FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Schools, academies and governors
AI makes phishing and impersonation more convincing, and KCSIE 2026 now treats cyber security as part of safeguarding and a whole-school issue. For RPA members, cyber cover is limited to £250,000 per member per year, so boards need to know what sits outside it.
Part of: AI in schools, academies and governors
In short
Attackers use AI to write fluent, personalised phishing emails, imitate suppliers, parents and senior leaders, and time payment diversion requests to match real invoices. DfE warns that AI may increase the sophistication and credibility of attacks, and that schools should plan for pupils creating realistic emails that appear to come from the school. KCSIE 2026 frames cyber security as safeguarding and a whole-school issue, not something left to individuals or external providers. RPA Section 14 covers increased cost of working and incident response up to £250,000 per member per year. Commercial cyber or crime cover may fill gaps.
Schools are attractive targets: they hold sensitive data on children, process regular payments to suppliers, and have staff who are busy and trusting. AI removes many of the tell-tale signs of phishing. Emails can arrive in perfect English, refer to real events from the school website, and copy the tone of a known supplier or the trust's chief financial officer. Spoofed emails from "parents" ask the office to change contact details. A bursar receives a convincing message from a regular contractor giving new bank details just before a large invoice is due. Voice cloning can make a follow-up phone call sound genuine.
DfE's Generative AI in education policy says AI may increase the sophistication and credibility of cyber attacks, and that schools should plan for pupils creating realistic emails that appear to come from the school. That second point matters: impersonation is not only an outside threat.
According to DfE's KCSIE 2026 consultation response, paragraph 170 and a new paragraph frame cyber security as part of safeguarding and a whole-school issue, not something left to individuals or external providers. Governing bodies and proprietors therefore need to oversee it in the same way as other safeguarding duties, alongside the annual filtering and monitoring review.
Illustrative scenario: an academy trust's finance officer receives an email apparently from a building contractor, written in the contractor's usual style and referencing a real project, asking for future payments to go to a new account. A follow-up voice message sounds like the contractor's manager. The change is made without a call-back to a known number. Two payments go to the fraudster before the contractor chases. At the same time, a phishing email to staff leads to a compromised account, and the trust has to investigate whether pupil data was accessed.
The trust now faces two different problems: lost money, and a cyber incident with response costs and possible data protection consequences.
Under the RPA membership rules for academy trusts, Section 14 covers increased cost of working after a Cyber Incident, plus incident response. The limit is £250,000 per member per year, with a £750,000 aggregate for a group network, and a member retention of £1,000 for a primary academy or £2,000 for others. The rules reviewed do not mention artificial intelligence.
Two points deserve attention. First, the Section 14 description focuses on the cost of working and response, so a trust should not assume that money lost to payment diversion is covered; that depends on the rules and any separate crime cover. Second, a large trust may find £250,000 modest against a serious incident across several schools.
Commercial policies commonly attach conditions, such as call-back verification for bank detail changes, so controls and cover go together.
Related: AI for bursars and the AI in schools hub.
Apex arranges governors' D&O for independent schools and academy trusts, and a broker can compare your RPA cyber position with commercial options and the conditions that come with them.
Yes. KCSIE 2026, according to DfE's consultation response, frames cyber security as part of safeguarding and a whole-school issue, not something left to individuals or external providers. Governors should oversee it as they do other safeguarding duties.
Under the September 2026 academy rules, Section 14 covers increased cost of working and incident response up to £250,000 per member per year, with a £750,000 aggregate for a group network, and a £1,000 or £2,000 member retention.
It should not be assumed. Section 14 is described in terms of increased cost of working and incident response. Whether a diverted payment is recoverable depends on the rules, and many organisations use separate crime or social engineering cover.
Independent schools are not in the RPA, so cyber cover has to be arranged commercially. It is often combined with crime cover for payment diversion, and may come with conditions on verification and authentication controls.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
