#EdTech Your School Has an AI Policy. It Probably Doesn’t Work.
What school and MAT leaders need to do — and why a template isn’t enough.
Be honest. Does your school have an AI policy? If so, when did a member of staff last read it? Does it say anything useful, or does it mostly say “AI tools must be used responsibly and in accordance with the school’s values” — which is the policy equivalent of “please be good”?
Most schools that have an AI policy have a template. Someone downloaded it, added the school logo, and filed it on the server. Governors nodded it through. Job done.
Except it isn’t done. Because that policy isn’t changing anyone’s behaviour. Staff are using AI tools they’ve found themselves, with no idea whether they’re GDPR‑compliant. Students are submitting AI‑generated work, and teachers aren’t sure what the rules actually are. And if Ofsted walks in — and AI affects safeguarding, data protection or leadership decisions — being able to show how AI is governed in practice matters far more than having a document on the server.
A policy that staff don’t know about is not a policy. It’s paperwork.
Why This Matters More Than It Did Last Year
The landscape shifted significantly in 2025. Three things changed that you can’t afford to ignore.
KCSIE 2025 now explicitly mentions AI.The updated statutory guidance — in force from 1 September 2025 — references generative AI for the first time (paragraph 143). Your safeguarding obligations now include ensuring AI tools don’t bypass your filtering and monitoring, and that students are taught to protect themselves in the context of AI. This isn’t optional guidance. It’s statutory.
Ofsted now considers AI where relevant.From 2025, inspectors may consider how schools manage AI where it affects safeguarding, leadership, data protection, or pupil outcomes. Schools with no coherent approach are exposed — particularly where practice varies between classrooms or, in a trust, between schools.
The Data (Use and Access) Act 2025 is now law.It updates UK GDPR with a specific focus on children’s data online. If students are using tools that haven’t been through a DPIA, you have a compliance gap — whether you realise it or not.
Add to that: around 60% of UK teachers are already using AI at work, and 83% say it’s a time‑saver (Twinkl, March 2025). Most secondary‑age students are using it for schoolwork too. This isn’t a future problem. It’s already happening — in your school — whether you’ve planned for it or not.
The Real Problem Isn’t the Policy. It’s What Comes After It.
Schools that genuinely handle AI well have two things that template‑downloaders don’t:
A policy that gives staff and students usable guidance, not vague statements
Training that makes sure people have actually read it — and know what to do on a Monday morning
Without the training, the policy is decoration. And most schools have skipped the training entirely, because no one quite owns it and no one ever seems to have the time.
Asking staff to follow an AI policy they’ve never been trained on is like handing someone a car manual and assuming they can drive.
And this isn’t theoretical.
If a teacher enters a student’s data into an unapproved AI tool, your school may have a GDPR breach. If a student submits AI‑generated coursework and your policy doesn’t clearly define misconduct, you may not be able to act on it through JCQ processes. These aren’t edge cases. They’re happening in schools right now.
What an AI Policy Needs to Cover
Here’s a quick checklist. If you’re not sure whether your current policy covers each of these, that’s your answer.
An approved tools list — with useful information
Not just a list of names. For each tool: who can use it (staff, students, or both), whether it’s been through a DPIA, where the data is stored and for how long, whether it’s age‑appropriate for under‑18s (many popular tools, including ChatGPT, have age restrictions or require parental consent), and when it was last reviewed.
Staff guidance that genuinly guides
Staff need clear answers to practical questions. Can I use AI to help write a report? Can I upload a student’s work to get feedback suggestions? Can I use it to draft parent communications?
The answer to each of those is different, and “use AI responsibly” doesn’t answer any of them. Your policy should.
The short version: AI can support planning, drafting and admin. It cannot replace professional judgement — and it should never replace the personal feedback pupils actually learn from. Personal data must never go into an unapproved tool. Every AI output needs a human check before it reaches students or parents.
Student rules with examples, not just principles
Students need to know exactly what is and isn’t allowed. “Brainstorm with AI, then write in your own words” is clear.“Use AI responsibly” is not.
Build in declaration requirements for assessed work. Align with JCQ guidance on academic integrity. And make sure your misconduct process explicitly includes AI misuse — many still don’t.
Data protection that goes beyond “don’t share personal data”
DPIA before any new tool goes live. Data residency confirmed. Retention and deletion policies checked. The DfE’s Generative AI: Product Safety Expectations reviewed for every student‑facing tool.
This isn’t red tape. It’s what the UK GDPR and KCSIE now expect schools to do.
Assessment rules that are actually enforceable
When can AI be used on homework? On coursework? In class? What does a student need to declare — and when? What counts as misconduct?
These questions need specific answers, aligned with JCQ guidance, not vague principles that fall apart under challenge.
A monitoring approach that staff and students understand
KCSIE 2025 requires schools to review filtering and monitoring at least annually, and this now includes AI tools. Schools need to ensure AI platforms can’t bypass content filters. Staff and students should know what is monitored and why. Transparency builds trust; secrecy undermines it.
Training — and a plan to repeat it
The DfE and the Chartered College of Teaching published free certified training materials in June 2025. There’s no excuse for not using them.
Build AI into INSET, CPD and new‑staff induction. Cover safeguarding implications, data protection, how to spot hallucinations and bias, and subject‑specific use cases. Then plan to repeat it — because the tools and guidance change every few months.
A pilot process for new tools
Any tool not on your approved list should go through a simple, controlled process before use: propose, assess (DPIA), pilot for a term, review, and decide.
That isn’t bureaucracy for its own sake. It’s how you stay in control.
So, Where Does That Leave You?
Run through that list. How does your current policy stack up?
If it covers most of it and staff have been trained, you’re in a good position. Genuinely, you’re ahead of most schools.
If it covers some of it, but training hasn’t happened, you have a policy gap that paper alone won’t close.
If you downloaded a template and haven’t looked at it since, you have work to do — and sooner is better than later, given what KCSIE 2025 and Ofsted now expect.
The goal isn’t a perfect policy document. It’s a school where staff and students understand the rules, trust the process, and use AI in ways that are safe, legal and genuinely useful.
Need a Hand Getting There?
At The Tech Shepherd, we work with schools and multi‑academy trusts to turn paper policies into working practice. That means reviewing what you have, identifying the gaps, building something your staff will actually use, and helping you deliver training that makes it stick.
We’re not here to sell you a template. We’re here to help your school — or trust — be safer, clearer and better prepared.
Get in touch: www.thetechshepherd.co.uk
Download our School and MAT AI Policy Starter Pack: Click Below.
Comments