# Why a Short School AI Policy Beats a Long One Canonical URL: https://blog.theaieducator.io/posts/short-school-ai-policy Publication: Dan Fitzpatrick Insights Author: Dan Fitzpatrick Topic: AI Governance and Responsible Leadership Published: 2026-10-16T05:50:00.000Z Modified: 2026-10-16T15:43:37.808Z A school AI policy that staff can read in one sitting is more likely to be followed than a long one. What to put in it, what to leave to other documents, and the test that tells you whether it works. ## In brief A school AI policy should be short enough to read in one sitting and specific enough to answer the questions staff ask every day: what data can go into a tool, which tools are approved, what pupils may do, and who decides. Everything else belongs in the documents you already have. The test is whether a teacher can answer those four questions without asking anyone. ## Key takeaways - A school AI policy is judged by whether staff can use it, so length is a cost, not a sign of care. - Four questions settle most daily decisions: what data can go into a tool, which tools are approved, what pupils may do, and who decides. - The Department for Education recommends that personal data is not used in generative AI tools, which makes the data rule the one clause every policy needs in plain words. - Ofsted's June 2025 study of early adopters found no consensus on whether AI needs a separate policy or belongs inside existing ones such as safeguarding and acceptable use. - A short policy needs a short review cycle: a termly check of the approved tools and a full review at least once a year. - Write the policy with a small group and consult staff before it is final, because people follow rules they helped shape. A school AI policy should be short enough to read in one sitting, because every extra page is a page a busy teacher is less likely to reach. The test is whether a member of staff can answer the four questions they actually ask, without asking anyone: what data can go into a tool, which tools are approved, what pupils may do, and who decides. Most schools that write an AI policy make the same quiet mistake: they write it for the file, not for the person who has two minutes before a lesson. The result is eight pages that are accurate, careful and unread. My view is that the length of a policy is a cost, and the test above is the one I would apply. ## What are the four questions a school AI policy has to answer? Four questions cover most of the daily decisions, and I offer them as my suggested test, not a statutory list. 1. **What data can go into a tool?** This is the one that matters most. The Department for Education's [generative AI policy paper](https://www.gov.uk/government/publications/generative-artificial-intelligence-in-education/generative-artificial-intelligence-ai-in-education) states: "It is recommended that personal data is not used in generative AI tools." A policy that says this in plain words, and says what staff do if they get it wrong, has done its most important job. 2. **Which tools are approved?** A short list, with a date and a named reviewer beside each. [What to require before approving an AI tool](https://blog.theaieducator.io/posts/approving-ai-tools-for-schools) goes through the checks. 3. **What may pupils do, and how do they say so?** By age and subject, with a simple way for pupils to acknowledge AI help. Assessed work follows the exam board's rules exactly. 4. **Who decides?** One named senior leader owns the policy, and one person approves tools. [Who should own AI strategy](https://blog.theaieducator.io/posts/who-should-own-ai-strategy) explains why this cannot be spread across a committee. If your policy answers those four clearly, it has done most of what a policy can do. ## Does a school need a separate AI policy at all? Not always, and the evidence does not insist on one. Ofsted's June 2025 study, ["The biggest risk is doing nothing"](https://www.gov.uk/government/publications/ai-in-schools-and-further-education-findings-from-early-adopters/the-biggest-risk-is-doing-nothing-insights-from-early-adopters-of-artificial-intelligence-in-schools-and-further-education-colleges), found no consensus among its early-adopter leaders on whether AI needed a separate policy or belonged inside existing ones such as safeguarding and acceptable use. Hold that finding at its true size. The study is small, the schools chose to be early, and it cannot tell you what a typical school should do. What it does show is that the choice is a practical one. If your existing policies already cover data, safeguarding and assessment well, a one-page AI statement that points to them can be enough. If they do not mention AI at all, a short standalone policy is the clearer route. ## What should a short policy leave out? Anything another document already owns. Data protection law belongs in your data protection policy. Safeguarding procedure belongs in your safeguarding policy. Exam malpractice rules belong with your assessment policy and the awarding bodies. The AI policy should point to each, in a sentence, and add only what is new about AI. It should also leave out a long list of tools. Tools change faster than policies. Keep the list as a separate one-page appendix you can update each term, and keep the policy itself for the principles that will still be true next year. ## What I see in practice The policies that get used are written by a small group, not a single author. In my view that group needs the data protection lead, the designated safeguarding lead, someone who knows assessment, and at least one classroom teacher, with a senior leader owning the result. The teacher matters because they will spot a clause that reads well and cannot be followed on a Tuesday. The mistake I would warn against is writing the policy to reassure inspectors or governors. Those readers matter, and they are better served by a policy staff follow than by a long one nobody does. [What to do when staff use unapproved tools](https://blog.theaieducator.io/posts/what-to-do-about-shadow-ai) takes apart why staff go round an approved route, and the answer is rarely carelessness. ## How do you keep a short policy useful? Put a review date in it and keep it. Check the approved tools list each term and review the whole document at least once a year, sooner if a major tool, law or official guidance changes. Tell staff what changed in two lines, not a new document. Consult staff before you finalise it. Staff concern is useful evidence about what the policy has to answer, and people follow rules they helped shape. Where it is age-appropriate, ask pupils too. ## What should you do this half term? Write the four answers on one page. Share them with staff and ask what is missing. Fold what you learn into a draft, take it to governors or trustees, and set the first review date. If you want the outline, sample clauses and a 90-day plan in one place, I have set them out in a [school AI policy guide](https://theaieducator.io/school-ai-policy?utm_source=blog.theaieducator.io&utm_medium=referral&utm_campaign=short-school-ai-policy). If your leadership team needs the wider direction the policy sits inside, that is the work I support through [AI strategy sessions for school leaders](https://theaieducator.io/ai-strategy-for-schools?utm_source=blog.theaieducator.io&utm_medium=referral&utm_campaign=short-school-ai-policy). I also write about these questions for the newsletter, and you can [join it here](https://theaieducator.io/?utm_source=blog.theaieducator.io&utm_medium=referral&utm_campaign=short-school-ai-policy#newsletter). ## Sources and further reading - Department for Education, [Generative artificial intelligence (AI) in education](https://www.gov.uk/government/publications/generative-artificial-intelligence-in-education/generative-artificial-intelligence-ai-in-education), policy paper. - Ofsted, ["The biggest risk is doing nothing": insights from early adopters of artificial intelligence in schools and further education colleges](https://www.gov.uk/government/publications/ai-in-schools-and-further-education-findings-from-early-adopters/the-biggest-risk-is-doing-nothing-insights-from-early-adopters-of-artificial-intelligence-in-schools-and-further-education-colleges), June 27, 2025. *Dan Fitzpatrick is the founder of The AI Educator, a Forbes contributor and a bestselling author on AI in education. [More about Dan](https://theaieducator.io/about?utm_source=blog.theaieducator.io&utm_medium=referral&utm_campaign=short-school-ai-policy).* ## Frequently asked questions ### How long should a school AI policy be? Short enough to read in one sitting, usually one to three pages plus a one-page summary for staff. If a teacher cannot find the answer to a daily question in it, it is either too long or missing the question. ### Does a school need a separate AI policy? Not necessarily. Ofsted's early adopters did not agree on whether AI needed its own policy or belonged inside safeguarding, data protection and acceptable use. A short AI statement that points to those documents is a sound start. ### What is the most important clause in a school AI policy? The rule on personal data. The Department for Education recommends that personal data is not used in generative AI tools, so the policy should say plainly what staff must not enter and what to do if they have. ### How often should a school AI policy be reviewed? Check the approved tools list each term and review the whole policy at least once a year, sooner if a major tool, law or official guidance changes. ### Who should write a school AI policy? A small working group led by a senior leader, including the data protection lead, the designated safeguarding lead, a curriculum or assessment lead and a classroom teacher. Governors or trustees approve it, and staff are consulted first. --- Source: [Why a Short School AI Policy Beats a Long One](https://blog.theaieducator.io/posts/short-school-ai-policy) Publisher: [The AI Educator](https://theaieducator.io)