PROCUREMENT · JISC/CHEST
How to Buy AI Assessment Tools Through the Jisc/CHEST Framework
Eduface is an approved Jisc/CHEST supplier. How UK universities can procure AI assessment tools through the framework, and what to ask any vendor first.
By Eduface · July 2026 · 8 min read
Procurement teams at UK universities are under pressure from two directions at once. AI assessment tools are arriving faster than evaluation frameworks can keep up. At the same time, the compliance stakes around student data, academic outcomes, and AI regulation are genuinely high. Getting it wrong is not just an operational problem: it carries legal and reputational risk. This is one area where the Jisc/CHEST framework earns its place.
Can UK universities buy AI tools through Jisc/CHEST?
Yes. The Jisc/CHEST framework is a compliant procurement route for UK higher and further education institutions. Products listed on the framework have been pre-vetted by Jisc, meaning institutions do not need to run a full Find a Tender (formerly OJEU) process. Eduface is an approved supplier on the framework, enabling institutions to move from evaluation to contract without the full tender overhead.
What is the Jisc/CHEST framework and how does it work?
Jisc (Joint Information Systems Committee) is the UK’s not-for-profit digital, data and technology agency for education and research. It provides shared infrastructure, negotiated licences, and policy guidance across the sector. CHEST (Combined Higher Education Software Team) is the procurement vehicle operated by Jisc. It aggregates purchasing power across hundreds of UK HE and FE institutions, which produces two concrete benefits: better commercial pricing, and a pre-vetted supplier list.
The vetting process covers financial stability, data security posture, contractual terms, and service levels. Suppliers that pass are listed on the framework. Institutions can then procure directly from those suppliers without running a separate competitive tender, provided the purchase falls within scope. This is compliant with UK public procurement regulations. In practical terms, a procurement lead does not need to build a supplier assessment from scratch. The framework provides the baseline. The question shifts from can we trust this vendor at all? to does this vendor meet our specific institutional requirements?
Why does the framework matter for AI tools specifically?
Most software procurement involves questions around cost, support, and integration. AI assessment tools add several layers on top of that. Student data is involved at every stage: submissions, grades, feedback, and behavioural patterns. Academic outcomes are directly affected by the tool’s accuracy. And since 2024, the EU AI Act has classified certain AI systems used in education as high-risk, which brings legal obligations around transparency, human oversight, and record-keeping.
These are not hypothetical risks. A procurement decision that skips proper data due diligence could expose the institution to a GDPR enforcement action. A vendor whose AI drifts in accuracy could affect degree classifications. A tool that does not meet EU AI Act requirements for human-in-the-loop oversight could create audit exposure. The Jisc/CHEST framework removes a portion of this risk by ensuring baseline vetting has already happened. But it does not remove the institution’s responsibility to ask the right questions of the specific vendor.
What should institutions ask any AI assessment supplier?
Even when procuring through a compliant framework, institutions should probe seven areas before signing:
1. Where is student data processed and stored? EEA residency matters for UK and EU GDPR compliance. Data leaving the EEA without adequate safeguards creates risk.
2. Does the vendor use external AI APIs? Tools built on top of OpenAI, Google, or Anthropic APIs route your student data through those providers’ infrastructure. That creates additional data-sharing relationships you need to account for.
3. Is student data used to train AI models? This is both a GDPR concern and an ethical one. Students have rights over how their data is used. Training on student submissions without proper legal basis is not defensible.
4. Is a Data Processor Agreement (DPA) available? Under Article 28 GDPR, a DPA is mandatory when a controller engages a processor. Any vendor unable to provide one should not be shortlisted.
5. Does the tool comply with the EU AI Act? For high-risk AI systems, the Act requires human oversight of consequential decisions. In assessment, this means a lecturer must be able to review and override any AI-generated grade.
6. What is the evidence base for accuracy? Vendors should point to pilot data showing how closely their AI aligns with human marker judgements. General claims about accuracy are not sufficient.
7. What LMS integrations are supported? A tool that cannot integrate with your existing VLE via LTI 1.3 will create workflow friction that undermines adoption.
How does Eduface meet the key procurement criteria?
Eduface was built specifically for higher education assessment, and the architecture reflects the compliance requirements that brings. The platform runs on proprietary GPU servers located in the Netherlands. There are no external AI APIs in the processing pipeline: OpenAI, Google, Anthropic, and equivalent providers are not used. Student data does not leave Eduface’s own infrastructure, and it is not used to train AI models.
A Data Processor Agreement is available on request, drafted to meet Article 28 requirements. The EU AI Act’s human-in-the-loop requirement is met by design: every grade generated by the platform must be confirmed by the lecturer before it is recorded. The AI provides a recommendation; the lecturer retains the decision.
In terms of accuracy, Eduface has achieved 95% alignment with lecturer assessments in UK pilots. Pilot partners include Bath Spa University in the UK, and De Haagse Hogeschool, Tilburg University, Hogeschool Rotterdam, and UMCG in the Netherlands. The platform integrates with Canvas, Brightspace, Moodle, and Blackboard via LTI 1.3, covering the four VLEs most commonly deployed across UK HE. Eduface is approved on the Jisc/CHEST framework for UK institutions, and on the HEAnet framework for institutions in Ireland.
What does the procurement process actually look like?
For institutions procuring through Jisc/CHEST, the process is considerably lighter than a full tender. The typical path: the institution identifies Eduface as a listed supplier on the framework, confirms the purchase is within scope, and moves directly to contract negotiation using the framework terms as the baseline. The Jisc/CHEST agreement covers the core commercial and contractual points, so the institution’s legal team is reviewing adjustments rather than drafting from scratch.
In parallel, procurement leads and learning technologists typically want to see a demonstration, confirm the DPA meets their institution’s DPO requirements, and validate LMS integration with their IT team. These steps usually take two to four weeks depending on internal sign-off processes. For Irish institutions, the HEAnet framework provides an equivalent compliant procurement route.
Procurement checklist: AI assessment tools for UK HE
Criterion
Why it matters
Eduface
Jisc/CHEST approved
Simplifies UK procurement compliance
Yes
Data residency in EEA
UK/EU GDPR requirement
Yes (Netherlands)
No external AI APIs
Prevents data leaving the vendor’s control
Yes
Student data not used for training
GDPR and ethical requirement
Yes
DPA available
Article 28 GDPR mandatory
Yes, on request
EU AI Act compliant
High-risk AI requires human oversight
Yes
Human-in-the-loop
Lecturer confirms every grade
Yes
LMS integration (LTI 1.3)
Fits existing institutional workflow
Canvas, Brightspace, Moodle, Blackboard
Pilot evidence of accuracy
Validates the technology
95% alignment (UK pilots)
Frequently asked questions
Is Eduface available on the Jisc/CHEST framework?
Yes. Eduface is an approved supplier on the Jisc/CHEST framework. UK higher and further education institutions can procure Eduface directly without running a full competitive tender process. The framework provides a compliant procurement route under UK public procurement regulations, with baseline vetting already completed on financial stability, data security, contractual terms, and service levels.
Do institutions need to run a full tender to buy through Jisc/CHEST?
No. One of the primary purposes of the framework is to remove that requirement. Institutions purchasing from a listed supplier within the scope of the framework agreement are compliant with UK public procurement regulations without a separate Find a Tender process. This saves procurement teams significant time and reduces the internal resource required to reach contract.
What data protection documents does Eduface provide for procurement?
Eduface provides a Data Processor Agreement on request, drafted in line with Article 28 UK/EU GDPR requirements. This covers the obligations of Eduface as data processor and the institution as data controller, including sub-processor arrangements, breach notification timelines, and data deletion procedures. Institutions are advised to share the DPA with their Data Protection Officer early in the procurement process.
Does Eduface integrate with our LMS?
Eduface integrates with Canvas, Brightspace, Moodle, and Blackboard via LTI 1.3. LTI 1.3 is the current interoperability standard for VLE integrations and supports secure, standards-based single sign-on and grade passback. If your institution runs a different VLE, contact Eduface to discuss integration options before committing to procurement.
What is the HEAnet framework and does Eduface appear on it?
HEAnet is Ireland’s national education and research network, providing shared services and procurement frameworks for Irish higher education institutions. The HEAnet framework functions similarly to Jisc/CHEST in the UK: it provides a compliant procurement route with pre-vetted suppliers. Eduface is an approved supplier on the HEAnet framework, enabling Irish institutions to procure without a separate tender process.
Conclusion
Procuring AI assessment tools is not like buying a standard software licence. The compliance requirements around student data, accuracy, and AI regulation make due diligence essential. The Jisc/CHEST framework significantly reduces the administrative burden by providing a pre-vetted, compliant procurement route. For institutions ready to move, Eduface is available on the framework and prepared to support the procurement process from demonstration through to contract.
Procurement-ready from day one
Request a demo or the procurement pack, including the Data Processor Agreement, and see how Eduface fits your framework route.