# School AI Policy Template: What to Copy, What to Decide

Canonical URL: https://blog.theaieducator.io/posts/school-ai-policy-template
Publication: Dan Fitzpatrick Insights
Author: Dan Fitzpatrick
Topic: AI Governance and Responsible Leadership
Published: 2026-10-06T07:28:00.000Z
Modified: 2026-10-06T07:23:19.957Z

Every AI policy template hands you finished prose for decisions your school has not made. This one is the complete policy, published in full, with each section marked Settled by law or Yours to decide, and the second set left deliberately unfinished.

## In brief

A school AI policy template should separate the clauses already settled by law and exam regulation from the clauses only the school can settle, and leave the second set visibly unfinished until a named person fills them in. Of the ten sections in this template, two are settled by law and exam regulation, one is settled in a single narrow respect, and the remaining seven are the school's own decisions. The data clause follows the Department for Education's position that personal data is not to be entered into generative AI tools; the assessment clause follows the Joint Council for Qualifications; the safeguarding clause is settled only on AI-generated imagery, and the rest of a school's AI safeguarding surface has to be written locally.

## Key takeaways

- A school AI policy template should mark which clauses are settled by law and which are the school's own decisions, and leave the second set visibly unfinished rather than filling them with borrowed prose.
- Of the ten sections in this template, two are settled by law and exam regulation, one is settled in a single narrow respect, and the remaining seven are the school's to decide.
- The Department for Education's position is that personal data is not to be entered into generative AI tools, and that responsibility for the content of any final document stays with the professional who produced it.
- The Joint Council for Qualifications requires students to acknowledge AI use in qualification assessments, including the tool, the date, a non-editable copy of the prompt and output, and states that teachers must not use AI as the sole means of marking.
- Keeping Children Safe in Education 2026 names AI directly in its section on nudes and semi-nudes, which means the rest of a school's AI safeguarding surface is a local decision rather than an inherited one.
- Ofsted's 2025 study of 21 early adopter schools and colleges found leaders reviewing AI-related policies at least termly, and found no clear consensus about what an AI policy should contain.
- The clause that stays unfinished longest is accountability, because completing it means putting a named person next to the call from the parent.

A school AI policy template should separate the clauses the law has already settled from the clauses only your school can settle, and leave the second set visibly unfinished until a named person fills them in. The complete policy is below, published in full with nothing behind a form. Copy it. The marked clauses are the ones that take the meeting.

Every template in circulation this term hands you finished prose for decisions your school has not made. That is why so many of them get adopted in September and cannot answer a question in October. A policy made of other people's sentences reads beautifully and settles nothing.

So this one is built the other way around. Each section is tagged **Settled** or **Yours**. Settled means the clause is fixed by legislation, statutory guidance or exam regulation, and your discretion is close to zero: copy it and move on. Yours means the sentence has a bracket in it, and the bracket stays empty until somebody in your building decides what goes there. The brackets are the policy. Everything else is formatting.

## What should a school AI policy template include?

A school AI policy template should include ten sections, and should mark which of them you can adopt unchanged and which you have to finish yourself. The ten below follow [the eight decisions an AI policy records](https://blog.theaieducator.io/posts/what-should-a-school-ai-policy-contain), with a scope clause at the front and a safeguarding clause that most templates leave out.

The Eight Decisions an AI Policy Records are the eight questions a school has to settle before a policy can be written rather than adopted: purpose, permission, data, students, disclosure, approval, accountability and review. The template is the document those decisions produce. If you adopt it without taking them, you have a handsome compliance artifact and the questions will still arrive at your door.

## Which clauses are settled, and which are yours?

Two of the ten sections are settled by law and exam regulation, a third is settled in one narrow respect, and the remaining seven are yours. The hard ones are concentrated there.

| Section | Status | What fixes it, or what you must decide |
|---|---|---|
| 1. Scope and status | Yours | Which people and which tools the policy covers |
| 2. Purpose | Yours | What AI is for here, and one thing it is not for |
| 3. Staff permission | Yours | The three lists: do it, tell someone, never |
| 4. Data | Settled | Data protection legislation and the DfE's position |
| 5. Students | Yours | Which tasks, from which year group |
| 6. Disclosure in assessed work | Settled | JCQ requirements for qualification assessments |
| 7. Approved tools | Yours | Who adds a tool, who removes one, on what conditions |
| 8. Accountability | Yours | The named person who answers when it goes wrong |
| 9. Safeguarding | Settled in one respect | KCSIE on AI-generated imagery; the rest is local |
| 10. Review | Yours | The date, and the event that brings it forward |

Section 9 is the one worth pausing on, because it is where leaders most often assume cover they do not have. The place Keeping Children Safe in Education 2026 names AI directly is its section on nudes and semi-nudes, which notes that images "may also be digitally altered or wholly generated using artificial intelligence, including what are sometimes described as 'deepfakes' or 'deep nudes'". That is statutory, it is specific, and it is narrow. The rest of your AI safeguarding surface, a child confiding in a chatbot, a tool that stores what a pupil types, an assistant that quietly profiles a class, is not covered by a sentence you can lift from statutory guidance. You write it, or nobody does.

## The template: a school AI policy you can copy

What follows is a complete policy. Adopt it, rename the roles to match your structure, and fill every bracket. It is written for a school or trust in England and the Settled clauses are drawn from English law and regulation; if you are elsewhere, the structure and the Settled-or-Yours split still hold, and the sources behind sections 4, 6 and 9 change.

### 1. Scope and status

This policy applies to all staff, governors, volunteers and students at **[school name]**, and to every use of an artificial intelligence tool in connection with the work of the school, whether the tool is on the approved list, embedded in software the school already uses, or accessed on a personal device for school purposes. It sits alongside and does not replace our data protection, safeguarding, acceptable use, curriculum and malpractice policies. Where this policy and another conflict, **[named policy]** takes precedence. Approved by **[governing body or board]** on **[date]**.

### 2. Purpose

We use AI at **[school name]** to **[the specific outcome, in plain words: for example, reduce the hours staff spend on written administration so that time returns to teaching and to talking to children]**. We do not use AI to **[the named exclusion: for example, grade student work, or write anything that goes home about a named child]**.

### 3. What staff may do

Staff may use approved AI tools for the following without asking anyone: **[list]**.

Staff may use approved AI tools for the following and must then tell **[named role]**: **[list]**.

Staff may not use AI for the following in any circumstances: **[list]**.

The quality and content of anything a member of staff produces remains theirs. The Department for Education puts this plainly in its policy paper on [generative AI in education](https://www.gov.uk/government/publications/generative-artificial-intelligence-in-education/generative-artificial-intelligence-ai-in-education): "The quality and content of any final documents remains the responsibility of the professional who produced it and the organisation they belong to, regardless of the tools or resources used." A tool producing something wrong is not a defense, and "the AI wrote it" is not an explanation anyone here will accept.

### 4. Data (Settled)

Personal data must be protected in accordance with data protection legislation. Following the Department for Education's position, personal data is not to be entered into generative AI tools. Students' original work must not be used to train a generative AI model unless the school has permission or a copyright exception applies.

In practice, at **[school name]**, the following must never be typed into any AI tool: a child's name, a safeguarding record or concern, a medical or SEND detail, anything taken from a pupil record, anything about a named member of staff. If you are unsure whether something counts, it counts. Ask **[named role]** before, not after. [What staff can and cannot put into ChatGPT](https://blog.theaieducator.io/posts/can-staff-put-student-data-into-chatgpt) is the question this clause will be tested with first, usually within a fortnight.

### 5. Students

Students at **[school name]** may use approved AI tools for **[tasks]**, from **[year group]**. Students may not use AI for **[tasks]**. Student use is supervised: the Department for Education's position is that pupils "should only be using generative AI in education settings with appropriate safeguards in place, such as close supervision and the use of tools with safety and filtering and monitoring features."

Supplier age terms set a floor, not our policy. Where a supplier permits use from an age below **[year group]**, our limit stands.

### 6. Disclosure in assessed work (Settled)

For any qualification assessment, the requirements of the Joint Council for Qualifications apply in full. Students must sign a declaration that the work submitted is their own unaided work and must acknowledge every source, including AI tools. Where AI has been used, the student must record the name of the tool, the date the content was generated, a non-editable copy of the prompt and the output, and an explanation of how it was used. Teachers must confirm that work was completed under the required conditions, must not accept work they cannot authenticate, and must investigate before signing. JCQ is explicit on marking: "Teachers must not use artificial intelligence as the sole means of marking candidates' work."

For school work that is not a qualification assessment, students must declare AI use when **[circumstances]**. Where we believe a declaration is missing, we will **[the process, named and written before the first case, not during it]**. That process is a fairness decision rather than a technical one, which is why [what a school does when a student is accused of using AI](https://blog.theaieducator.io/posts/student-accused-of-using-ai) belongs in this policy and not in a conversation held under pressure.

### 7. Approved tools

Only tools on the approved list may be used with school data or with students. **[Named role]** may add a tool to the list. **[Named role]** may veto or remove one. A tool is removed when **[conditions: for example, its data processing terms change, its age limits change, a safeguarding feature is withdrawn, or the supplier is acquired]**. The list is held at **[location]** and dated. [What a school should require before approving an AI tool](https://blog.theaieducator.io/posts/approving-ai-tools-for-schools) sets out what to ask for in writing before anything joins it.

### 8. Accountability

**[Named person and role]** is accountable for AI use at **[school name]**. When an AI tool contributes to something going wrong, that person answers to the family or member of staff affected, and **[named role]** is responsible for putting it right by **[timescale]**. Any member of staff or student may raise a concern about AI use to **[named role]** without going through a line manager. [Who is accountable when a school's AI tool gets it wrong](https://blog.theaieducator.io/posts/who-is-accountable-when-ai-gets-it-wrong) is the clause that cannot be delegated downward, and a committee named here means nobody is.

### 9. Safeguarding (Settled in one respect)

AI-generated and AI-altered imagery of children is handled under our child protection procedures and Keeping Children Safe in Education, which recognizes that nudes and semi-nudes may be "digitally altered or wholly generated using artificial intelligence". Any such incident goes to the designated safeguarding lead immediately, as any other would.

Beyond imagery, at **[school name]**: where a student discloses something of concern to an AI tool rather than a person, **[what happens]**. Where an approved tool stores or reviews what students type, **[who checks it, and how often]**. Our filtering and monitoring arrangements cover AI tools as follows: **[detail]**. These are local decisions. No statutory document makes them for you, and [what AI means for safeguarding in schools](https://blog.theaieducator.io/posts/what-does-ai-mean-for-safeguarding-in-schools) is where the thinking behind them sits.

### 10. Review

This policy is reviewed on **[date]**, and sooner on any of the following events: an approved tool changes what it does or how it handles data; statutory guidance is updated; a serious incident occurs; the approved list changes materially. **[Named role]** owns the review.

## What I See in Practice

Across the leadership teams I work with, the brackets fail in a pattern, and it is not the pattern people expect. Sections 4 and 6 get filled in fast, because they feel like compliance and compliance is familiar ground. Section 3's middle list, the things a member of staff may do and then mention to someone, is usually left empty, and an empty middle list is the clearest sign the thinking is not finished: it means the school has only imagined freedom and prohibition, and most real use lives between them.

The bracket that stays empty longest is in section 8. Writing those words means a person's name goes next to the call from the parent, and until that moment everybody in the room has been discussing a technology rather than agreeing who takes responsibility. When I wrote the books on AI in education I expected the hard chapters to be about the technology. They were about this.

## How often should an AI policy be reviewed?

An AI policy should be reviewed termly at least, and immediately on a trigger event, because what dates it is a supplier changing the product rather than time passing. The schools furthest ahead already work this way. Ofsted's study of early adopters, [The biggest risk is doing nothing](https://www.gov.uk/government/publications/ai-in-schools-and-further-education-findings-from-early-adopters/the-biggest-risk-is-doing-nothing-insights-from-early-adopters-of-artificial-intelligence-in-schools-and-further-education-colleges), published on June 27, 2025 from interviews with leaders at 21 schools and colleges in England during the spring term of 2025, found them "reviewing and updating AI-related policies at least termly, if not more often".

The same study is worth reading for a second finding, which explains why the template market looks the way it does: "There was no clear consensus about what to include in a policy, or whether to have a separate AI policy." Nobody is behind for not having solved this. Everybody is improvising, including the schools held up as examples, and a template that presents itself as the settled answer is misrepresenting the state of the field. The honest version marks what is settled, which is less than leaders assume, and hands back the rest.

Write the trigger as well as the date. [An approved tool that has quietly changed](https://blog.theaieducator.io/posts/when-an-approved-ai-tool-changes) is the commonest trigger and the one least likely to be noticed, because nothing arrives to tell you.

## What to do with this before the next governors' meeting

Copy the ten sections. Delete nothing. Then count your brackets, send the document to the people who have to fill them, and put only those lines on the agenda. A governing body does not need to debate section 4; it needs twenty minutes on section 8 and a name at the end of it.

A policy you can adopt in an afternoon is worth having. A policy whose unfinished lines are visible is worth more, because every empty bracket is a question that would otherwise have reached you in the middle of a Tuesday, in the form of a member of staff standing in your doorway.

## Where this goes next

The brackets in sections 2 and 5 are not governance questions. They are strategy questions wearing governance clothes, and a leadership team that cannot agree what AI is for will not finish them in a policy meeting. If that is where your team is stuck, it is the kind of work I do through [AI strategy sessions with school and trust leadership teams](https://theaieducator.io/ai-strategy-for-schools?utm_source=blog.theaieducator.io&utm_medium=referral&utm_campaign=school-ai-policy-template), and [the newsletter](https://theaieducator.io/?utm_source=blog.theaieducator.io&utm_medium=referral&utm_campaign=school-ai-policy-template#newsletter) carries the thinking between them.

## Sources and further reading

- Department for Education, [Generative artificial intelligence (AI) in education](https://www.gov.uk/government/publications/generative-artificial-intelligence-in-education/generative-artificial-intelligence-ai-in-education), policy paper, published March 29, 2023, last updated August 12, 2025.
- Ofsted, [The biggest risk is doing nothing: insights from early adopters of artificial intelligence in schools and further education colleges](https://www.gov.uk/government/publications/ai-in-schools-and-further-education-findings-from-early-adopters/the-biggest-risk-is-doing-nothing-insights-from-early-adopters-of-artificial-intelligence-in-schools-and-further-education-colleges), commissioned by the Department for Education, published June 27, 2025, based on interviews with leaders at 21 schools and further education colleges, spring term 2025.
- Joint Council for Qualifications, [AI Use in Assessments: Protecting the Integrity of Qualifications](https://www.jcq.org.uk/knowledge-hub/ai-use-in-assessments-your-role-in-protecting-the-integrity-of-qualifications/), April 2025.
- Department for Education, [Keeping children safe in education 2026](https://www.gov.uk/government/publications/keeping-children-safe-in-education--2), statutory guidance, September 2026.

*Dan Fitzpatrick is the founder of The AI Educator, a Forbes contributor and a bestselling author on AI in education who works with school and system leaders on AI strategy and governance. [More about Dan](https://theaieducator.io/about?utm_source=blog.theaieducator.io&utm_medium=referral&utm_campaign=school-ai-policy-template).*

## Frequently asked questions

### Can a school copy an AI policy template without changing it?

Only the clauses fixed by law and exam regulation. The data, assessment and AI-imagery clauses can be adopted as written. The rest, including purpose, staff permissions, student permissions, approved tools, accountability and review, depend on decisions only your school can take, and copying someone else's answers records nothing.

### How long should a school AI policy be?

Short enough that a member of staff can find an answer in it during a free period. Ten sections covering scope, purpose, staff permission, data, students, disclosure, approved tools, accountability, safeguarding and review is sufficient. Length is not the measure; whether a recurring question is already answered in it is.

### What must a school AI policy say about coursework and exams?

For qualification assessments, Joint Council for Qualifications requirements apply in full. Students sign a declaration that work is their own and must acknowledge AI use, naming the tool, the date, a non-editable copy of the prompt and output, and how it was used. Teachers must authenticate work before signing.

### Does a school AI policy need its own safeguarding section?

Yes, because statutory guidance covers only part of the ground. Keeping Children Safe in Education 2026 addresses AI directly in relation to nudes and semi-nudes that are digitally altered or wholly generated. Disclosures made to chatbots, tool data retention and filtering arrangements for AI are local decisions.

### Should a school have one AI policy or several documents?

One policy, with separate shorter guidance for staff and students if useful. Ofsted's 2025 study of early adopters found no clear consensus on whether to have a separate AI policy at all, with most providers folding AI into existing safeguarding, data protection and acceptable use policies.

### How often should a school review its AI policy?

Termly at least, plus a trigger. Ofsted found early adopters reviewing AI-related policies at least termly, if not more often. Write the named events that bring the review forward: an approved tool changing what it does, updated statutory guidance, a serious incident, or a material change to the approved list.

---
Source: [School AI Policy Template: What to Copy, What to Decide](https://blog.theaieducator.io/posts/school-ai-policy-template)
Publisher: [The AI Educator](https://theaieducator.io)