An AI policy for primary schools: free template and annex
A school AI policy needs to cover five things: which tools are approved and for what; what is prohibited — above all, putting identifiable pupil data into consumer tools; how data protection duties, including a DPIA, are met; how AI interacts with statutory writing assessment; and how staff are trained and the policy reviewed. The template below covers all five, with every clause tied to current DfE, ICO and STA guidance.
Last updated: · Free to copy and adapt — no download gate, no email required
Who this template is for
Written for the people who have to own the answer when a parent, governor or moderator asks “what is your policy on AI?”:
- Headteachers and SLT who need a defensible, current position on AI use — staff-facing and pupil-facing — approved by governors.
- Data protection officers and business managers who need the DPIA trigger, procurement checks and privacy-notice duties in one place.
- English and assessment leads — especially in Year 6 — who need the STA's independence rules translated into clauses staff can actually follow.
How to adapt this template
- Name an owner (a member of SLT) and involve your data protection officer from the start.
- Replace the placeholders in [brackets] and list the AI tools your school has actually approved, with what each is approved for.
- Complete or update a DPIA for each tool that touches pupil personal data (section 4) before it goes near a classroom.
- Align it with the policies you already have: data protection, online safety, marking and feedback, and homework.
- Take it to governors, publish it with a review date, and tell parents (the model note in section 7 is a starting point).
- Diarise a review for September 2026, when KCSIE 2026 comes into force.
A starting point, not legal advice. This template reflects the DfE, ICO and STA guidance linked from each clause, as published at the date above. It is not legal advice, and it cannot know your school's circumstances — have your DPO, and where appropriate your legal advisers or trust data protection team, review whatever you adopt.
The template: model AI policy for a primary school
Everything below is free to copy into your own document. Each clause carries a one-line why pointing at the guidance it comes from, so you can defend it — or deliberately depart from it — at governors.
1. Scope and definitions
What this policy covers, and what the words mean.
This policy applies to all staff, governors, volunteers and pupils of [school name], and covers any use of AI tools that relates to the school, its pupils or its data — on school or personal devices, on or off site.
Why: The DfE's generative AI policy paper addresses both staff-facing and pupil-facing use; a policy that only covers pupils misses most actual AI use in a primary school.
Generative AI means tools that produce text, images, audio or video in response to a prompt, including large language models. Consumer AI tool means a general-purpose service used under a personal account, with no contract with the school. Approved AI tool means a tool on the school's approved list (clause 2.4), procured with a data processing agreement where pupil personal data is involved.
Teacher-mediated use means AI whose output is reviewed, and where necessary edited or rejected, by a member of staff before it is used or shared. All approved uses in this policy are teacher-mediated: no AI output reaches a pupil or parent unreviewed.
Why: The DfE's guidance keeps responsibility for the quality and content of AI-assisted work with the professional who produced it (DfE, Generative AI in education).
2. Approved uses
What staff and pupils may do with approved AI tools.
Staff may use approved AI tools to support planning, resource creation, drafting of routine communications and administration, provided the member of staff checks every output for accuracy and appropriateness before use and remains responsible for it.
Why: The DfE recognises AI's potential to reduce workload on planning, resources and administration, provided professionals check outputs and remain responsible for them (DfE, Generative AI in education).
Staff may use approved AI tools to help assess completed work and draft feedback, provided the work was finished before the tool saw it, the teacher reviews and can edit all feedback before anything reaches a pupil or parent, and the requirements of Annex A are met for writing that may support statutory teacher assessment.
Why: The DfE lists feedback among legitimate uses with professional oversight; the STA rules on what happens to the pupil's writing afterwards are in Annex A (DfE; STA).
Pupils may use AI tools only where the tool is approved for pupil use, its age restrictions permit it, the activity is closely supervised by staff, and the school's filtering and monitoring arrangements cover the tool.
Why: The DfE says pupils should only use generative AI with appropriate safeguards, such as close supervision and tools with safety, filtering and monitoring features, and schools must comply with tools' age restrictions (DfE, Generative AI in education).
The school maintains an approved AI tools register recording, for each tool: what it is approved for, who approved it and when, the DPIA reference where pupil personal data is processed, and the date of last review against the DfE's product safety expectations.
Why: The DfE's product safety expectations set out what generative AI products should meet to be considered safe for use in education — a ready-made procurement checklist.
3. Prohibited uses
These apply to everyone, on any device.
No one may enter identifiable pupil data — names, photographs, work with names visible, or any SEND, medical or safeguarding information — into a consumer AI tool, or into any tool that has not been approved under this policy with the data protection officer's confirmation that inputs are protected and not used to train the model.
Why: The DfE recommends that personal data is not used in generative AI tools, and requires a DPO check — including that inputs are not used to train the model — before pupil personal data enters any AI tool (DfE, Generative AI in education; DfE, Data protection in schools).
AI-generated work must never be presented as a pupil's own, and writing produced in full or in part by AI must never be used as evidence for statutory teacher assessment (Annex A).
Why: The STA is explicit that writing produced in full or in part by AI must never be used to reach teacher assessment judgements — doing so risks a maladministration investigation (STA, KS2 teacher assessment guidance).
Pupils must not have access to AI tools during the composition of any writing the school intends to assess, including when word processing (Annex A, clause A5).
Why: Under the STA's guidance, access to large language models should be disabled when pupils word process assessed writing (STA).
AI output must not be used unchecked in any record or communication with significant consequences for a pupil or member of staff — references, safeguarding records, SEND documentation, reports to parents — and no significant decision about a pupil may be delegated to an AI tool without human review.
Why: Responsibility for outputs stays with the professional; high-stakes documents demand the highest scrutiny (DfE, Generative AI in education).
4. Data protection and DPIA checklist
The school is the data controller for pupil personal data. Before any AI tool processes pupil personal data, the data protection officer leads the following checks.
A data protection impact assessment is completed before adopting any AI tool that processes pupil personal data — as early as possible in procurement, before any decision is made on how the data will be processed — and kept updated as the processing changes.
Why: UK GDPR requires a DPIA where processing is likely to result in a high risk, particularly with new technologies; the ICO lists AI as innovative technology and flags children's data (ICO, When do we need to do a DPIA?). The DfE says complete it as early as possible, ideally before decisions are made (DfE, Procuring edtech).
The DPIA and procurement records answer, as a minimum: what personal data the tool processes and why; the lawful basis; whether the supplier is a processor or a controller for any feature; where data is stored and any international transfers; whether inputs are used to train models; retention periods; breach notification; and how data is returned and deleted when the school leaves.
Why: These are the checks the DfE sets out for edtech procurement: assigned responsibilities in a contract or data processing agreement; storage locations and international transfers; deletion, return and exit timescales (DfE, Procuring edtech).
The school's privacy notice is updated to cover every approved AI tool that processes personal data, describing how data is collected, processed and stored.
Why: The DfE requires schools to include how data is collected, processed and stored by generative AI tools in the school's privacy notice (DfE, Data protection in schools).
Pupils' original work is protected by copyright. The school does not allow pupils' work to be used to train AI models unless permission has been given by the pupil or their parent or an exception applies, and confirms each approved tool's position on this in its DPIA.
Why: The DfE is explicit that schools must not allow or cause pupils' original work to be used to train generative AI models without permission or a copyright exception (DfE, Generative AI in education).
5. Safeguarding, filtering and monitoring
AI sits inside the school's existing safeguarding framework, not beside it.
The school's filtering and monitoring arrangements cover pupil access to generative AI, and pupil-facing tools are checked against the DfE's product safety expectations before approval.
Why: KCSIE 2025 points schools to the DfE's Generative AI: product safety expectations, which explain how filtering and monitoring requirements apply to generative AI (DfE, Keeping children safe in education).
AI-generated harmful content — including digitally altered or wholly AI-generated imagery of pupils or staff — is treated as a safeguarding matter and reported to the designated safeguarding lead under the child protection policy, exactly as equivalent non-AI content would be.
Why: KCSIE 2026 (in force 1 September 2026) brings AI-generated imagery, including deepfakes, explicitly within its treatment of nudes and semi-nudes (DfE, Keeping children safe in education).
The school's homework and unsupervised-study expectations account for the availability of generative AI at home, and make clear to pupils and parents which tasks must be the pupil's own unaided work.
Why: The DfE suggests schools may wish to review homework policies and other unsupervised study to account for the availability of generative AI (DfE, Generative AI in education).
6. Staff training and review cycle
A policy nobody is trained on is a document, not a policy.
All staff receive induction and an annual refresher covering this policy: the approved tools register, the prohibition on identifiable pupil data in unapproved tools, the limits of AI output (inaccuracy and bias), and the Annex A rules for assessed writing.
Why: The DfE expects professionals to apply critical judgement to AI outputs, which requires knowing their limitations (DfE, Generative AI in education).
This policy is owned by [named SLT member], reviewed with the data protection officer at least annually — and immediately when KCSIE, STA assessment guidance or DfE AI guidance changes — and approved by governors. Next review: [date].
Why: The guidance this policy rests on moves quickly: KCSIE is reissued each September, the STA guidance each assessment year, and the DfE's AI guidance has been updated repeatedly since 2023.
7. Model note to parents
Adapt and send when the school first adopts an AI tool that touches pupil work. Transparency duties sit in the privacy notice (clause 4.3); this note is how you keep parents genuinely informed.
Dear parents and carers,
We want to tell you how [school name] uses artificial intelligence. Our teachers use [tool name], an approved education tool, to help them assess completed writing and prepare feedback. Your child's teacher reviews everything the tool produces and decides what, if anything, is shared with your child or with you. Children do not use the tool and do not have accounts.
Before adopting it we completed a data protection impact assessment with our data protection officer. Your child's work is processed only to provide feedback to their teacher, is not used to train AI models, and is deleted when no longer needed. Full details are in our privacy notice at [link]. AI is never used to write for children, and national rules on independent writing are followed for any work that counts towards statutory assessment.
If you have any questions, or would like to discuss this, please contact [DPO/headteacher contact].
Annex A. AI and statutory writing assessment (KS1 and KS2)
The part most templates miss. These clauses turn the STA's independence rules into policy — quoted wording is verbatim from the key stage 2 teacher assessment guidance (STA, updated 2 March 2026), section 6.2. The full walkthrough of what the guidance says and means is at AI marking and independent writing.
Statutory teacher assessment judgements in writing are based only on work the pupil produced independently.
Why: STA: “Teachers’ judgements must only be based on writing that a pupil produced independently.”
Where a pupil edits or rewrites a piece following AI feedback, the redraft is treated as taught work, not independent evidence. The original, independently produced version is retained as the evidence in the pupil's collection.
Why: STA: writing is not independent if it has been “edited or rewritten following feedback from large language models or other forms of artificial intelligence (AI)”.
Writing produced in full or in part by AI is never used to reach teacher assessment judgements, under any circumstances.
Why: STA: writing “produced, either in full or in part, using large language models or other forms of artificial intelligence” used to reach TA judgements “could result in the school being investigated for maladministration”.
Teachers record where AI was used to provide feedback, and on which pieces, and make this clear to moderators so affected work can be excluded from the collection.
Why: STA: teachers “should make it clear to moderators where they have used AI programmes to provide feedback, so this work can be excluded from the pupil’s collection of writing”.
When pupils word process writing that may support assessment judgements, spelling and grammar checkers and any access to large language models are disabled.
Why: STA: when pupils word process, “it is advised that the spelling and grammar check functions, as well as any access to large language models, are disabled”.
A teacher may use an approved AI tool to inform their own assessment of a completed piece: this does not change how the writing was produced, and the piece remains independent if it was produced independently. Feedback feeds forward into the next piece of writing rather than into redrafts of evidence pieces.
Why: The STA rules restrict what happens to the pupil's writing, not what informs the teacher's judgement; the DfE treats checked, professionally owned AI use as legitimate (DfE; STA).
Sources
Every clause above traces back to one of these documents. If a clause and a source ever disagree, the source wins — and we would like to know: tell us.
- Department for Education (updated 12 August 2025), “Generative artificial intelligence (AI) in education” — policy paper covering staff and pupil use, personal data, safeguarding, homework and intellectual property.
- Department for Education (updated 9 July 2026), “Data protection in schools: generative artificial intelligence (AI) and data protection in schools” — DPO checks before pupil data enters an AI tool; privacy notices must cover generative AI.
- Department for Education (updated 9 July 2026), “Data protection in schools: procuring educational technology (EdTech)” — DPIAs completed as early as possible; contracts, storage locations, transfers, and exit planning.
- Department for Education (updated 19 January 2026), “Generative AI: product safety expectations” — the capabilities generative AI products should meet to be considered safe for use in education, including filtering and monitoring.
- Department for Education, “Keeping children safe in education” — the 2025 edition is statutory until 31 August 2026; the 2026 edition was published on 7 July 2026 and comes into force on 1 September 2026.
- Information Commissioner's Office, “When do we need to do a DPIA?” — a DPIA is required where processing is likely to result in a high risk, particularly using new technologies; AI and machine learning are listed as innovative technology.
- Information Commissioner's Office, “Examples of processing ‘likely to result in high risk’” — includes large-scale profiling of children and the use of innovative technologies such as AI.
- Standards and Testing Agency (updated 2 March 2026), “Key stage 2 teacher assessment guidance”, section 6.2 Independent writing — all STA wording in Annex A is quoted verbatim from this document.
Where Howay fits a policy like this
We publish this template because Howay was designed to sit inside exactly these requirements, not around them. Against the clauses above: feedback is teacher-mediated by design — every output is reviewed and editable before a child or parent sees it (clauses 1.3, 2.2); Howay operates under UK GDPR, processes writing only to return feedback to the uploading teacher, and children do not have accounts (clauses 3.1, 4.2); and it works on completed writing, on the teacher's side of the STA line (Annex A6). More on the data questions at is AI marking safe?
If your school or trust is evaluating AI feedback tools, see Howay for schools & MATs — or contact us about a pilot, including the documentation your DPO will want for section 4.
Common questions
- Do we need a DPIA for an AI marking tool?
- In almost all cases, yes. UK GDPR requires a data protection impact assessment where processing is likely to result in a high risk to individuals, particularly when using new technologies. The ICO lists artificial intelligence and machine learning among examples of innovative technology, and processing children's data raises the risk further. The DfE's data protection guidance for schools says a DPIA should be completed as early as possible, ideally before any decisions are made about how personal data will be processed. Your data protection officer should lead it, using the supplier's own documentation. Read more: Is AI marking of children's writing safe?.
- Can teachers use ChatGPT for marking?
- Not with identifiable pupil work in a personal consumer account. The DfE recommends that personal data is not used in generative AI tools, and its data protection guidance tells staff to check with the school's data protection officer before entering pupils' personal data into any AI tool — including checking that inputs are not used to train the model. A personal chatbot account fails those checks; an approved education tool operating under a data processing agreement can pass them. There is also a quality question: a general-purpose chatbot is not aligned to the writing curriculum your school assesses against. Read more: Howay vs ChatGPT for marking.
- Does AI feedback affect KS2 writing moderation?
- It can. The STA's key stage 2 teacher assessment guidance says that writing a pupil has edited or rewritten following feedback from AI is not independent, and that writing produced in full or in part by AI must never be used to reach teacher assessment judgements — doing so risks a maladministration investigation. What the guidance does not restrict is a teacher using AI to inform their own assessment of a completed piece: that changes nothing about how the writing was produced. Annex A of this template turns those rules into policy clauses. Read more: AI marking and independent writing at KS2.
- What does KCSIE actually say about AI?
- Less than many summaries suggest. KCSIE 2025 — statutory until 31 August 2026 — addresses generative AI briefly, pointing schools to the DfE's Generative AI: product safety expectations, which explain how filtering and monitoring requirements apply to generative AI. KCSIE 2026, published on 7 July 2026 and in force from 1 September 2026, goes further: it brings AI-generated imagery, including deepfakes, explicitly within its treatment of nudes and semi-nudes, and directs schools to DfE guidance covering teacher-facing and pupil-facing AI tools. Review your policy's safeguarding section against the 2026 edition before September.
- Do we need parental consent to use AI marking tools?
- Consent is not usually the lawful basis schools rely on for processing pupil data — your data protection officer should confirm the lawful basis for each tool — but transparency is required either way. The DfE's data protection guidance says your school's privacy notice must cover how data is collected, processed and stored by generative AI tools. Separately, the DfE is explicit that pupils' original work must not be used to train AI models without permission from the pupil or their parent. Writing to parents directly, as in the model note in section 7 of this template, is good practice and makes questions easier to handle.
Try Howay free. No card required.
Every account starts with 30 days of full Pro access, with unlimited classes, assignments, and feedback.
Get started