Writing a AI Policy for Primary Schools: A Practical Guide

Oct 26, 2026 | news, Whiteboard Blog

Around half of schools in England still don’t have a formal AI policy in place and if you work in primary, a primary school AI policy may well be further down the list than that. Most schools are in exactly the same position, so this isn’t about feeling behind.

AI is already in your school whether you have a policy or not. Staff use ChatGPT to plan lessons. Year 6 pupils use it at home for homework. Parents are starting to ask questions. Since September 2026, Keeping Children Safe in Education (KCSIE) has also named AI as part of your statutory safeguarding responsibilities.

A policy isn’t there to stop any of that. Its job is to make clear what’s acceptable, what isn’t and who is responsible for what, so that staff and pupils are protected and the school can show it has thought things through. This post sets out what a primary school AI policy should include, based on the DfE’s own guidance, and gives you a practical starting point.

What the guidance says

The DfE has built up a substantial body of material over the past two years:

It’s important to be clear about the legal position. The DfE AI guidance itself is non-statutory, and schools aren’t required by law to produce an AI policy. KCSIE 2026, which applies from 1 September 2026, is statutory, and it now names AI-related risks directly. In practice, then, a policy is far less optional than it felt a year ago.

Ofsted doesn’t inspect AI use as a standalone element and has no checklist of AI judgements. It has said that where a school’s use of AI, or its response to AI, has a significant impact on children, that becomes relevant to inspection, and inspectors will look at any AI-related safeguarding concerns that arise during a visit. The question you’re likely to face isn’t “do you have an AI policy?” but “have you thought about this carefully, and can you show us?”

The DfE guidance covers responsible use, transparency about when and how AI is used, data protection under UK GDPR, safeguarding and human oversight. Those areas map neatly onto five pillars for a primary school policy.

Pillar 1: Acceptable use

The first question any AI policy needs to answer is who can use AI, for what, and where it’s off limits.

For staff in a primary school, much of the useful work is low stakes: planning lessons, generating ideas, drafting a newsletter or a letter to parents, and creating differentiated versions of a resource. AI is well suited to this kind of time-saving task.

The policy should be equally clear about what is off limits:

  • entering pupil data into a public AI tool
  • writing reports on individual children, where professional judgement can’t be handed over
  • any involvement in formal summative assessment

For pupils, the question is different. Most primary pupils won’t use AI tools independently in school, but they will meet AI-generated content and some will use tools at home. Your policy should still address this, even if it simply says that pupils should tell a trusted adult whenever they’ve used AI to help with school work.

The DfE guidance also says staff should only use AI tools approved within the school. That doesn’t mean a vetted list of fifty tools. It means someone with oversight, usually a member of SLT or the computing lead, has looked at any tool in regular use and made a considered decision about it.

Pillar 2: Data and privacy

This pillar carries the most immediate legal weight.

Free versions of tools such as ChatGPT and Google Gemini are public tools. Anything you type is processed on external servers, and you have no control over what happens to it. One rule follows from that: never enter pupils’ names, photos or any identifying information into a public AI tool.

Under UK GDPR, the school is the data controller. If a member of staff types “Write a report for Jamie Smith in Year 3, who has an EHCP for autism” into a free AI tool, that is a data protection breach and the school is liable. Put this rule near the top of the policy, where every member of staff will read it, rather than in paragraph seven.

Enterprise versions are different. Microsoft Copilot through your school’s Microsoft 365 licence, or Gemini through Google Workspace for Education, come with different data agreements. The policy should spell out which tools fall into which category. Even with an approved enterprise tool, use initials or placeholders rather than names wherever you can, and follow your school’s data protection policy.

The DfE also recommends updating your privacy notices to reflect AI use, particularly where personal data is processed. Talk to your data protection lead or your local authority’s DPO about this.

Pillar 3: Accuracy and bias

AI tools can be useful, and they can also be confidently wrong. “Hallucination” is the term for an AI producing something that reads well and sounds plausible but is factually incorrect. It is a well-documented issue, and your policy should acknowledge it.

For staff, the rule is simple: every AI output is reviewed by a person before it’s used, whether it’s a lesson plan, a letter to parents or a resource sheet. The DfE guidance treats human oversight as non-negotiable.

For pupils, this is a curriculum opportunity. Teaching children to question what AI produces, to check sources and to think about where information comes from links directly to computing, RSHE and wider digital literacy.

Bias deserves a brief mention too. AI models are trained on huge amounts of human-written content, so they can reproduce biases around gender, ethnicity and culture. Naming this in the policy reminds staff that AI outputs aren’t neutral and that their own professional judgement still matters.

Pillar 4: Safeguarding

This is where many school leaders feel least confident. You don’t need a separate framework; the aim is to connect AI to the safeguarding arrangements you already have.

KCSIE 2026 names AI-related risks for the first time. These include harmful interactions with AI chatbots and companion apps that simulate human conversation, explicit images generated using AI, and AI-generated “deepfakes”. These sit within your statutory safeguarding responsibilities.

KCSIE also points schools to the DfE’s product safety expectations for help applying filtering and monitoring to generative AI. If your filtering system covers traditional websites but not tools such as ChatGPT or Gemini, ask your computing lead or IT provider to check it.

Your AI policy should reference your online safety policy and your KCSIE commitments directly, and answer a few practical questions. What happens if a pupil using an AI tool sees inappropriate content? Who is the first point of contact? Is it covered by your existing reporting procedures? In most schools the DSL role, the reporting structure and the channels for contacting parents already exist. The policy just needs to say that AI-related concerns go through them.

One more risk to plan for: AI makes it easy to produce convincing fraudulent communications, such as a letter that appears to come from a parent. Have a simple process for checking unusual written communications, especially on sensitive matters.

Pillar 5: Staff guidance and training

A policy that sits on the shared drive unread is just a document. This pillar is about making sure staff understand what’s expected and feel supported to do it.

The DfE and the Chartered College of Teaching offer free training on the safe and effective use of AI in education. It covers four areas, from understanding AI in education through to practical use cases, with a leader support pack and a free certified assessment at the end, so staff have something tangible to show for completing it. Signpost it in your policy as the recommended starting point.

Decide who owns the policy. AI tools change quickly, and guidance that was accurate twelve months ago may already need revisiting. Nominate your computing lead or a senior leader to review it annually, or sooner if significant new guidance or tools appear.

For hands-on training that shows how to use these tools in a classroom, rather than simply describing them, the Tech Fix channel has a growing set of practical videos.

Three common mistakes

Copying a template without adapting it. Templates are a useful starting point. If the policy doesn’t reflect your pupils’ age range and your existing safeguarding arrangements, it isn’t your policy; it’s someone else’s with your school name on it.

Writing a policy nobody reads. It’s common for a policy to be ratified by governors and then filed. If staff can’t tell you the one thing they must never do with AI, which is enter pupil data into a public tool, the policy hasn’t worked.

Banning AI entirely. The instinct is understandable, but a blanket ban can’t be enforced. Staff will still use AI at home for school work and pupils will still use it outside school. A clear, proportionate framework does far more good.

Download the one-page checklist

A one-page checklist covering the five pillars is available to download here. Take it to a staff meeting or share it with your headteacher as a starting point for your own policy.

Next Steps

If you’re starting from scratch, don’t write a ten-page policy. Write a one-page interim statement this week.

  1. Draft the statement. Say the school recognises AI is in use, set out the core rules (with the data rule first), reference the DfE guidance and your online safety and KCSIE commitments, and name who is responsible for reviewing it.
  2. Take it to staff before you finalise it. You’re not asking permission. You’re getting buy-in and catching anything that doesn’t fit your setting.
  3. Take it to governors, then publish it. From there, build towards a fuller policy using the DfE framework and the worked examples in the Chartered College materials, and review it at least once a year.

You don’t need a perfect policy; you need one that works and that staff have read. Share this post with your headteacher, computing lead and DSL, and watch the full video for a walk-through of each pillar

Writing a AI Policy for Primary Schools: A Practical Guide
The Whiteboard Blog – Education, Technology, AI and Science CPD and Support