Back when OpenAI launched ChatGPT at the tail end of 2022, it was introduced as a conversational interface fine-tuned from a model in the GPT-3.5 series. Teachers, being teachers, quickly took to it as a means to help, mostly at that point with things like lesson plans, adaptive resources and the day-to-day admin that teachers have to do. In many ways it was like the wild west, and it was adopted so quickly. Within a fortnight, it’s fair to say that it was likely that someone in every staffroom across the country had used it in one way or another, yet nobody had thought to ask a single question about where the work went, what was happening to it, or the intellectual property and data questions sitting underneath all of it. People pasted reports into a free chatbot hosted by who knows who and who knows where, and nobody really thought about what happened to any of that information. What was missing was an AI policy template for schools.
ChatGPT reached a hundred million users faster, at the time, than any consumer product in history, and it walked into classrooms and was used by teachers long before it appeared in any policy document. There was no policy, no guidance, no DPIAs (data protection impact assessments), nothing procedural around procurement, no approval process. It was just teachers, on their knees in many ways, turning to tools to help them do all the work they have to do.
So what did I do?
For the start of the academic year in September 2023, I launched an AI policy template to try and help corral some of what was happening, and it was hugely popular. When things moved on, and Keeping Children Safe in Education and other guidance moved on with them, I released another in 2025. The pace of this stuff is relentless.
So here we are in 2026, and I’m launching a new one.
Everyone thinks they need an AI policy without really knowing what a good one looks like. A lot of the policies I see in education either miss out important elements, don’t consider the safeguarding side of things, such as KCSIE or the Data (Use and Access) Act amendments or the DfE product safety standards. There is so much of it, so it’s entirely understandable that people struggle to keep up when the Department keeps sending out update after update around data privacy that we all need to stay on top of.
What I’m launching today
Three things: a new Use of Artificial Intelligence (AI) Policy, a DPIA screening tool for AI products to sit alongside it, and a website that brings it all together and breaks down how to go about completing everything. That’s the home for the suite, and you’ll find it at aigovernance.ictevangelist.com.
It’s aimed at anyone in education who’s considering using AI.
When we talk policy, it’s often leadership, data protection leads, designated safeguarding leads, governors and trust leaders, but like learning and teaching, this is too important to leave to chance.
Everyone should know what’s inside this policy, because it really does matter, and getting ready for September matters too. KCSIE 2026 is going live. The UK GDPR has been amended by the Data (Use and Access) Act 2025, including new automated decision-making provisions. We’ve got the generative AI product safety standards from January, the JCQ guidance, the Online Safety Act, Ofcom’s Protection of Children code, and, of course, how our good friends at Ofsted now look at AI. None of that is meant as a lecture; the point is simply that the template is drafted against all of these things and more, and it’s incumbent on all of us to meet these requirements and regulations.
What’s inside
Inside the policy, you’ll see there are bits to fill in and bits you can leave out, depending on how you’re using it. But some things are non-negotiable: no personal or special category data into AI tools; keeping the human in the loop, alert to bias; a DPIA in place before deployment; approved tools only; and the safeguarding, Prevent and online safety duties. This is more than a fill-in-the-blanks exercise. It requires close attention, sharing, and discussion with all your key stakeholders.
The DPIA screening tool follows the ICO’s DPIA structure, screens against the product safety standards and the Children’s Code, and covers the new Articles 22A to 22D that some older DPIAs will miss. It’s not behind a paywall; if you’d like to grab it, it would be lovely to stay in touch, so fill the form in and grab your copy.
Why I do this work
In a world where we can do so many things with technology, I’ve always said that just because we can doesn’t mean that we should. When it comes to (any) use of technology, our approaches should always be pedagogy first, technology second.
The policy exists to enable good teaching with AI, not to lock it down. If you know my 5Cs of digital cognition framework or TPACK, I’ve written about both at length in The EdTech Playbook, which I wrote with Olly Lewis; do grab a copy if you want the fuller thinking. None of this is about stopping people using the tools they’re used to. It’s about making sure the tools you use are safe and properly provisioned within your school.
So take it, use it, adapt it; that’s absolutely fine. It’s protected by a Creative Commons licence (CC BY-NC-SA 4.0), and there’s information about that on the microsite. But to be clear: these are templates that require completion, checking and ratification in context, in your school. I’m not giving you legal advice. When you look at the documentation I’ve had to synthesise to bring this together, you’ll see it’s a considerable piece of work, and if you’d like support with any of it through the consultancy and training work I do, please do reach out and drop me a line; I’d love to help.
I’m currently working on an Acceptable Use Policy template to join the suite. If that’s something you’d like, let me know: drop me an email, ping me a DM or leave a comment. It would be lovely to hear from you.
Head over to aigovernance.ictevangelist.com, have a look around, grab the template and let me know what you think.
