Schools are buying AI tutors before anyone sets the rules

My sister teaches at a secondary school that just rolled out an AI tutor across three year groups. Nobody asked parents, nobody explained what happens to the students' chat logs, and the data processing agreement is apparently still being "finalised" weeks after launch. I'm not against the tools, but procurement is racing ahead of any real policy. GDPR says children's data needs extra care, yet schools are signing up on free trials and figuring it out later. Who is actually meant to vet this stuff? Teachers already have enough on their plates. Curious whether other people are seeing the same pattern in their local schools.