AI did not arrive in your school through a board decision. It arrived through the staffroom. By December 2025, 82% of primary teachers and 78% of secondary teachers had used generative AI in their role — most often for lesson resources and planning — while only 3% of primary and 19% of secondary teachers said pupils were permitted to use it in assigned work (DfE School and College Voice, December 2025).
So the question in front of a governing board or trust board is not "should we adopt AI?" Staff already have. The question is whether anyone accountable knows where it is being used, on whose data, and against what policy. This playbook sets out what that oversight looks like, alongside our education sector page.
Key takeaways
- AI is already in your school: 82% of primary and 78% of secondary teachers have used generative AI — usually ahead of any policy.
- The governor's job is oversight, not operation: assure yourselves that leaders have identified, risk-assessed and evidenced their AI use, rather than approving tools line by line.
- DfE guidance supports AI for workload but leaves the judgement calls — which tools, which pupils, what to tell parents — to leaders and boards.
- KCSIE 2025 brings generative AI inside statutory safeguarding: from September 2025, filtering and monitoring must demonstrably cover it.
- Assessment integrity is the sharpest live risk: JCQ treats unacknowledged AI use as malpractice, and AI now accounts for three-quarters of plagiarism cases.
Oversight, not operation
School governance has always had a clean division of labour: the board sets direction and holds executive leaders to account; leaders run the school. AI does not change that division — it tests it. A board vetting individual chatbots has crossed into operation; one that has never asked which AI tools touch pupils' data has abandoned oversight.
The oversight job has three parts: a current list of AI tools in use across the school or trust, including the informal ones teachers adopted themselves; a risk assessment of each use against the things a board already answers for — children's data, safeguarding, equality, assessment integrity; and evidence, meaning documents the board can read rather than assurance by adjective.
Ofsted's position reinforces this. Inspectors do not evaluate AI as a stand-alone topic and will not require schools to use it or avoid it; they consider its impact on the outcomes and experiences of children, including through the safeguarding lens (How Ofsted looks at AI during inspection and regulation). AI reaches the board through the duties it already holds — the same shape as the wider UK position of no single AI statute and existing duties doing the work, which we map in our UK AI governance framework guide.
Where AI actually is in schools, and what is at stake in each place
Five clusters of use carry five different stakes.
Teacher workload tools. Drafting letters, reports and admin documents is the dominant use. The risk is specific: a member of staff pasting a pupil's name, SEND detail or safeguarding context into a free public tool that retains it. That is a data protection incident, not a productivity win.
Lesson planning and resource creation. The most common classroom use — 84% of secondary teachers who use AI use it to create lesson resources (DfE, December 2025). The stake is professional responsibility: the teacher, not the tool, remains accountable for what is taught, and the policy should say so.
Marking and feedback assistance. Useful, but bounded: schools must not use AI as the sole marker of non-exam assessment in regulated qualifications (Ofqual guide for schools and colleges 2025). A human reviews every AI-assisted judgement before it reaches a pupil.
Pupil-facing tutoring and chatbots. The highest-stakes category, because the user is a child. Safeguarding, content filtering, children's data and equality of access converge here — including the quiet inequity of pupils whose families pay for premium tools competing against those who cannot. And note the gap: most teachers say pupils may not use generative AI, yet only 28% of primary and 43% of secondary teachers report giving pupils guidance on using it safely. Prohibition without education is not a safeguarding strategy.
Admissions, attendance and pupil analytics. Models that flag attendance risk or shape admissions decisions process children's personal data to significant effect. That triggers UK GDPR's rules on profiling and automated decision-making, and demands an equality lens: a model trained on past patterns can quietly disadvantage the same groups of pupils it always did.
Assessment integrity deserves its own number. In the summer 2025 exam series, misuse of AI accounted for 75% of all student plagiarism cases — 100 cases, up from 85 in 2024 — though still around 2% of all student malpractice (Ofqual official statistics). Small numbers, rising fast, and entirely the centre's problem to police.
What the DfE expects — and what it leaves to your judgement
The Department for Education's position is set out in its generative AI in education policy paper and support materials, published in June 2025 and updated in August 2025. The posture is supportive: AI used well can reduce workload and improve resources. But the decisions — which tools, for which staff and pupils, under what conditions — sit with schools, colleges and their governing boards. No approved-products list is coming.
Three further instruments give the board its reference points:
- The DfE's Generative AI: product safety standards (published January 2025, updated 19 January 2026) define what a generative AI product should do to be safe for educational settings — filtering harmful content, logging activity, protecting data. The January 2026 update added standards on cognitive development, emotional and social development, mental health and manipulation. They are written for edtech developers, which makes them a ready-made procurement test: ask the supplier to evidence each one.
- Keeping Children Safe in Education 2025, in force from 1 September 2025, brings generative AI explicitly within statutory online-safety expectations and widens the definition of harmful online content to include misinformation and disinformation. Filtering and monitoring must demonstrably cover AI tools, and the board carries the statutory safeguarding accountability.
- The ICO's children's code sets fifteen standards for online services likely to be accessed by under-18s, anchored in the best interests of the child — and a data protection impact assessment is the expected artefact wherever edtech processes children's data at scale.
For assessments, the JCQ guidance on AI use in assessments (updated April 2025) is the operative rulebook: pupils may only use AI where the specification permits it, must acknowledge any use, and must retain non-editable copies of generated content. Unacknowledged use is malpractice, with penalties up to losing the qualification.
What none of these documents will do is make the judgement calls. Whether Year 10 may use a chatbot for homework, what parents are told and when, where human review sits in marking — that is the space the board fills.
The governors' question set
Treat this table as a working agenda item for the next full board meeting.
| Use case | The question to ask | Evidence to ask for |
|---|---|---|
| Staff workload tools | What may staff put into which tools — and what must never leave the school's systems? | Acceptable-use policy; approved-tools list; DPIA for tools touching pupil data |
| Lesson planning and resources | Who remains responsible for AI-assisted content reaching pupils? | Policy line on professional responsibility; examples from staff training |
| Marking and feedback | Does a human review every AI-assisted judgement, and is AI ever the sole marker? | Moderation and sampling records; written marking policy |
| Pupil-facing tutoring | Has this tool been tested against the DfE product safety standards, and does our filtering and monitoring cover it? | Supplier's standards mapping; KCSIE filtering and monitoring review; age-appropriate access controls |
| Coursework and NEA | How do pupils declare AI use, and how are suspected breaches handled? | Exam and malpractice policy; candidate declarations; centre malpractice log |
| Attendance and admissions analytics | Could this model profile or disadvantage groups of pupils, and who reviews what it flags? | DPIA; equality impact assessment; named human reviewer for flagged cases |
A leadership team that can produce the right-hand column is governing its AI.
Policy essentials for a school or MAT
A workable AI policy for a school or trust needs four parts:
- Acceptable use for staff. Which tools are approved, what data may never enter unapproved tools (names, SEND, safeguarding, anything identifying a child), and the rule that a human reviews every output before it reaches a pupil or parent.
- Acceptable use for pupils. When AI use is permitted, by year group and task; how it must be declared, aligned to the JCQ wording for assessed work; and what pupils are actually taught about using it safely.
- Parental transparency. Privacy notices that name the AI tools processing children's data and what they do — plus a plain-language explanation before any pupil-facing AI is introduced. Parents finding out from their children is a governance failure in miniature.
- Procurement checks. Every edtech AI claim tested against the DfE product safety standards; controller and processor roles established; and a direct answer to the question suppliers least like: is our children's data used to train your models?
If a blank page is the obstacle, our free AI policy generator produces a school-ready draft from a short set of questions — built to be edited, not adopted unread.
The MAT difference: one policy, many academies
For a multi-academy trust, the worst available outcome is thirty academies making thirty separate judgements about the same tools. The trust board should own a single AI policy and risk appetite, with the scheme of delegation stating precisely what is reserved — procurement due diligence, DPIAs through the trust's data protection officer, the approved-tools list — and what local governing bodies monitor: implementation, staff training uptake, safeguarding incidents involving AI, and parental communication.
That way, supplier due diligence happens once, to one standard, and every academy inherits it. Trustees then need one reporting line: a live register of AI tools across the trust, reviewed termly, with exceptions — new tools, near-misses, malpractice cases — surfaced rather than buried in local minutes.
Three questions tell a board where it stands. Do we know every AI tool in use, including the unofficial ones? Can leaders evidence that filtering, monitoring and data protection cover the pupil-facing ones? And does our exams policy handle AI declarations the way JCQ requires? If any answer is "not cleanly", that is the agenda for the next meeting — and our free Board AI Scorecard turns those questions into a structured baseline in about ten minutes.
Last reviewed: 12 June 2026.
If your board wants help moving from questions to evidence, start with the free Board AI Scorecard, explore AI board training designed for governors and trustees, or commission a GovernIQ diagnostic (from £3,950). The full education offer is on our sector page for education.
