AI use policy for a school or training provider

A school or training provider has two AI questions where a business has one: what its staff may do with the tools, and what its learners may do, and the second is bound up with assessment integrity, safeguarding and the special protection the law gives children's data. The policy sets the staff rules, the learner rules (permitted and prohibited use by course and age, declared where used), the safeguarding position on chatbots and the awarding bodies' requirements, with terms for parents and learners that match. The business receives its AI use policy and the contract provisions that go with it within five working days for a fixed £995.

Who this is for

Independent schools, colleges, apprenticeship and training providers, tuition centres and online education businesses in England and Wales (maintained schools follow the Department for Education's guidance and their own governance, which the policy can be adapted to).

What matters in a school or training provider's AI use policy

Staff use, learner use and the two policies in one

The policy has a staff section (the tools approved for planning, resources, marking support, feedback, reports and administration; the accounts; the checking; the data) and a learner section (what learners may use tools for in each course, what they must declare, what is prohibited, and the rules for assessed work), and the two are written to be consistent with each other and with the provider's existing academic integrity, acceptable use, safeguarding and data protection policies, and the Department for Education's guidance on generative AI in education and the awarding bodies' joint guidance are the references the policy follows.

Pupils' data, the design code and the tools that may not have children in them

entering personal data into an AI tool is processing under the UK GDPR and brings with it the need for a lawful basis, a notice to the individuals, an Article 28 data processing agreement with the provider and, where people are affected, an Article 35 impact assessment, and the data of pupils (their work, their progress, their needs, their safeguarding records) is children's data with the specific protection the UK GDPR gives it; the policy requires pupils' data to enter only tools the provider has vetted under a data processing agreement, with training on inputs excluded, with the age appropriate design code under section 123 of the Data Protection Act 2018 applied to any tool pupils themselves use (many consumer tools' terms exclude children altogether), with special category data (needs, health, safeguarding) kept out of general-purpose tools, and with the parent and pupil privacy notices describing the tools.

Marking, feedback and the decision about a learner

A tool that marks, grades, predicts or flags a learner is making or shaping a decision about them, and article 22 of the UK GDPR, as amended by the Data (Use and Access) Act 2025, governs decisions with legal or similarly significant effects taken solely by an AI tool, permitting them outside special category data where the person is informed, can make representations, can obtain human intervention and can contest; the policy requires marks, grades, predictions, set placements and interventions to be decided by a teacher with the tool as support, requires feedback generated by a tool to be read and owned by the teacher before it reaches the learner, prohibits tools from deciding a learner's progression or sanctions, and requires the provider to be able to explain to a parent how a tool was used.

Academic integrity and the work a learner did not write

The awarding bodies treat the submission of generated work as the learner's own as malpractice, require centres to have policies and to teach learners what is permitted, and expect declarations and the usual authentication of work, and the policy sets the rules by course (what tools may be used for research, drafting, checking and presentation; what must be declared and how; what is prohibited for assessed work), the consequences under the provider's existing malpractice and disciplinary procedures, and the provider's position on detection tools, which are unreliable and produce false positives that fall on particular groups; the policy requires staff to assess integrity through the awarding bodies' methods (drafts, discussion, in-class work, known ability) and to treat a detection score as one indicator at most.

Safeguarding, chatbots and the conversations children have with machines

A provider that gives learners access to a chatbot (a tutoring assistant, a homework helper) has a safeguarding question: whether the tool can say harmful things, whether disclosures of harm are escalated, whether an adult sees the conversations, whether it was designed for children; the policy requires any learner-facing tool to be assessed by the designated safeguarding lead, configured for children where the provider offers it, set to escalate disclosures to a person, covered by the provider's filtering and monitoring obligations, and used only with parents informed; a tool whose terms permit training on inputs or their retention is off limits for confidential information, trade secrets and clients' data, because protection under the Trade Secrets (Enforcement, etc.) Regulations 2018 and compliance with the business's confidentiality obligations depend on the steps taken, and a school's confidential information includes its pupils' records.

Parents, awarding bodies and the contract provisions that go with the policy

The contract provisions drafted with the policy go into the parent contract and the learner agreement (the provider's use of tools in teaching, marking and administration; the learner's obligations and the consequences; the data processing the parent is told about; the position on learner-facing tools), the provider's staff contracts and handbook (the policy incorporated, with breach a disciplinary matter), the supplier agreements with education technology providers (children's data, the design code, training excluded, the safeguarding configuration, the data processing agreement), and the centre agreements with awarding bodies that require the policy to exist; the policy is reviewed each academic year.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Can our teachers use AI to mark work?

As support to a teacher who decides the mark and owns the feedback, on approved tools under a data processing agreement with training excluded, with pupils' data entering only vetted tools. A tool must not decide a learner's grade, placement or sanction on its own.

Can we use a detection tool to catch generated coursework?

As one indicator at most: detection tools are unreliable and produce false positives that fall on particular groups. The awarding bodies' methods (drafts, discussion, in-class work, known ability) are the basis for an integrity decision, under the existing malpractice procedure.

We want to give pupils a homework chatbot. What do we need?

A safeguarding assessment by the designated lead, a tool designed or configured for children with disclosures escalated to a person, the design code applied, parents informed, and the provider's filtering and monitoring obligations covered. Many consumer tools exclude children in their terms.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Privacy notice for a tutor or school
• AI use policy for a charity

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.