Markable — Compliance Statement

Version: 1.3 (POC) Effective date: 6 September 2026 Previous versions: 1.2 (POC) (29 August 2026) · 1.1 (POC) (19 August 2026) Owner: Markable Compliance Lead Contact: support@markable.uk

This statement summarises Markable's compliance posture during its proof-of-concept stage. It is intended for review by Data Protection Officers, school Senior Leadership Teams, and other stakeholders considering use of Markable. A more detailed compliance framework will be issued before scaled deployment.

---

1. About Markable

Markable is an AI-assisted annotation and feedback platform for vocational and curriculum-based qualifications. Markable is at proof-of-concept stage. It is in use by individual teachers and is being prepared for its first school deployments.

How the AI works

Markable uses AI to analyse a student's work against the official mark scheme and examiners' reports for that qualification. The AI produces written observations, paragraph-level annotations, identified strengths, and areas for development.

The AI does not tell you what mark, band, level or grade the work has achieved. It may describe what a higher band requires and what is missing in order to reach it, quoting the mark scheme - for example, "to reach Level 5 this would need a developed counter-argument." It does not state or imply the standard the work currently sits at.

One exception, clearly identified: for BTEC Applied Law Unit 2 coursework, the AI additionally produces a suggested grade and a suggested overall comment. These are shown to the teacher as suggestions only. The teacher's own grade selection begins empty and is never pre-filled with the AI's suggestion.

For coursework units, the AI also drafts an initial comment against each assessment criterion. The teacher may edit or replace any of these before finalising.

The teacher enters every mark. A script cannot be finalised until the teacher has entered their marks, written their comments and confirmed they have reviewed the feedback the student will see. Nothing reaches a student report that the teacher has not saved as their own.

Where an indicative grade is shown, it is calculated arithmetically from the marks the teacher has entered. No AI is involved in producing it. For most subjects this uses the awarding body's published grade boundaries for the series being marked. Where those boundaries are not available to us, an approximation is used and the platform says so on screen alongside the grade.

2. Frameworks Markable is designed against

We have designed Markable's processes with reference to:

• UK GDPR and the Data Protection Act 2018 — compliance documented through the Privacy Policy, DPA, DPIA, LIA, and TRA.
• Ofqual's Principles of AI use in marking (Jan 2026) — informs our approach to validity, oversight, transparency, fairness, and contestability.
• DfE Generative AI in education (last updated August 2025) — informs our schools-facing position.
• DfE Generative AI Product Safety Expectations (Jan 2025) — informs filtering, monitoring, security, privacy, IP, design and testing, and governance.
• Keeping Children Safe in Education 2025 — informs our safeguarding posture.
• JCQ guidance on AI use in assessments — informs assessment integrity.
• ICO Children's code — informs our processing of children's data.
• The five UK AI Regulation principles — applied across our design.

3. How we comply, in summary

3.1 Data protection (UK GDPR)

• Privacy Policy sets out lawful basis, purposes, retention, recipients, transfers, and rights.
• Data Processing Agreement between Markable and each School satisfies UK GDPR Article 28.
• Data Protection Impact Assessment maintained as required by Article 35.
• Legitimate Interests Assessment maintained where relied upon (internal working document, available on request).
• Transfer Risk Assessment maintained for each non-UK Sub-processor (internal working document, available on request).
• ICO registration C1917001.
• Multi-factor authentication available and strongly encouraged for teacher accounts; encryption in transit and at rest; row-level security; least-privilege access for staff.

3.2 AI transparency (UK GDPR Articles 13(2)(f), 14(2)(g), 22)

• The Privacy Policy provides the formal disclosure: what the AI does, how it works in plain English, the limitations of LLMs, and that Markable does not engage in solely automated decision-making.
• A first-time-use AI disclosure with tick-box acknowledgement is shown to teachers before their first upload.
• A persistent in-app indicator shows when AI is operating.
• A Student/Parent Privacy Notice template is provided to schools to issue to students and parents.

3.3 Teacher oversight

• The AI's role and its single coursework-grade exception are described in the canonical description in section 1 above.
• AI-generated annotations are shown first to the teacher. Those the teacher keeps after review appear on the student's feedback report; those they delete do not.
• The teacher enters every mark. A script cannot be finalised until the teacher has entered their marks, written their comments and confirmed they have reviewed the feedback the student will see. Nothing reaches a student report that the teacher has not saved as their own.
• AI-generated improvement priorities require explicit teacher confirmation or editing before they appear on the student's report.

3.4 Safeguarding

Markable does not detect, route, receive or store safeguarding concerns, and has no feature for doing so. A teacher concerned by something in a pupil's work follows their school's own safeguarding procedure, exactly as they would with anything else a pupil told them.

The upload scan is sometimes mistaken for a safeguarding feature. It is not. It checks whether text looks like a real name and asks the teacher to check the work before it is analysed. It has no view on content, meaning or risk.

Terms of Service 6.3 says the same to teachers directly: nothing in the Service will alert them to a safeguarding concern, and they should not rely on it to.

3.5 Validity and fairness — POC stage

We will run a first internal evaluation cycle during the autumn 2026 term, covering:

• Coverage accuracy — are the AI's content-presence claims correct?
• Hallucination rate — does the AI claim content is present that isn't?
• Consistency — do repeated runs produce similar output?
• Sub-group fairness on script-derived proxies — does annotation quality vary by response length, surface complexity, or other script-derived factors?

Findings will inform iteration during POC. A formal Validity and Fairness Report will be issued before scaled deployment.

We do not request demographic data (e.g., EAL status) from schools and do not flag individual scripts to teachers as "EAL" or "difficult to read"; doing so could itself produce discriminatory effects.

3.6 Contestability and complaints

Concerns about the AI's behaviour, fairness or accuracy should be sent to support@markable.uk. Putting "Compliance Concern" in the subject line helps us route it quickly, but we will treat a concern as a concern however it reaches us. We acknowledge within 5 working days and respond substantively within 20 working days.

If your concern is about how we handle personal data, that is a data protection complaint and it has a faster route. Section 10 of our Privacy Policy sets it out: acknowledged within 5 working days, outcome within 30 calendar days, with your right to complain to the Information Commissioner's Office alongside it.

Marking disputes are not handled by Markable; they are a matter for the school's normal assessment appeals procedure.

Escalation routes include the ICO (data protection), Ofqual (qualification regulation), the relevant Local Authority Designated Officer (safeguarding), and the relevant awarding organisation.

3.7 Intellectual property

• Student work remains the IP of the student. Markable does not collect, retain, share, or use student script content for training, fine-tuning, product improvement, or any commercial purpose.
• Teacher-authored content belongs to the teacher's school under the school's normal arrangements with its staff.
• Awarding organisation materials referenced by the platform are the copyright of the relevant awarding organisation. We acknowledge that the commercial position with awarding organisations will need to be formalised before scaled deployment, on legal advice. POC scale is limited and bounded.
• Markable platform code, design, prompts, and trained components are Markable's IP.

3.8 Children's data

What we hold about a child depends on the account. Teachers using Markable outside a school account identify pupils by initials or a reference code, and no pupil name is held. Where a School has enabled pupil access it records each pupil's full name and school email address, so that a pupil can be given feedback on their own work and can prove which work is theirs when they sign in. We apply the principles of the ICO Age Appropriate Design Code in both cases: data minimisation, no profiling for advertising, no nudge techniques, default to the most protective settings, and age-appropriate transparency through the Student/Parent Privacy Notice template.

3.9 Scope

Markable is offered as an annotation and feedback tool for the subjects and assessment types officially supported on the platform. It is not offered for use as a sole or primary marker for any regulated qualification, for GCSE/AS/A-level summative marking that contributes to reported outcomes, for coursework moderation that bypasses centre IV, as a remote invigilator, or directly with students.

4. POC stage — what is deferred to scale

In line with legal advice, the following items are appropriately deferred from POC to scaled deployment:

5. Operational responsibilities

Named roles within Markable:

• Compliance Lead: Joanne Renwick
• Data Protection Lead: Joanne Renwick
• Security Lead: Joanne Renwick

These can be the same individual at POC scale.

A standing quarterly review covers the risk register, open compliance items, complaints, sub-processor changes, and incidents.

6. Available on request

The following are available to school DPOs (and to relevant awarding organisations) on request, under reasonable confidentiality terms:

• The full DPIA;
• The LIA;
• The Transfer Risk Assessment;
• Penetration test summaries;
• Security questionnaire responses;
• A platform demonstration.

7. Contact

Markable (sole trader, proprietor: Joanne Renwick) support@markable.uk ICO Registration: C1917001

8. Review

This statement will be reviewed at least annually, before scaled deployment, on any material change to the platform, and on any material change to applicable law or regulator guidance.