Aipedia: Schools, academies and governors

Pupil deepfakes and AI-generated images

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

KCSIE 2026 treats AI-generated content as "making" images, so a pupil who creates a deepfake nude of a classmate is a safeguarding matter from the outset. How the school responds, and records that response, decides whether a complaint becomes a claim.

Part of: AI in schools, academies and governors

In short

Nudification apps and image generators let pupils create realistic fake images of classmates or staff in seconds. KCSIE 2026, in force from 1 September 2026, treats AI-generated content as "making" images, intended to capture deepfakes, and links to CEOP Education and Internet Watch Foundation guidance on AI-generated child sexual abuse material. Schools must respond through safeguarding procedures, not as a behaviour issue alone. Families of victims, accused pupils and affected staff may all complain or claim. Governors' liability, abuse, employment and PI cover can each be relevant.

What schools are facing

Free apps and websites can now turn an ordinary photo, often taken from social media or a school website, into a realistic nude or sexualised image. Pupils use them on classmates and sometimes on teachers. Images spread through group chats in minutes. Other cases involve fake voice notes or videos of staff saying things they never said. The harm to the person depicted is real whether or not the image is "genuine", and the school is usually where it surfaces first.

What KCSIE 2026 and DfE say

DfE's KCSIE 2026 consultation response confirms that "making" images now covers AI-generated content, intended to capture deepfakes. KCSIE 2026 adds links to CEOP Education and Internet Watch Foundation guidance on AI-generated child sexual abuse material. Generative AI paragraphs were added after paragraph 159, cross-referring to DfE's AI policy and the product safety standards.

DfE's Generative AI in education policy says online safety, including AI, belongs in safeguarding policies, and pupil use needs safeguards. It also warns schools to plan for pupils creating realistic emails that appear to come from the school, a reminder that impersonation goes beyond images. Filtering and monitoring should cover generative AI, which is reviewed under paragraph 166.

The school's response

The practical message of KCSIE 2026 is that a deepfake of a pupil is handled as a child protection matter, led by the DSL, using the specialist guidance KCSIE links to. Staff should not view, copy or forward images beyond what that guidance allows, and should not try to investigate devices themselves. The victim's support, parents' involvement, any referral and the response to the pupils who made or shared the image all need to be recorded. Where staff are depicted, the school also has duties as an employer to support them. Behaviour sanctions may follow, but they sit alongside safeguarding, not in place of it.

What can go wrong

Illustrative scenario: a group of Year 10 pupils create fake nude images of a classmate and share them. A teacher, unsure what to do, asks to see the images on a pupil's phone and later forwards one to a senior leader "for evidence". The incident is handled as a behaviour matter, and the victim's family is told days later. The family complains that the school mishandled the images and failed to protect their child; one accused pupil's parents challenge the exclusion; and the teacher faces an internal investigation.

How claims against the school and governors are handled

Several types of claim can follow, and they usually fall under different covers:

A victim's claim that the school failed to protect them may involve abuse or liability cover, subject to the wording. See the education abuse scenario.
Allegations that governors failed to put proper policies in place may involve RPA Section 5 or commercial D&O. The RPA rules exclude personal injury from Section 5, and exclude acts done in reckless disregard of whether they were a breach of duty.
Challenges to exclusions and complaints by accused pupils' families raise governance and process questions; see AI in behaviour and exclusions.
A staff member depicted in a deepfake may bring an employment-related claim if they feel unsupported, which depends on any employment practices cover.

Practical controls

Update safeguarding and online safety policies to name AI-generated images and deepfakes.
Train staff on what not to do with images, using the specialist guidance KCSIE links to.
Agree how staff deepfakes will be handled, including support and reporting.
Teach pupils that creating or sharing such images is serious, using CEOP Education material.
Record every step, and report incident patterns to governors through the AI policy review.

Related: AI in safeguarding records and the AI in schools hub.

How Apex helps

Apex arranges governors' D&O for independent schools and academy trusts. A broker can check how your programme would respond to the several claims a single deepfake incident can produce.

Sources

Frequently asked

Is a pupil-made deepfake nude a safeguarding issue?

Yes. KCSIE 2026 treats AI-generated content as "making" images, intended to capture deepfakes, and links to CEOP Education and Internet Watch Foundation guidance. It should be led by the DSL through safeguarding procedures, not treated only as behaviour.

Should staff look at the images to investigate?

Staff should follow the specialist guidance KCSIE links to rather than improvising. Viewing, copying or forwarding images beyond what that guidance allows can cause further harm and create problems for the staff member and the school.

What if a teacher is the target of a deepfake?

The school should support the teacher as an employer, as well as dealing with the pupils responsible. A teacher who feels unsupported may complain or claim, which can involve employment practices cover where it is held.

Can governors be personally liable for a deepfake incident?

Claims usually target the school or trust. Allegations that governors failed to put suitable policies in place may involve RPA Section 5 or D&O, subject to exclusions such as personal injury and reckless disregard of duty.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.