FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Schools, academies and governors
A school or trust AI policy should set out approved tools, DPO sign-off, staff and pupil use, filtering and incident handling, drawing on DfE guidance, KCSIE 2026 and Ofsted's approach. A documented, reviewed policy is also governors' best evidence that they acted reasonably.
Part of: AI in schools, academies and governors
In short
No law requires a standalone AI policy, but DfE, KCSIE 2026 and Ofsted together make one the practical way to show control. A board-approved policy should cover approved tools and DPO sign-off, rules on personal data, staff accountability for output, pupil use and homework, filtering and monitoring that includes generative AI, deepfakes, cyber security, biometrics and automated decisions. It should link to safeguarding, data protection and behaviour policies, and be reviewed regularly. When a claim or complaint arises, a policy that was followed helps governors show reasonable oversight.
DfE has not issued AI guidance aimed at governors or trust boards, and no law requires a separate AI policy. But the expectations are spread across several documents: DfE's generative AI policy and data protection guidance, KCSIE 2026 and Ofsted's approach, which looks at whether leaders' AI decisions are sensible and serve pupils. A single, board-approved policy pulls those threads together, tells staff what is allowed, and gives governors something concrete to monitor.
| Area | What to include | Source |
|---|---|---|
| Approved tools | List of tools, who approves them, DPO or IT lead sign-off before personal data is used | DfE data protection guidance |
| Personal data | Anonymise by default; no use of data to train AI; privacy notice covers AI | DfE data protection guidance |
| Staff use | Staff check output and remain responsible "regardless of the tools" | DfE generative AI policy |
| Pupil use and homework | When pupils may use AI, safeguards, and that pupils' work is not used to train AI without permission | DfE generative AI policy |
| Filtering and monitoring | Annual review covering generative AI on all devices, with records | KCSIE 2026 para 166 |
| Deepfakes and images | AI-generated images handled as safeguarding | KCSIE 2026 |
| Cyber security | Whole-school responsibility; impersonation and phishing | KCSIE 2026 para 170 |
| Automated decisions | Human review of significant decisions; transparency | UK GDPR Arts 22A to 22D |
| Biometrics and high-risk tools | DPIA and valid consent before use | ICO, Chelmer Valley |
| Supplier standards | Use DfE product safety standards when choosing pupil-facing tools | DfE product safety standards |
A good policy names the places AI is actually used and sets rules for each: staff tools and pupil data, SEND paperwork, safeguarding records, behaviour and exclusions, recruitment and governor packs and minutes. Exams and coursework are covered by separate qualification rules; see learners using AI and malpractice.
Illustrative scenario: a trust has no AI policy. Different schools adopt different tools; one uses a free chatbot for SEND drafting, another switches on AI features in its safeguarding platform, and a third allows pupils unrestricted access to an image generator. After a deepfake incident and a data complaint in the same term, the trust board is asked by Ofsted and by a parent's solicitor how it oversaw AI. It can point only to scattered emails, and governors struggle to show they had any view of the risks.
Claims against governors usually turn on whether they acted reasonably. A policy that was approved, communicated, trained on and reviewed is evidence of that. It also helps with cover: RPA Section 5 and commercial D&O exclude acts done in reckless disregard of whether they were a breach of duty, and a board with no arrangements after clear guidance is more exposed to that argument. Where the trust is a charity, the CC3 duties of reasonable care and skill and collective responsibility point the same way. Independent schools can use the independent school risk assessment as a starting point, and see governor liability for AI.
See also the DfE and KCSIE guide and the AI in schools hub.
Apex arranges D&O for academy trusts and schools and trustee indemnity for independent schools that are charities. A broker can discuss how your AI policy and controls are presented to insurers at renewal.
No law requiring a standalone AI policy was found. DfE guidance, KCSIE 2026 and Ofsted's approach make one the practical way to show that AI use is controlled, and a school may fold it into existing safeguarding and data protection policies.
The governing board or trust board should approve it, with leaders responsible for day-to-day operation and the DPO advising on data protection. Governors should set a review date and receive reports on incidents and the filtering review.
At least annually is sensible, and sooner when guidance changes. DfE's data protection guidance was updated in October 2026 and KCSIE changes each September, so tying the review to the annual filtering review and the KCSIE cycle keeps it current.
It can. Claims against governors often turn on whether they acted reasonably, and a followed policy is good evidence. It also counters any argument of reckless disregard, which RPA Section 5 and many D&O wordings exclude.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
