FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Training providers and educators
Providers should not put identifiable learner data into generative AI tools, and must not use learners' work to train AI without permission. Breaches lead to complaints, regulatory attention and data protection claims.
Part of: AI in training providers and educators
In short
Tutors and trainers may paste learner work, names and grades into AI tools. The DfE recommends that personal data is not entered into generative AI and that anything entered should not identify individuals. Students' work must not be used to train generative AI without permission or a copyright exception. Ofsted treats AI data use like other personal data handling. Commercial trainers are bound by data protection law and client confidentiality. Claims may fall under PI, cyber or both, and fines are often uninsurable, so approved tools and de-identification matter.
Tutors and assessors paste learner essays into a generative AI chatbot to get feedback suggestions, upload portfolios to summarise evidence, record sessions for AI transcription, or ask an AI assistant to draft progress reports that include names, grades, attendance and support needs. Corporate trainers may upload delegate lists, assessment results or 360 feedback. Each step moves personal data, and often learners' original work, into a third party's system.
The DfE's Generative AI in education guidance (updated 12 August 2025) is written for schools and colleges but sets a clear benchmark:
Ofsted treats AI data use like other personal data handling, and inspectors may ask questions similar to those they ask about other data collection and storage. Commercial trainers have no sector rule, but UK data protection law applies to every provider.
Learners usually own the copyright in what they write. Uploading it to a tool whose terms allow the supplier to use inputs for training can mean using that work in a way the learner never agreed to. The DfE position is explicit that this needs permission or a copyright exception. The same applies to client materials a corporate trainer has been given under a confidentiality obligation. If those materials are reused or exposed, the client may claim breach of confidence or breach of contract, separately from any data protection complaint.
Illustrative scenario: a college tutor uses a free generative AI chatbot on a personal account to mark a batch of assignments, pasting in names and support plan details. A learner later finds out and complains to the college and the regulator. The college has to investigate, notify affected learners and deal with complaints, and several learners pursue compensation for distress.
Other examples include session recordings of a coaching programme stored by a transcription supplier abroad, or a corporate client discovering its internal case studies were fed into a public AI tool.
Civil claims for breach of data protection law or confidentiality may be covered under a PI policy, a cyber policy or both, depending on the wordings. Regulatory fines are often uninsurable or excluded, though investigation costs may be covered. See GDPR fines versus civil claims, cyber cover for education and pupil data and whether PI covers IP infringement.
Apex arranges PI for training providers and educators, and can check how the two fit together for AI data incidents. See the training providers Aipedia hub, AI tutors and chatbots and telling learners you use AI.
The DfE recommends that personal data is not entered into generative AI tools, and that anything entered should not identify individuals. Remove names and identifiers, use an approved tool whose terms prevent training on inputs, and get permission if the work could be used to train a model.
Yes. The DfE guidance says students' work must not be used to train generative AI without permission from the student, or a parent or guardian for minors, unless a copyright exception applies. Learners usually own the copyright in what they produce.
It can be either or both. Civil claims for misuse of personal data may sit under PI, while incident response, notification costs and regulatory investigation are more often cyber cover. Policies overlap and exclude in different ways, so check how yours fit together.
The DfE guidance is written for schools and colleges, but UK data protection law applies to every provider, and corporate clients usually impose confidentiality terms. The DfE approach of not entering identifiable data and not training models on others' work without permission is a sensible standard for any trainer.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
