Aipedia: Schools, academies and governors

DfE, KCSIE and Ofsted AI rules for schools

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Schools face no single AI rulebook: KCSIE 2026 is statutory guidance, while DfE's generative AI and data protection pages are advice on meeting existing law. Knowing which is which tells governors what they must evidence and what they should follow.

Part of: AI in schools, academies and governors

In short

Four sources shape AI in English schools. DfE's Generative AI in education policy sets the principles: check output, avoid personal data, plan for safeguarding and cyber risks. DfE's Data protection in schools guidance, last updated 14 October 2026, explains how to use AI lawfully, with DPO approval and privacy notices. KCSIE 2026, in force from 1 September 2026, adds generative AI paragraphs, treats AI-generated images as image-making and sets an annual filtering review. Ofsted does not inspect AI tools but judges whether leaders' AI decisions are sensible and serve pupils.

Statutory duties versus advice

The distinction matters when something goes wrong. Schools must have regard to statutory guidance such as KCSIE, and departures are hard to defend. DfE policy papers and support materials are advice, but they show what a reasonable school would have done, so they are used as a benchmark in complaints, inspections and claims. Underneath both sits law that applies regardless: UK GDPR, including the automated decision rules in Articles 22A to 22D, in force since 5 February 2026 under SI 2026/82.

Document	Dates	Status	Key AI points
DfE, Generative AI in education	29 March 2023; last update 12 August 2025	Policy and advice	Accountability for output, personal data, safeguarding, cyber, IP
DfE, Generative AI and data protection in schools	Added 7 February 2024; updated 14 October 2026	Advice on meeting UK GDPR	Anonymise, DPO approval, no training on data, privacy notices
DfE, Generative AI product safety standards	22 January 2025; updated 19 January 2026	Expectations for edtech suppliers	Design standards; cross-referred in KCSIE
KCSIE 2026	In force 1 September 2026	Statutory guidance	AI paragraphs, deepfakes, filtering review, cyber
Ofsted, How Ofsted looks at AI	27 June 2025; updated 21 October 2025	Inspection approach, non-final	No standalone AI inspection; leadership judgement

DfE: Generative AI in education

The policy paper was first published on 29 March 2023. Updates added data privacy and IP (26 October 2023), IP implications and a link to product safety expectations (22 January 2025), support materials (10 June 2025) and Ofsted's AI guidance (12 August 2025). Its key points:

DfE "recommends that personal data is not used in generative AI tools". Where it is, products must comply with the setting's data privacy policies and pupils and parents should understand how data is processed.
Be "open and transparent" about automated decision-making and profiling, including in-house chatbots, with a link to ICO guidance on profiling children.
Staff must check output. A document remains the responsibility of the professional and their organisation "regardless of the tools or resources used".
Online safety, including AI, belongs in safeguarding policies, and filtering and monitoring should cover generative AI.
AI may make cyber attacks more sophisticated and credible, including pupils creating realistic emails that appear to come from the school.
Pupils' original work must not be used to train AI without permission from the pupil or their parent or guardian.

It does not mention governors, trust boards or SEND specifically.

DfE: Generative AI and data protection in schools

The AI section of Data protection in schools was added on 7 February 2024 and last updated on 14 October 2026. It says generative AI can often be used without personal data, for example drafting a parent email from anonymised notes and adding the name afterwards. Before pupils' personal data goes into a tool, staff should confirm with the DPO or IT lead that it is safe and approved by the school, and data must be protected and "not used to further train the AI". The privacy notice must explain how AI tools collect, process and store data. It warns that tools may collect location, IP address and browser data that may be viewed or sold to third parties. The update log shows the AI section revised in March 2026 and a new EdTech procurement section added in July 2026.

DfE: Generative AI product safety standards

The product safety standards are aimed at edtech suppliers rather than schools. The January 2026 update added cognitive, emotional and social development, mental health and manipulation. They give schools a yardstick when choosing pupil-facing tools, and KCSIE 2026 now cross-refers to them.

KCSIE 2026: what changed for AI

According to DfE's consultation response, KCSIE 2026:

adds two paragraphs after paragraph 159 on DfE's generative AI policy and resources, cross-referring to the product safety standards;
treats AI-generated content as "making" images, intended to capture deepfakes, with links to CEOP Education and Internet Watch Foundation guidance on AI-generated child sexual abuse material;
at paragraph 166, says governing bodies and proprietors should ensure filtering effectiveness is reviewed at least once every academic year, across all internet-connected devices and relevant locations, with records kept, while not expecting governors to do the checks themselves;
at paragraph 170 and a new paragraph, frames cyber security as part of safeguarding and a whole-school issue.

DfE describes the filtering change as clarifying existing expectations. Mobile phone guidance also became statutory. Paragraph references here follow the consultation response.

Ofsted and the Academy Trust Handbook

Ofsted does not inspect AI tools as such. Inspectors consider whether leaders' decisions about AI are sensible and serve pupils, and treat data protection, safeguarding and bias within existing judgements. Ofsted calls its position non-final. Exams, marking and malpractice are covered in the Ofqual, Ofsted and DfE guide for educators.

The Academy Trust Handbook 2026, effective 1 October 2026, has no AI-specific content on its landing page. Its 2026 changes clarify procurement of energy and management information systems at paragraphs 2.29 and 2.30, which matters when AI features arrive inside an MIS contract.

What it means in practice and for cover

Record the annual filtering review, including generative AI, and report it to the board.
Keep an approved tools list with DPO sign-off, and update privacy notices.
Add AI and deepfakes to safeguarding and online safety policies.
Treat cyber security as a safeguarding item on the board agenda.
Require staff to check and own AI-drafted documents.

A school that can show it followed this guidance is better placed if a claim follows. RPA Section 5 governors' liability and commercial D&O respond to claims alleging breach of duty, subject to their terms, but regulatory penalties are excluded. See governor liability for AI, the filtering review, pupil deepfakes, school AI policies and the schools hub.

Apex arranges governors' D&O for independent schools and academy trusts; a broker can map these duties against your governors' D&O or RPA position.

Sources

Frequently asked

Is DfE's generative AI guidance statutory?

No. The Generative AI in education policy and the data protection pages are advice. They are still the benchmark for what a reasonable school does, and they explain how to meet UK GDPR, which is law. KCSIE 2026 is statutory guidance and now includes AI paragraphs.

When did KCSIE 2026 come into force?

KCSIE 2026 came into force on 1 September 2026. DfE's consultation response describes new generative AI paragraphs, AI-generated images within image-making offences, an annual filtering review under paragraph 166 and cyber security as a safeguarding issue.

Will Ofsted inspect our AI tools?

Ofsted says it does not inspect AI tools as such. Inspectors look at whether leaders' AI decisions are sensible and serve pupils, and consider data protection, safeguarding and bias within existing judgements. Ofsted describes this position as non-final.

Is there DfE AI guidance for governors?

No DfE AI guidance aimed specifically at governors or trust boards was found. Governors' AI responsibilities come through KCSIE filtering, monitoring and cyber duties, data protection law, and Ofsted's leadership and management judgement.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.