AI Policy for Multi Academy Trusts: One Policy, Many Schools

A multi academy trust should have one trust-wide AI policy, owned by the trust board, with a short local annex for each school. The academies in a trust are not separate legal bodies, so data protection, safeguarding duties and platform contracts all sit with the trust. Local schools then decide the day-to-day detail the scheme of delegation allows them to.

I'm a governor at a single primary school, not a trust leader. But I've spent most of my career in technology and transformation in large organisations, and the problems trusts run into with AI look a lot like the ones big organisations hit: fifteen schools, fifteen tools, fifteen policies, and nobody quite sure who signed off what. This guide is about fixing that without crushing the good work already happening in your schools.

What's in this guide

• Should a MAT have one AI policy or one per school?
• Who owns what in a trust's AI policy?
• What must a trust-wide AI policy cover in 2026?
• How do you choose a trust-wide AI platform?
• What does a phased AI rollout across a trust look like?
• What goes in the policy, section by section?
• How should AI be reported to the trust board?
• What should be on a MAT's AI policy checklist?
• Frequently asked questions

Should a MAT have one AI policy or one per school?

One trust-wide policy with local annexes is the right model for almost every trust. Separate school policies create gaps and contradictions, and they don't match where legal responsibility actually sits.

Why the legal structure points to one policy

A multi academy trust is a single charitable company. Its academies are not separate legal entities. That has three practical effects for AI:

• Data protection. The trust is normally the single data controller for every school, registered once with the ICO and with one data protection officer. If a teacher in one school puts pupil data into an unapproved chatbot, the breach belongs to the trust. Check your own ICO registration and privacy notices to confirm how your trust is set up.
• Contracts. Microsoft 365, Google Workspace for Education and most edtech contracts are signed by the trust. The policy should match the tools the trust has actually bought.
• Accountability. The trust board is accountable for the trust's schools. The Academy Trust Handbook sets out how the board and its committees govern, and local governing bodies only hold the powers the board delegates to them.

What the local annex is for

The annex is where schools make the policy real without rewriting it. Keep it to one page. It should name the school's AI lead, DSL and filtering and monitoring lead, list any extra approved tools for that phase, set pupil use rules suitable for the age range, and record local training dates. A primary school's annex and a secondary school's annex will look quite different, and that's fine.

How the scheme of delegation fits in

Your scheme of delegation is the document that says who decides what. Add AI to it explicitly. A sensible split is:

• Reserved to the board: approving the trust AI policy, the AI risk appetite and the choice of trust-wide platform.
• Delegated to the CEO and executive: the approved tools list, DPIAs, supplier due diligence, training plans and incident handling.
• Delegated to headteachers and local governing bodies: the local annex, monitoring that the policy is followed in school, and reporting concerns upwards.

If AI isn't in the scheme of delegation, it will be decided wherever the most enthusiastic person happens to work. Writing it down is ten minutes of work that saves a lot of confusion.

Who owns what in a trust's AI policy?

The trust board owns the policy and the risk; the executive runs it; schools apply it. The table below is a starting point for your own responsibilities section.

The DfE filtering and monitoring standards say a member of the senior leadership team and a governor are responsible for making sure the standards are met, with the DSL leading on safeguarding and IT support handling the technical side. In a trust, decide whether that governor role sits with a trustee, a local governor at each school, or both, and write it down. If you're setting up the executive group, my guide to setting up an AI steering group in a multi academy trust covers membership and terms of reference.

What must a trust-wide AI policy cover in 2026?

Your policy needs to line up with six sets of rules: KCSIE 2026, the DfE generative AI guidance, the DfE product safety standards, the filtering and monitoring standards, UK GDPR, and JCQ rules for schools that run qualifications. The Academy Trust Handbook matters for buying and digital standards, but it doesn't set AI rules.

Keeping children safe in education 2026

KCSIE 2026 has applied since 1 September 2026, and it applies to academy trusts as well as maintained schools. The AI-related changes that matter most for a trust policy are:

• Online safety now covers AI-generated content and interactions with generative AI, including chatbots that act like a person, as a contact risk.
• The wording on nudes and semi-nudes now includes images that are digitally altered or created using AI, so deepfakes belong in your child-on-child abuse procedures.
• The annual filtering and monitoring review is spelt out more clearly, led by the responsible senior leader with support from the DSL and IT.

My summary of the KCSIE 2026 AI changes goes through each one. Always check the wording against the DfE document itself.

The DfE generative AI in education guidance

The DfE's generative AI in education guidance is non-statutory, but it's the clearest statement of what the department expects. Points to build into your policy:

• It recommends that personal data is not used in generative AI tools.
• Schools and colleges must not allow or cause pupils' original work to be used to train generative AI models without permission or an exception.
• Pupils should only use generative AI in school with appropriate safeguards, such as close supervision and filtering.
• The quality and content of any final document remains the responsibility of the professional who produced it.
• Settings should follow the age restrictions that AI tools set.

For staff rules in more detail, see what the DfE says about personal data and AI.

The DfE generative AI product safety standards

The DfE's product safety expectations were renamed Generative AI: product safety standards when they were updated on 19 January 2026. They're written for edtech suppliers, but schools and trusts can use them to judge tools. The 2026 update added standards on cognitive development, emotional and social development, mental health and manipulation. Your policy should say that no AI tool is approved for pupils until it has been checked against these standards. I explain how to use them in the DfE product safety standards explained.

Filtering and monitoring standards

The filtering and monitoring standards now name AI-generated content directly. They expect the review to cover how generative AI tools are used, and whether your system can actually filter AI content. Bringing in a new AI tool should trigger an extra review. The standards also say blocklists must not be disabled or changed by any user in a school, college or multi academy trust. That's a useful line when a school asks for a local exception. More in my filtering and monitoring AI summary.

UK GDPR and DPIAs

Most AI tools that touch pupil or staff data will need a data protection impact assessment. The ICO explains when a DPIA is needed. In a trust, do the DPIA once, centrally, per tool, and have schools add a short local note if their use is different. Fifteen schools each doing their own DPIA for the same platform wastes time and produces fifteen different answers. My guide to doing an AI DPIA for schools has a worked structure.

JCQ rules for secondary schools

If your trust has secondary schools, sixth forms or any centre running JCQ qualifications, the policy must point to JCQ's AI Use in Assessments guidance. At the time of writing, the version on JCQ's site is the one effective from 30 April 2025. Check for a newer one each year. Centres must make sure pupils and staff have clear rules on AI use in coursework and non-exam assessment. A trust-wide approach makes sense here, because exams officers and heads of centre benefit from the same wording. See JCQ guidance on AI in assessments explained.

What the Academy Trust Handbook says

The Academy Trust Handbook doesn't contain AI-specific rules, as far as I can find. The 2026 edition, in force from 1 October 2026, still matters in two ways. First, it expects trusts to be working towards the DfE's six core digital and technology standards by 2030, and those include cyber security and filtering and monitoring. Second, its procurement rules apply to AI purchases like any other spending. That includes considering the DfE's Get help buying for schools service, and a new requirement to align MIS contracts with the DfE MIS framework by September 2027. If AI features start arriving in your MIS, that matters. Check the current handbook for exact wording.

How do you choose a trust-wide AI platform?

Start with the ecosystem your trust already runs on. If your schools are on Microsoft 365, Copilot is usually the lowest-risk first platform. If you're on Google Workspace for Education, Gemini is. Add specialist tools only where they do something the main platform can't.

Sources: Microsoft Copilot in education and Google's Gemini for Education admin guide. Licensing changes often, so check both pages and get a UK quote from your licensing partner before you budget.

Questions to ask before you choose

1. Which licences do we already have, across every school? Many trusts find schools on different editions. Fix that first.
2. What are our pupils' ages? A mostly-primary trust can't rely on a tool that is only for over-13s for pupil use.
3. Does it meet the DfE product safety standards? Ask the supplier for written answers.
4. Can we control it centrally? Can it be switched on by group or year, logged, and switched off quickly?
5. Where is the data processed, and is it used for training? Get this in the contract, not just on a web page.
6. What does it really cost at full scale? Price it for every member of staff, not the pilot group.

For the detail on each platform, see Microsoft Copilot for UK schools and Google Gemini for UK schools.

What does a phased AI rollout across a trust look like?

Roll out in four phases over about a year: foundations, pilot, scale, review. Don't switch everything on for everyone on day one, and don't let a pilot drift on for two years either.

1. Foundations (first half-term). Board approves the policy and risk appetite. Add AI to the scheme of delegation. Audit what tools schools already use. Complete the DPIA for the main platform.
2. Pilot (one term). Two or three schools of different phases, staff use only, a small set of agreed tasks such as planning, letters and reports. Collect time saved and problems.
3. Scale (one to two terms). Train all staff, roll out staff access trust-wide, and agree whether and how pupils will use AI by phase. Update filtering and monitoring reviews in every school.
4. Review (ongoing). Annual policy review, termly board reporting, and a clear route for schools to request new tools.

My AI rollout plan for multi academy trusts breaks these phases into weeks, with a 12-month timeline. Training is usually the bottleneck, so plan it early.

What goes in the policy, section by section?

A good trust AI policy is short, around six to ten pages, with the detail in appendices. Here's the outline I'd use.

1. Purpose and scope. Covers every school, central team, trustee and governor, and all AI tools, including AI features inside existing software.
2. Principles. Human oversight, safeguarding first, no personal data in unapproved tools, honesty about AI use.
3. Roles and responsibilities. Board, CEO, AI lead, DPO, DSLs, IT and headteachers, matching the scheme of delegation.
4. Approved tools. A link to the live tools register, and the process for requesting a new tool.
5. Staff use. What's allowed, what's not, and checking outputs. Link to a staff AI acceptable use policy.
6. Pupil use. Rules by phase and age, supervision, and the age limits of each tool.
7. Data protection. DPIAs, personal data, pupil work not used for training, privacy notices.
8. Safeguarding. Deepfakes, chatbots, filtering and monitoring, and reporting concerns to the DSL.
9. Assessment and academic integrity. JCQ rules for secondary schools, and homework expectations.
10. Procurement and suppliers. Product safety standards checks, contract terms, Academy Trust Handbook rules.
11. Training. Who gets what, and how often.
12. Incidents and breaches. How AI-related incidents are logged and escalated.
13. Monitoring and review. Annual review date and board reporting.
14. Appendix: local annex template. The one-page school annex.

If you want a starting draft, my free AI policy template for UK schools covers most of these sections. Add the trust-level roles, scheme of delegation and annex on top.

How should AI be reported to the trust board?

Give the board a short AI update every term, with a fuller annual review. Trustees need to see risk, compliance and benefit, not a tour of features.

Put AI on the trust risk register as its own line. Common entries are data breaches through unapproved tools, safeguarding harm from AI content, academic malpractice, and money spent on tools nobody uses. For governors and trustees who want a primer first, my governor AI briefing deck is free to use in a board meeting.

What should be on a MAT's AI policy checklist?

Use this list to check your trust is covered. If you can tick every line, you're in a better place than most.

• One trust-wide AI policy, approved by the trust board, with a review date.
• AI decisions written into the scheme of delegation.
• A one-page local annex for each school, signed off by the headteacher.
• A named executive AI lead or steering group.
• A live register of approved AI tools, with a request process.
• A central DPIA for each approved tool, signed off with the DPO.
• Each pupil-facing tool checked against the DfE product safety standards.
• Age limits recorded for each tool and followed.
• A clear rule that personal data goes only into approved tools, and pupil work is not used to train models.
• Safeguarding policies updated for deepfakes and AI chatbots, in line with KCSIE 2026.
• Filtering and monitoring reviewed in every school this academic year, with AI tools in scope and a dated record.
• JCQ AI rules shared with staff and candidates in every exam centre.
• AI training for all staff, with completion tracked.
• AI on the trust risk register, with termly board reporting.

To score your current position, try the free AI policy health check. It takes two minutes and works for each school in the trust.

If you'd rather have help, I write tailored AI policies from £495 and run staff training from £395. Details are on the packages page. For trust-wide work, get in touch.