Aipedia: Schools, academies and governors

AI in schools: governor duties, risks and cover

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Schools may use AI, but DfE makes the professional and the school responsible for its output, and KCSIE 2026 asks governors to oversee filtering, monitoring and cyber security. That turns everyday AI use into a governance question, with safeguarding, data protection and liability consequences.

Part of: AI in schools, academies and governors

In short

There is no AI law written for schools. The rules come from DfE guidance on generative AI and data protection, KCSIE 2026 and Ofsted's leadership judgement. DfE recommends that pupils' personal data is not put into generative AI tools, and says a document remains the responsibility of the professional and their organisation regardless of the tools used. KCSIE 2026 asks governing bodies to ensure an annual filtering review that covers generative AI, and frames cyber security as safeguarding. AI-related claims usually fall to RPA governors' liability, commercial D&O, PI or cyber, but fines and penalties are excluded.

How schools and trusts use AI

AI may reach schools through ordinary software rather than a single decision. Teachers use generative AI chatbots to plan lessons, adapt resources and draft feedback. Office teams use AI assistants for parent letters and newsletters. SENCOs draft support plans and annual review contributions. Bursars and school business managers forecast budgets and summarise supplier contracts. Clerks and heads draft governor packs and minutes. Safeguarding and behaviour platforms add AI summaries and analytics, and some schools use biometrics for canteens and site access.

The DfE's Generative AI in education policy says teacher-facing uses such as planning, resources, feedback and admin have "more immediate benefits and fewer risks" than pupil-facing uses. Pupil-facing tools need safeguards, and pupils' own use raises separate questions, from homework to deepfake images of classmates.

The rules that apply

Governors' AI duties come through existing frameworks. No DfE AI guidance aimed specifically at governors or trust boards was found. The main sources are:

Source	Status	What it means for AI
DfE, Generative AI in education (2023, updated August 2025)	Departmental policy and advice	Check output; avoid personal data; transparency on automated decisions; safeguarding and cyber planning; no training on pupils' work without permission
DfE, Data protection in schools AI section (updated 14 October 2026)	Guidance on how to meet UK GDPR	Anonymise first; DPO or IT lead approval before using personal data; privacy notices must cover AI
KCSIE 2026 (in force 1 September 2026)	Statutory guidance	New generative AI paragraphs; AI-generated images treated as "making" images; annual filtering review; cyber security as safeguarding
Ofsted (updated 21 October 2025)	Inspection approach, described as non-final	Does not inspect AI tools as such; judges whether leaders' AI decisions are sensible and serve pupils
UK GDPR Articles 22A to 22D	Law, in force 5 February 2026	Safeguards for significant decisions based solely on automated processing
Academy Trust Handbook 2026	DfE handbook for academy trusts	No AI-specific content found; procurement of energy and MIS clarified

The detail, and which parts are statutory, is in DfE, KCSIE and Ofsted AI rules for schools. Exams, marking and assessment malpractice are covered in the Ofqual, Ofsted and DfE guide for educators.

What governors and trustees are accountable for

Filtering and monitoring: under KCSIE 2026 paragraph 166, governing bodies and proprietors should ensure filtering effectiveness is reviewed at least once every academic year, across all internet-connected devices and relevant locations, with records kept. Governors ensure the checks happen; they do not carry them out.
Cyber security: KCSIE 2026 frames it as part of safeguarding and a whole-school issue, not something left to individuals or external providers.
Online safety policy: AI belongs in safeguarding policies under KCSIE.
Data protection: the school or trust is the controller. It must involve the DPO before personal data is used in AI, carry out a DPIA for high-risk processing and explain AI use in privacy notices.
Charity trustees: where an independent school or academy trust is a charity, the duty of reasonable care and skill and collective responsibility for delegated decisions in the Charity Commission's CC3 apply to AI-assisted decisions too.

The main risks

Staff entering pupil data into unapproved tools, leading to breaches and complaints.
Inaccurate AI drafts in SEND paperwork, parent letters, safeguarding records and governor minutes, which the school still owns.
Filtering that misses generative AI, and pupils creating deepfake or nude images of classmates or staff.
Automated or AI-shaped decisions on behaviour, exclusions and recruitment, challenged by parents or candidates.
Biometrics introduced without a DPIA or valid consent, as in the ICO's 2024 reprimand of Chelmer Valley High School.
AI-crafted phishing and payment diversion aimed at finance teams.

How RPA, D&O and PI respond

No statutory requirement for schools to buy D&O or PI was found. Academies and eligible maintained schools can join the DfE Risk Protection Arrangement (RPA) instead of buying commercial insurance. Under the September 2026 RPA rules for academy trusts:

Section 5, Governors' Liability: £10,000,000 any one loss and in the aggregate per Membership Year, nil retention, claims-made. "Governor" includes members, trustees and local governing body members. Exclusions include criminal fines and regulatory penalties, dishonesty, personal injury and acts known to be a breach of duty or done in reckless disregard.
Section 6, Professional Indemnity: unlimited, £1,000 retention, claims-made.
Section 14, Cyber: £250,000 per member per year, covering increased cost of working and incident response.

The rules reviewed do not mention artificial intelligence, so AI-related claims are judged under the ordinary wording. Independent schools buy commercial cover; where the school is a charity, trustee insurance cannot cover regulatory penalties under Charities Act 2011 s.189. See D&O for academy trusts and schools, RPA versus commercial insurance, trustee indemnity for charities and cyber cover for pupil data.

Aipedia guides for schools, academies and governors

DfE, KCSIE and Ofsted AI rules for schools: what is statutory and what is advice.
Staff putting pupil data into AI tools: anonymising, DPO approval and breach exposure.
AI filtering and monitoring: governor checks: the annual review under paragraph 166.
AI for SEND support plans and EHCP evidence: accuracy where tribunal appeals follow.
AI-drafted letters and emails to parents: misstatements and wrong-family errors.
AI in safeguarding logs and DSL notes: summaries that can distort disclosures.
Pupil deepfakes and AI-generated images: KCSIE's image-making change and response duties.
AI in behaviour tracking and exclusion decisions: automated decision limits and panel scrutiny.
AI for bursars: budgets, procurement and contracts: financial errors and Handbook expectations.
AI in teacher and support staff recruitment: safer recruitment that cannot be automated.
Facial recognition and biometrics in schools: lessons from the Chelmer Valley reprimand.
AI-written governor packs and minutes: deciding on summarised data.
AI-powered phishing and cyber attacks on schools: RPA cyber limits and commercial options.
Governor liability for AI: RPA and D&O: how Section 5 and D&O respond.
School AI policies: what boards should approve: the contents of a defensible policy.

How Apex helps

Apex arranges governors' D&O for independent schools and academy trusts, alongside or instead of the RPA. A broker can review how your governors' cover, PI and cyber would treat AI-related claims and where gaps sit; the education insurance guide explains the wider programme.

Sources

Frequently asked

Is there a law on AI in schools?

No AI-specific law for schools was found. Duties come from UK GDPR, including Articles 22A to 22D on automated decisions, KCSIE 2026 as statutory guidance, DfE advice on generative AI and data protection, and Ofsted's judgement of whether leaders' AI decisions are sensible and serve pupils.

Do governors have to approve AI tools themselves?

Not personally. KCSIE 2026 asks governing bodies to ensure filtering is reviewed annually and that cyber security is treated as safeguarding. Governors should expect a policy, a DPO approval route for tools and regular reporting, rather than choosing products themselves.

Does RPA governors' liability cover AI mistakes?

The September 2026 RPA rules do not mention AI. A claim against governors arising from an AI-assisted decision would usually be considered under Section 5 like any other claim, subject to its exclusions, including criminal fines, regulatory penalties and reckless breaches of duty.

Do independent schools have the RPA?

No. The RPA is for academies and eligible maintained schools. Independent schools arrange commercial D&O or trustee indemnity, PI and cyber, and where the school is a charity the Charities Act 2011 s.189 limits on trustee insurance apply.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.