Every school in England now needs a clear position on artificial intelligence. This guide gives you everything in one place: what the DfE and KCSIE actually expect, the 12 sections a good policy covers, a free model policy you can copy and adapt, and a simple plan for getting it approved and working. It's written by a school governor who has done this for his own school.
Last updated: 6 October 2026 · Written by Neil Brooker Kidd, primary school governor and founder of AskColin
Do UK schools have to have an AI policy?
There is no single statutory "AI policy" document that the DfE requires in England. But in practice every school now needs one, because the duties that AI touches are statutory:
- Safeguarding. AI has been referenced in Keeping Children Safe in Education since KCSIE 2025, and KCSIE 2026 goes further. See our KCSIE and AI timeline.
- Data protection. UK GDPR applies to any personal data staff put into AI tools. See what the DfE says about personal data and AI.
- Assessment. JCQ rules govern AI in coursework and exams. See JCQ guidance explained.
- Direction of travel. The Seldon report calls for a governor-approved AI strategy in every school by September 2027.
Without a written policy, staff make it up as they go – usually with personal accounts and pupil data in the mix. A short, clear policy fixes that.
What the DfE guidance expects
The DfE's guidance on generative AI in education sets the principles your policy should reflect. In summary, schools should:
- Protect personal and special category data in line with data protection law.
- Not allow pupils' original work to be used to train AI models without appropriate permission.
- Make sure AI use is safe and appropriate, with safeguarding in mind.
- Recognise that AI can produce inaccurate or biased content, so outputs need checking.
- Be transparent about how AI is used.
For pupil-facing tools, the DfE's generative AI product safety expectations set the standard. Our summary of the DfE guidance goes into more detail.
The 12 sections every school AI policy needs
| # | Section | What it answers |
|---|---|---|
| 1 | Purpose | Why the school uses AI, and the principles behind it |
| 2 | Scope | Who and what the policy covers |
| 3 | Roles | Head, AI lead, DSL, DPO, governors |
| 4 | Approved tools | Which tools staff may use, and for what |
| 5 | Data protection | What can and cannot be entered into AI |
| 6 | Staff use | Encouraged uses, checking outputs, no decisions about people |
| 7 | Pupil use | What pupils can do, and assessment rules |
| 8 | Safeguarding | Filtering, monitoring, deepfakes, reporting concerns |
| 9 | Parents | How the school communicates its approach |
| 10 | Training | What staff are trained on, and when |
| 11 | Breaches | What happens when it goes wrong |
| 12 | Review | Annual review and who signs it off |
Free school AI policy template (copy and adapt)
Prefer a file? Download the AI policy template as a PDF, or get the editable Word version using the form below.
Here is a complete model AI policy for a UK school. Copy it into your own policy template, replace the bracketed sections, and take it through your normal approval process. It is deliberately short – a policy staff actually read is worth more than a long one nobody opens.
[School name] – Artificial Intelligence (AI) Policy
Approved by governors: [date] · Review date: [date + 12 months] · AI lead: [name, role]
1. Purpose
[School name] uses artificial intelligence to reduce staff workload and support teaching and learning. AI supports our staff; it does not replace their professional judgement. We use AI safely, lawfully and transparently, in line with Keeping Children Safe in Education, the DfE's guidance on generative AI in education, and UK GDPR.
2. Scope
This policy applies to all staff, governors, volunteers, contractors and pupils, and to any AI tool used for school business – on school or personal devices.
3. Roles and responsibilities
The headteacher has overall responsibility. The AI lead [name] maintains the approved tools list and coordinates training. The DSL ensures AI is covered by filtering, monitoring and online safety arrangements. The Data Protection Officer advises on data protection impact assessments. Governors approve this policy and receive an annual report.
4. Approved tools
Staff may only use the AI tools listed in Appendix A, for the purposes listed, signed in with school accounts. Requests for new tools go to the AI lead and are assessed for data protection, safeguarding and suitability before use.
5. Data protection
Identifiable personal data about pupils, staff or families must not be entered into any AI tool unless Appendix A states that the tool is approved for that purpose and a data protection impact assessment is in place. Special category data (including health, SEN and safeguarding information) must never be entered. Staff anonymise information wherever possible. Pupils' work will not be used to train AI models without appropriate permission.
6. Staff use
Staff may use approved AI tools to support planning, resource creation, drafting communications and administrative tasks. Staff remain responsible for any content they produce with AI and must check all outputs for accuracy, bias and appropriateness before use. AI must not be used to make decisions about pupils or staff.
7. Pupil use
[Primary: Pupils do not use general AI tools independently. Any AI use in lessons is led by the teacher.] [Secondary: Pupils may use school-approved AI tools as directed by staff. Rules on AI in assessed work follow JCQ guidance and are set out for each task.] All pupils are taught about AI as part of online safety and computing.
8. Safeguarding
AI is included in the school's filtering and monitoring arrangements, which are reviewed at least annually. Staff report any concern involving AI – including AI-generated images of pupils or staff – to the DSL under the child protection policy.
9. Parents and carers
The school explains its use of AI on its website and in its privacy notice, and informs parents of significant changes.
10. Training
All staff receive training on this policy and the approved tools, refreshed annually.
11. Breaches
Misuse of AI is dealt with under the staff code of conduct or behaviour policy. Any suspected data breach is reported to the DPO immediately.
12. Review
This policy is reviewed annually, or sooner if guidance or technology changes significantly.
This policy is based on the free AI policy template for UK schools from AskColin – askcolin.uk.
Appendix A – Approved AI tools
Tool · Approved for · Personal data permitted? · DPIA in place?
[e.g. Microsoft Copilot Chat (school account) · planning, drafting, resources · anonymised only · yes]
Get the Word version (free)
A ready-to-edit Word document with the school name, dates and approved-tools table set up for you. Enter your email and the download link appears straight away.
Free to use: any school can copy and adapt this template. All we ask is that you keep the credit line at the bottom – it's how we keep it free.
For primary-specific wording, see primary school AI policy: what to include. Pair the policy with a one-page staff AI acceptable use agreement that every member of staff signs.
Want your AI policy done for you?
Tell me what you're trying to sort out — a tool, a policy, a parent question, a workload problem — and I'll give you a straight answer.
Primary, secondary and trust differences
Primary schools
Most AI tools have minimum ages of 13 or 18, so a primary policy is mainly about staff use, with pupil use limited to teacher-led activities. The parent section matters more – primary parents ask the most questions. See safe AI activities for KS2.
Secondary schools
Secondary policies need a fuller pupil section: which tools pupils can use, on which accounts, and clear rules on AI in homework and coursework under JCQ. See Copilot for students and how teachers check for AI.
Multi-academy trusts
Trusts usually set a trust-wide policy with a school-level appendix for approved tools and local contacts. See an AI rollout plan for MATs.
How to write and launch it in one term
- Week 1–2: name an AI lead and audit. Run a quick anonymous staff survey: which AI tools are people using, on which accounts, for what? You'll almost certainly find personal ChatGPT accounts in use.
- Week 3: choose your approved tools. Usually Copilot or Gemini on school accounts, which most schools already have. See how to choose safe AI tools.
- Week 4: complete a DPIA for any tool that will touch personal data. See how to do an AI DPIA.
- Week 5–6: draft and consult. Adapt the template above; share with the DSL, DPO, SLT and a few teachers.
- Week 7: governors approve. A short governor briefing makes this quick.
- Week 8–10: train staff. A hands-on session on the approved tool, with the rules built in. See how to train school staff in AI.
- Week 11–12: tell parents and update safeguarding. Publish a plain-English page and add AI to your filtering and monitoring review and safeguarding policy.
Seven common mistakes
- A "holding statement" instead of a policy. "Staff should use AI responsibly" tells nobody what to do.
- No named tools. If the policy doesn't name the approved tools, staff will choose their own.
- Banning everything. Blanket bans push staff onto personal accounts and phones – worse for data protection, not better.
- Forgetting safeguarding. AI belongs in your filtering and monitoring review and DSL training, including deepfakes.
- No pupil photo rule. Staff uploading class photos to AI image tools is one of the most common breaches. See AI image generators in schools.
- No training. A policy nobody has been trained on doesn't change behaviour.
- No review date. AI and the guidance change fast. Review annually at least.
Don't want to write it yourself?
I'm a governor at Worple Primary School in Hounslow, and I wrote our AI policy, staff agreement, governor briefing and parent letter myself. Through AskColin I now do the same for other schools – a complete, tailored AI document set for £495, usually turned around within a week, including a call to understand your school and a follow-up once it's in place. Or ask me a question first – I reply the same day.
Frequently asked questions
Do UK schools need an AI policy?
There is no single statutory AI policy document, but schools must meet safeguarding, data protection and assessment duties that AI affects. A written AI policy is the clearest way to show you are doing so, and the Seldon report calls for a governor-approved AI strategy in every school by 2027.
What should a school AI policy include?
Purpose, scope, roles, approved tools, data protection, staff use, pupil use, safeguarding, parents, training, breaches and review – plus an appendix listing approved tools and what each is approved for.
Is there a free school AI policy template?
Yes. This page includes a complete model AI policy for UK schools that you can copy and adapt, with bracketed sections for your school's details.
Who should approve a school AI policy?
The governing body (or trust board), usually on the headteacher's recommendation, with input from the DSL and data protection officer.
How long should a school AI policy be?
Around four to six pages is enough, plus a one-page staff acceptable use agreement. Short, specific policies are more likely to be followed.
What does the DfE say about AI in schools?
The DfE expects schools to protect personal data, not let pupils' work train AI models without permission, check AI outputs, keep pupils safe and be transparent about AI use.
Can staff use ChatGPT under a school AI policy?
Only if the policy approves it. Many schools approve Copilot or Gemini on school accounts instead, because they come with education data protections. Personal accounts should not be used with pupil data.
How often should a school AI policy be reviewed?
At least annually, and sooner if guidance such as KCSIE changes or the school adopts significant new AI tools.
Does the UK have an AI policy for schools?
There is no single national AI policy that schools in England must adopt. The DfE publishes guidance on generative AI in education and product safety expectations, KCSIE references AI, and each school or trust sets its own AI policy within those rules.
What is the 30% rule for AI?
There is no official "30% rule" in UK education guidance. The phrase is used informally online, often to suggest AI should only do a small part of a piece of work. In schools, what matters is the school's own AI policy and, for assessed work, JCQ rules on AI use.
Is there an AI policy for schools PDF?
Yes. This page includes a free AI policy template for UK schools as a PDF, plus an editable Word version you can adapt for your school.