Is It Legal to Use AI to Mark Pupils' Work in the UK?

Yes, in most cases it is legal for UK teachers to use AI to help mark pupils' work, especially for everyday feedback and low-stakes quizzes. But it comes with real conditions: the school has to treat pupil work as personal data, use an approved tool that doesn't train on it, and keep a teacher genuinely in charge of every mark. For GCSE and A level coursework, the rules are stricter still.

I'm a governor at a primary school in Hounslow, and "can we use AI for marking?" is now one of the questions I hear most from staff. Marking is where the workload pain is, so it's where people reach for AI first. This guide sets out what the law and the regulators actually say, as of October 2026, and how to do it safely.

What's in this guide

• Is it legal for teachers to use AI to mark work?
• Is pupils' work personal data?
• What does data protection law require for AI marking?
• What does the DfE say about pupils' work and AI?
• Does the automated decision-making rule stop AI marking?
• Can AI mark GCSE coursework, NEA or exams?
• Which types of marking are allowed? (table)
• How do you use AI for marking safely?
• What should your AI policy say about marking?
• What should you tell parents?
• Frequently asked questions

Is it legal for teachers to use AI to mark work?

Yes. There is no UK law that bans teachers from using AI to help mark. What there is, instead, is a set of rules that shape how you can do it: data protection law, copyright, the DfE's guidance, and, for qualifications, the rules set by JCQ and Ofqual.

The legal risk rarely comes from the marking itself. It comes from three things:

1. Where the work goes. Pasting a named pupil's essay into a free chatbot on a personal account is the classic mistake. It can be a data breach, and it may hand the pupil's work to a company that trains on it.
2. Who decides the mark. If nobody really checks what the AI says, you have a professional problem and, for some decisions, a legal one.
3. Which assessment it is. A spelling quiz and a piece of GCSE coursework are governed by completely different rules.

Get those three right and AI marking is a sensible, lawful way to reduce marking workload without cutting quality.

Is pupils' work personal data?

Usually, yes. If a piece of work can be linked to a pupil, by name, candidate number or class list, it tells you something about that pupil, so it counts as personal data under UK GDPR. The marks and comments you add to it are personal data too.

This isn't a theoretical point. Pupils and parents can already ask for marks and teacher comments through a subject access request. Work can also contain far more than you expect: a creative writing piece about home life, a reflective journal or a PSHE task can reveal health, family circumstances or safeguarding concerns. Some of that is special category data, which is more tightly protected.

Does removing the name make it anonymous?

Not always. Taking the name off helps a lot, and you should do it. But a piece of writing that mentions a pupil's brother, street, or medical condition can still identify them. The honest position is that redacted work is lower risk, not risk-free. Treat it as personal data unless you are confident nobody could work out who wrote it.

What does data protection law require for AI marking?

In short: a lawful basis, a DPIA, a proper contract with the supplier, transparency with families and tight limits on what the supplier does with the data. These are the same basics that apply to any edtech, applied a little more carefully.

1. A lawful basis

Schools usually rely on "public task" for processing linked to teaching and assessment, because marking is part of their core function. You don't normally need consent to mark work, with or without AI. Your DPO should confirm the basis and record it.

2. A data protection impact assessment (DPIA)

The ICO lists "new technologies, or the novel application of existing technologies (including AI)" among the types of processing likely to be high risk, in its examples of processing likely to result in high risk. Add children's data and it's hard to argue a DPIA isn't needed. Do it before staff start uploading work. Our step-by-step guide on how to do an AI DPIA for schools walks through it.

3. A processor contract

When a marking tool handles pupil work on your behalf, the supplier is usually your data processor. UK GDPR requires a written contract (Article 28) covering what they can do with the data, security, sub-processors, where data is stored, and deletion. In practice this is the supplier's data processing agreement. If a tool can't give you one, don't use it with pupil work.

4. No training on pupil work

Check, in writing, that the supplier won't use pupil work or your prompts to train or improve its models. Consumer accounts on general chatbots are often the problem here. Education and enterprise plans usually switch training off by default, but check the current terms, not a sales page. We go through the main tools in is ChatGPT GDPR compliant for UK school data?

5. Data minimisation and retention

Only upload what the AI needs to do the job. Remove names, candidate numbers and anything sensitive. Know how long the tool keeps uploads and chat history, and delete them in line with your retention schedule.

What does the DfE say about pupils' work and AI?

The DfE says schools must not let pupils' original work be used to train AI models without permission, recommends keeping personal data out of generative AI tools, and says teachers stay responsible for anything AI produces. All of this is in its policy paper Generative artificial intelligence (AI) in education.

Pupils' work and intellectual property

This is the part most schools miss. The DfE points out that work created by pupils, such as essays and homework, may well be copyright material owned by the pupil. It says schools and colleges must not allow or cause pupils' original work to be used to train generative AI models unless they have permission or an exception to copyright applies. Permission has to come from the pupil as the copyright owner, or from a parent or guardian if the pupil is too young to consent. The DfE notes that exceptions are limited and suggests taking legal advice.

So "the tool might train on it" isn't just a data protection question. It's a copyright one too. The simplest fix is to only use tools that contractually don't train on your inputs.

Personal data

The same guidance recommends that personal data is not put into generative AI tools, and warns that many free tools use what users type to further train their models. It also says schools should make sure pupils and parents understand when their personal data is being processed by AI. Our summary of DfE guidance on personal data and generative AI covers this in more detail.

Professional judgement

The DfE is clear that staff must use their professional judgement with these tools, that AI output needs checking for accuracy and appropriateness, and that responsibility for the final product stays with the professional and their organisation. For marking, that means the mark is yours, not the tool's.

Does the automated decision-making rule stop AI marking?

Not if a teacher genuinely reviews the work and decides the mark. The automated decision-making rules only bite when a significant decision is made with no meaningful human involvement.

What changed in 2026

The old UK GDPR Article 22 has been replaced. Under the Data (Use and Access) Act 2025, new Articles 22A to 22D took effect in full on 5 February 2026. In plain English:

• A decision is "based solely on automated processing" if there is no meaningful human involvement in taking it.
• A decision is "significant" if it has a legal effect on the person or a similarly significant effect.
• Solely automated significant decisions are now allowed more widely, but only with safeguards, including telling the person about the decision, letting them make representations, getting human intervention, and letting them contest it.
• Stricter limits remain where the decision is based on special category data, such as health information.

What it means for marking

A spelling score or a piece of formative feedback is very unlikely to be a "significant decision". A grade that decides a pupil's set, a predicted grade sent to a sixth form or university, or a final coursework mark is a different matter. For anything with real consequences, the safest approach is simple: make sure a teacher reads the work and decides the mark. Rubber-stamping the AI's number doesn't count.

The ICO consulted on draft guidance on automated decision-making in spring 2026. The draft says meaningful human review should be active rather than passive, done by someone with the competence and authority to change the outcome, and done before the decision is final. Check the ICO website for the final version before you rely on any detail.

Can AI mark GCSE coursework, NEA or exams?

AI can help, but it can never be the sole marker of qualification work. A human assessor must read all of it and decide the mark.

What JCQ says

JCQ's document AI Use in Assessments: Your role in protecting the integrity of qualifications (the April 2025 version was current when I checked) covers non-examined assessment, coursework and internal assessment for general and vocational qualifications. On marking, it says:

• Centres may decide, "after careful consideration of any data privacy concerns", whether their teachers can use AI tools to help mark student work.
• Where they do, "an AI tool cannot be the sole marker".
• "A human assessor must review all the work in its entirety and determine the mark it warrants", regardless of what the AI tool produced.
• "The assessor remains responsible for the mark/grade awarded."

Centres are also told to make sure teachers know they must not use AI tools as the sole marker. The JCQ member awarding bodies follow this, and Pearson's own AI guidance says the same: AI should not be used as the sole method of marking a learner's work. For more on the wider rules, see our explainer on JCQ guidance on AI in assessments.

What Ofqual says

In a January 2026 blog post on using AI in marking, Ofqual said that "the use of AI as the sole mechanism for awarding marks does not comply with our current regulations", and that AI is "nowhere near ready to take over high stakes marking". It sees more potential in areas like quality assurance and marker training, with human expertise at the centre.

Exams marked by the boards

Written exam papers are marked by the exam boards, not by schools, so this mostly matters for NEA and internally assessed units. For a deeper look at what AI can and can't do with GCSE work, read can AI mark GCSE work?

Primary statutory assessment

Key stage 2 tests are marked externally by markers trained by the Standards and Testing Agency's supplier, so schools don't mark them. Writing at the end of KS2 is teacher-assessed and moderated by local authorities, as set out in the KS2 assessment and reporting arrangements. Those are statutory teacher judgements. I'd strongly advise against letting AI decide them, and you should be ready to explain every judgement to a moderator yourself.

Which types of marking are allowed? (table)

Here's how I'd summarise the position. "Allowed" means allowed with the school's approval and an approved tool, not "any tool, any account".

On reports, see can primary teachers use ChatGPT for reports safely?

How do you use AI for marking safely?

Use a school-approved tool, strip out identifying details, give it your own mark scheme, and treat what comes back as a first draft for you to check. Here's the workflow I'd suggest.

1. Use the school's approved tool only. That means the one in your DPIA, signed in with your school account, with training switched off. No personal accounts.
2. Remove identifiers. Take out names, candidate numbers and anything sensitive before uploading. Use initials or numbers you can match back yourself.
3. Give it your criteria. Paste in your success criteria or mark scheme. AI marks far more consistently against a clear rubric than against "mark this out of 10".
4. Ask for evidence, not just a score. Ask it to quote the parts of the work that meet each criterion. That makes checking quick and shows up errors.
5. Read the work yourself. Check the feedback against the actual piece. AI can be confidently wrong, miss creativity, and be thrown by spelling or handwriting.
6. Edit and own it. Change anything you disagree with. The final mark and feedback are yours.
7. Moderate a sample. Every so often, mark a few pieces without AI and compare. Look for bias, for example against pupils with EAL or SEND.
8. Delete uploads. Clear chat history and files in line with your retention schedule.

What should your AI policy say about marking?

Your AI policy should say which tools staff may use for marking, what they may and may not upload, which assessments are off limits, and who is accountable. Put it in writing so staff aren't left guessing.

• A list of approved tools for marking and feedback, linked to the DPIA for each.
• A clear ban on uploading identifiable pupil work to personal or unapproved AI accounts.
• A rule that a teacher reviews all AI-assisted marking and remains responsible for the mark.
• The JCQ rule that AI is never the sole marker of NEA or coursework, plus any extra conditions from your exam boards.
• A position on statutory assessments and teacher assessment judgements.
• A requirement that suppliers don't train on pupil work, reflecting the DfE's IP guidance.
• How the school will tell pupils and parents, and how they can raise concerns or challenge a mark.
• Who owns the policy (usually the head with the DPO), and when it's reviewed.

If you're starting from scratch, our guide on how to write an AI policy for a UK school includes a free template. Governors who want a quick overview can use our AI governor briefing.

What should you tell parents?

Tell parents plainly that AI may help with some marking, that a teacher always checks and decides, and how their child's work is protected. Openness is a legal requirement, and it also heads off complaints.

The legal part

Update your privacy notice to say that AI tools may process pupils' work, for what purpose, which suppliers are involved, and that pupil work isn't used to train AI models. The DfE expects schools to make sure pupils and parents understand when their data is processed by AI.

The human part

A short message in a newsletter usually works better than a legal notice. Something like:

"Some teachers use an approved AI tool to help them give quicker feedback on classwork. Your child's name is removed first, the tool doesn't keep or learn from their work, and a teacher always checks the feedback and decides the mark. If you have any questions, please speak to us."

For more help, see how to explain AI use in school to parents.

If you'd like help getting this right

Most schools can sort this out themselves using the steps above. If you'd rather have support, AskColin offers tailored AI policies from £495 and staff training from £395. Details are on the packages page.