11/09/2026
“Have an AI policy” is now common advice for schools. What that policy, or the school’s wider policy framework, should include is often less clear.
At a minimum, schools should consider:
• Scope: The tools, users and settings covered, including staff, pupils, governors, assessment and administration.
• Staff use: Approved tools, permitted uses and clear restrictions, including whether personal AI accounts may be used for school work or on school devices.
• Staff training: Who is responsible for AI literacy, how training will be provided and when it will be refreshed.
• Pupil use: Which tools pupils may use, when and for what purpose, taking account of age restrictions and appropriate supervision.
• Assessment and academic integrity: What support is acceptable, how AI use should be acknowledged, what constitutes misuse and the consequences.
• Safeguarding: Risks including deepfakes, AI-generated explicit or sexual imagery, harmful content, bullying and grooming, with clear reporting and response procedures.
• Data protection: The risk-assessment status of each approved AI use, including whether a DPIA is required, completed or under review.
• Accountability: A named lead or leadership team with clear responsibilities and appropriate knowledge and training.
• Review: A defined review schedule, at least annually and following any significant AI-related incident or material change in guidance.
For schools and colleges in England, KCSIE 2026 is now in force and expressly includes nudes and semi-nudes generated by AI.
Schools should ensure their AI arrangements connect clearly with their safeguarding and incident-response procedures. If they do not, they need updating.
Download our free AI policy considerations:
https://everythingict.org/ai-policy-considerations/