School AI policy: what to include and how to write one

A school AI policy sets the rules for how artificial intelligence is used in a school or trust. It covers how staff may use AI tools, what pupils may do with them, how personal data is protected, how the school keeps assessment honest and who is accountable when something goes wrong.

It is not the same as a technology strategy, and it is not a ban. It is the written answer to everyday questions: Can I paste pupil names into this tool? Can pupils use AI for coursework? Which tools are approved? If a teacher cannot answer those after reading it, the policy is not finished.

Some schools call it an AI policy, others an AI acceptable use policy, an AI statement or AI guidance. The name matters less than whether staff, pupils and parents can find it, understand it and follow it.

Staff are already using AI to plan lessons, adapt resources, write reports and draft emails. Pupils are already using it for homework. The question is no longer whether to have a position. It is whether the position is written down, understood and consistent across the school.

Existing duties apply to AI whether or not you have a policy. In the UK these include UK GDPR and the safeguarding duties in Keeping Children Safe in Education, plus the assessment rules set by exam boards and the Joint Council for Qualifications. In the United States they include FERPA, COPPA and state education department guidance. The Department for Education in England has published its own guidance on generative AI in education, and many other education systems have followed. A school policy translates that guidance into decisions for your own context.

A short, clear policy also protects staff. When the rules are written down, teachers do not have to guess, and leaders can show that they have thought about risk.

Whatever format you choose, cover these ten areas. Each can be a paragraph rather than a page.

1. Purpose and scope. Who the policy applies to (staff, pupils, governors, contractors) and what counts as AI.
2. Accountability. The named senior leader who owns the policy and the person who approves tools.
3. Approved tools. A short list, and a simple route for staff to request a new one.
4. Staff use. Encouraged uses such as planning, differentiation and administration, and uses that need care or are not allowed.
5. Pupil use. What is expected by age and subject, and how pupils should acknowledge AI help.
6. Data protection. What personal and sensitive data must never be entered into a tool, and how tools are assessed against your data protection obligations.
7. Safeguarding and online safety. How AI fits with your existing safeguarding approach, including harmful content, deepfakes and image generation.
8. Assessment and academic integrity. What is acceptable in coursework and exams, following the relevant exam board and awarding body rules.
9. Communication. How parents, pupils and staff are told what the school has decided.
10. Training and review. How staff are supported, and when the policy is next reviewed.

Use this as a skeleton. Replace the prompts in brackets with your own decisions.

1. Our position. One paragraph on why the school uses AI and what it will not compromise on.
2. Scope and definitions. Who and what the policy covers.
3. Roles. [Senior leader] owns the policy. [Data protection lead] approves tools. [Designated safeguarding lead] advises on risk. [Head of assessment] advises on coursework and exams.
4. Approved tools. [List, with the date each was reviewed and who reviewed it.]
5. Staff expectations. What is encouraged, what needs approval, what is not allowed, and the rule that a person remains responsible for anything AI produces.
6. Pupil expectations. Rules by year group or key stage, and how to acknowledge AI help.
7. Data and privacy. What must never be entered. How to report a mistake.
8. Assessment and integrity. Rules for homework, coursework and exams.
9. Safeguarding and wellbeing. How concerns are raised and handled.
10. Communication, training and review. [Dates and responsibilities.]

These examples show the tone that works: plain, specific and short. Adapt them to your own school.

Personal data

“Staff must not enter pupil names, images, assessment results, health information or any other personal or sensitive data into an AI tool unless the tool is on the approved list and the data protection lead has confirmed it may be used for that purpose.”

Responsibility for output

“AI can draft, suggest and summarise. A member of staff remains responsible for checking anything produced with AI before it is shared, and for any decision made using it.”

Pupil acknowledgement

“If you use AI to help with homework, say what you used it for. Work that is assessed for a qualification must follow the exam board rules, and your teacher will tell you what is allowed for each piece.”

Approving a new tool

“Staff who want to use a new AI tool should ask [role]. We will check what data the tool collects, where it is stored, the age restrictions and whether it meets our safeguarding and data protection requirements.”

A traffic-light model is one of the simplest ways to make a policy usable. It turns abstract rules into examples staff can recognise.

Green: encouraged

• Drafting lesson plans, quizzes and resources that a teacher then checks.
• Adapting reading levels or producing examples for different needs.
• Generating ideas for parent newsletters or routine administration, with no personal data.

Amber: ask first

• Any tool that is not on the approved list.
• Using AI to give feedback on pupil work.
• Anything involving images, voice or video of pupils or staff.

Red: not allowed

• Entering personal or sensitive pupil data into a tool that has not been approved.
• Using AI output for decisions about pupils without human review.
• Submitting AI-generated work as a pupil's own in assessed coursework.

Your own lists will differ. What matters is that each list is short, specific and agreed by the people who will use it.

The three terms are often used interchangeably, but they do different jobs.

• Policy sets the rules: what is allowed, who decides, how risk is managed.
• Guidance shows people how to follow the rules in practice, with examples for each subject and role.
• Strategy sets the direction: why the school is using AI, what it wants to improve and in what order.

Most schools need a policy first, because it is quick and protective. Guidance follows, so staff know what good use looks like. A strategy keeps the policy from being the only thing the school has said about AI. If you are at that point, see AI strategy for schools.

Policies written by one person tend to be either too cautious or too vague. A small working group works better:

• A senior leader as owner.
• The data protection lead.
• The designated safeguarding lead.
• A curriculum or assessment lead.
• At least one classroom teacher.

Governors or trustees approve the final version. Consult staff before you finalise it. Staff concern is useful evidence about what the policy needs to answer, and people follow rules they helped shape. Where age-appropriate, ask pupils too.

• Primary schools. Keep it short. Focus on staff use, data protection and what pupils are told about AI. Most primary pupils should not be using open generative tools directly.
• Secondary schools and colleges. Add clear rules by key stage, a section on assessed work and a way for pupils to acknowledge AI help.
• Multi-academy trusts and groups. Set a trust-wide framework for data, safeguarding and approved tools, and let each school add its own detail. This avoids thirty different policies and keeps the approved list consistent.
• International schools. Check which local data protection and education rules apply, as well as any curriculum or exam body requirements.

• Copying a template without making decisions. The policy looks complete but names no approved tools and settles no real questions.
• Banning everything. Use moves out of sight, and the school loses the chance to guide it.
• Writing for inspectors instead of staff. If it is not usable in a classroom on a Tuesday, it will not be used.
• Treating it as a one-off. Tools change quickly, so build in a review rather than a rewrite every time something shifts.
• Leaving out pupils and parents. They need to know what the rules are and why.

Statutory duties and official guidance from your education department, regulators and exam boards remain your reference points. A policy sits alongside them, not in place of them.

A policy only works if people know about it. This sequence keeps the work manageable.

Days 1 to 30: understand

• Find out what staff and pupils are already using.
• Form the working group and agree who owns the policy.
• Review your existing data protection, safeguarding, assessment and acceptable use policies.

Days 31 to 60: decide and draft

• Agree the approved tools list and the traffic-light examples.
• Draft the policy and a one-page summary for staff.
• Consult staff, and pupils where appropriate.

Days 61 to 90: launch and learn

• Take the policy to governors or trustees for approval.
• Brief staff, with real examples from your own subjects.
• Tell parents and pupils what has been decided and set the first review date.

A policy is the start. The harder part is helping staff feel confident enough to follow it: showing what good use looks like in your subjects, agreeing where the boundaries sit and revisiting them as tools change.

Dan works with school and trust leaders to turn their context into a clear policy and a plan for introducing it. If your policy needs to sit within a wider direction for AI, see AI strategy for schools. If your staff need practical support, see AI training for schools. If you want a measured view of where your school stands first, try the school AI readiness check.