record, the professional decision a regulator or a parent can question — belongs to a person who can explain it and stand behind it.

This is not a nicety bolted on at the end. It is the constraint everything else is built to protect. Once “the AI marked it” becomes an acceptable sentence, you have lost the ability to say who is responsible when it is wrong — and it will sometimes be wrong in ways that are confident, fluent, and completely undetectable to a pupil. Keeping a human in the accountable seat is what makes the rest of the acceleration safe.

You can watch this in the prototype: one synthetic answer is fluent and confidently wrong, and the model reads it as fine — “no rubric conflict.” The human, checking the rubric, is what catches it. That is the whole argument, made concrete.

The design pattern

Around that core, four rules do the real work.

1. Pseudonymised inputs. Names and identifying detail are removed before anything reaches the model. The system reasons about an answer, not about a named child. This shrinks the data‑protection surface and removes a whole class of ways the output could be biased by who it thinks it is looking at.

2. Shadow mode before anything is live. The pattern is validated by running the model alongside real human marking and comparing — never by letting it touch a live grade. You learn where it agrees, where it drifts, and where it is confidently wrong, entirely in the shadow of a human process that stays in control.

3. A DPIA gate. No move from shadow validation toward any live use happens without a completed Data Protection Impact Assessment. The gate is deliberately placed at the tempting “we could just switch it on” moment, so that moment forces the paperwork and the sign‑off — not an afterthought once it is already running.

4. An under‑13 safeguarding pattern. For younger pupils the rules tighten: no pupil AI accounts, names removed before any AI processing, teacher‑mediated throughout. Children are not handed direct access to a model, and the model is never handed a child’s identity.

Everything is designed to sit inside the regulatory frame it actually has to live in — alignment with Ofqual, JCQ and Qualifications Wales guidance, and UK GDPR. Regulation is not the obstacle here. It is the specification.

The same discipline authors the content

The discipline that governs where AI sits in assessment is the same one that governs how the underlying content is made. The curriculum this framework marks against is authored and published openly — 6,775 files, Reception to Year 11, 100% point‑mapped to Pearson Edexcel International GCSE Computer Science (4CP0, all 89 spec points) and ICT (4IT1, all 36 subtopics), and mapped to NCCE Teach Computing and the Curriculum for Wales — with per‑lesson open‑licence provenance on every resource, and at least 10% double‑marking on the assessment side. Knowing exactly where each item came from, keeping taught and tested content structurally aligned, and requiring an auditable trail is the content‑side version of the same principle: a named human who can stand behind the result.

How the line moves

The reason this has to be a design discipline and not a fixed rulebook is that the models keep improving. As they get more reliable, more of the drafting and surfacing work can defensibly shift to the machine — better first‑pass feedback, better flagging of answers that need a second look, better consistency checks across a pile. What does not move, no matter how good the model gets, is the accountable judgement. Reliability is not the same as accountability. A model can become good enough to draft a mark long before there is any world in which “the model is accountable for the mark” is a coherent sentence. The methodology is built so that improving capability expands what AI assists with while the human‑accountability core stays exactly where it is — and each new capability earns a task by proving itself in shadow mode on that specific task, measured against the human standard, before it is trusted anywhere near a live decision.

A checklist for anyone putting AI into assessment

• Who is the marker of record? Name a person. If the honest answer is “the system,” stop.
• Is identifying data removed before the model sees the work? If not, fix that first.
• Have you run it in shadow mode against real human marking? If it has never been compared to a human on live‑shaped work, you do not yet know what it does.
• Is there a gate — a DPIA or equivalent — between validation and any live use? And is it placed at the tempting moment, not after it?
• For under‑13s: no pupil accounts, no names to the model, a teacher in the loop? Non‑negotiable.
• Which regulations actually apply, and is the design shaped to them? Treat them as the spec, not the enemy.
• What claims are you making about outcomes — and can you back them? “Validated in shadow mode” and “improves results” are very different sentences. Only say the one that is true.

The last one matters most, because it is the easiest to get wrong under commercial pressure. The strongest thing you can say about a responsible system is often the most modest: here is exactly what it does, here is what it does not, and here is the human who is accountable when it matters.