FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Schools, academies and governors
Under KCSIE 2026, governing bodies and proprietors should ensure filtering effectiveness is reviewed at least once every academic year, across all internet-connected devices, and DfE expects that to cover generative AI. If a pupil reaches harmful AI content, the board will be asked to show it.
Part of: AI in schools, academies and governors
In short
KCSIE 2026 paragraph 166 asks governing bodies and proprietors to ensure filtering effectiveness is reviewed at least once every academic year, across all internet-connected devices and relevant locations, with records kept. Governors must make sure the checks happen but are not expected to run them. DfE's generative AI policy says filtering and monitoring should cover generative AI. Chatbots, image generators and AI features inside ordinary apps can bypass filters built for websites. A safeguarding failure claim may involve governors' liability, but injury-based claims usually fall elsewhere.
Traditional filtering blocks categories of website. Generative AI does not fit that model neatly. A chatbot reachable through an allowed domain can produce content on self-harm, weapons or sexual material in response to a prompt. AI image generators can create images a URL block would never catch. AI features now sit inside search engines, office software, browsers and learning platforms that schools deliberately allow. School-issued laptops taken home, shared tablets in boarding houses and guest Wi-Fi add further routes. Monitoring that only flags keywords in search may miss a conversation that drifts into harmful territory over many prompts.
According to DfE's KCSIE 2026 consultation response, paragraph 166 says governing bodies and proprietors should ensure filtering effectiveness is reviewed at least once every academic year, across all internet-connected devices and relevant locations, with records kept. Governors must ensure the checks happen but are not expected to carry them out personally. DfE says this clarifies existing expectations rather than creating a new duty.
DfE's Generative AI in education policy adds that online safety, including AI, belongs in safeguarding policies, that pupil use needs safeguards, and that filtering and monitoring should cover generative AI. The product safety standards, updated January 2026 and cross-referred in KCSIE, give a benchmark for pupil-facing AI tools. KCSIE 2026 also frames cyber security as safeguarding, which links filtering to the wider cyber picture.
Illustrative scenario: a Year 9 pupil uses a school laptop at home and, through an AI feature inside an allowed app, receives detailed content about self-harm. Monitoring does not alert because no blocked site was visited. The pupil comes to harm. The parents complain that the school allowed unfiltered AI on its devices. The complaint finds that last year's filtering review tested websites on site only and was never reported to governors, and Ofsted later asks how leaders satisfied themselves that filtering covered generative AI.
The weak point is usually evidence. A review that happened but was not recorded, or that skipped take-home devices, is hard to rely on.
A claim alleging that governors failed in their oversight duties is the kind of allegation governors' liability is designed for. Under the RPA rules for academy trusts, Section 5 covers members, trustees and local governors, with a £10,000,000 limit, on a claims-made basis. Its exclusions matter here:
Commercial D&O for independent schools commonly has a similar injury carve-out, subject to the wording. Abuse-related allegations raise separate questions; see the governor D&O and Ofsted scenario.
See also the KCSIE and DfE guide and the AI in schools hub.
Apex arranges D&O for academy trusts and schools and trustee indemnity for independent schools that are charities. A broker can show how your governors' cover treats safeguarding oversight claims and what sits with liability or abuse cover instead.
No. KCSIE 2026 paragraph 166 says governing bodies and proprietors should ensure the review happens at least once every academic year, with records kept, but they are not expected to carry out the checks personally.
Yes, in practice. DfE's generative AI policy says filtering and monitoring should cover generative AI, and KCSIE 2026 cross-refers to that policy. A review that only tests website categories is unlikely to show the risk was managed.
Enough to show what was tested, when and by whom: the date, the devices and locations covered, whether generative AI and AI features in allowed apps were included, the results and the actions agreed. KCSIE 2026 asks for records to be kept, and governors should see them.
Section 5 excludes personal injury, so an injury claim is usually dealt with under other liability cover. Section 5 is more relevant to allegations that governors failed in their oversight, subject to its exclusions.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
