What Belongs in a School AI Acceptable Use Policy?

1. 01

   Stable rule

   Policy committee

   Approve the smallest school-wide, non-negotiable requirement that should survive routine product and practice changes.

2. 02

   Maintained control

   Named operational maintainer

   Keep the current register, guidance or procedure accurate and visibly linked to the policy requirement.

3. 03

   Local review

   Relevant specialist or adviser

   Confirm the law, safeguarding duty, contract, assessment rule or governance requirement that applies in this setting.

4. 04

   Change trigger

   Policy owner

   Reopen the decision when a material product, data, legal, assessment or operating change affects the approved boundary.

School leaders are often asked to approve an AI policy that tries to do everything at once. It names current tools, age limits, classroom examples, disclosure wording, incident contacts and the steps staff should follow. The draft looks complete, but one provider update or assessment rule change can make it unreliable.

The decision is not whether the school needs rules. It is which decisions need formal policy approval and which details need a faster, maintained route.

This brief supports that boundary decision. It is not a copy-ready policy or legal advice. Final documents must reflect the laws, safeguarding duties, assessment rules, contracts and governance arrangements that apply to the school.

Decision criteria

An expectation belongs in policy when it passes four tests.

• Stable: It should remain valid if a product, feature, setting or example changes.
• School-wide: It should apply across roles, tools or use cases, not only one lesson or workflow.
• Non-negotiable: It should establish a boundary, responsibility or decision right that needs formal approval.
• Traceable: It should point readers to the current register, guidance or procedure that explains what to do.

Product names, live settings, worked examples, contact details and step-by-step response instructions normally belong in a companion control. Anything that depends on law, regulation, contracts or awarding-body rules requires local review.

TeachAI’s AI Guidance for Schools Toolkit illustrates how education systems can address AI across responsible-use, privacy and academic-integrity policies. Its examples are prompts for local policy work, not wording to adopt without review.

Options and trade-offs

One all-in-one AI policy

Staff have one document to find, but changing details age quickly and minor updates repeatedly return to formal approval. Use this option only if the document separates durable requirements from maintained schedules or linked controls.

AI rules integrated into existing policies

Responsibilities can sit with the safeguarding, data, assessment and acceptable-use controls that already govern them. The risk is that staff cannot see the overall position when links and ownership are weak. This is viable when there is a clear index, consistent definitions and one accountable owner.

A short AI policy linked to companion controls

Durable boundaries remain visible while operational detail can be maintained at the right pace. Links can still become orphaned if no one owns the supporting controls. This is the recommended default, whether the formal rules sit in one policy or several existing policies.

Guidance without approved policy boundaries

Guidance can change quickly, but staff must interpret what is optional, prohibited or accountable. Reject this option where the school has not formally approved the underlying boundaries.

The recommended position is a two-layer policy system. The first layer contains durable rules and decision rights. The second contains named registers, guidance and procedures with their own maintainers and review triggers. A school may implement that structure through one AI policy, amendments to existing policies or a combination. The document layout is a local governance choice. The boundary is the important decision.

The durable decisions to record

The following ten areas form a useful completeness check. They do not prescribe exact wording.

• Scope: State who and which school activities the rules cover, including AI-enabled services used for learning, administration or operations. Maintain the current system inventory and working definitions elsewhere.
• Approved use: Require an authorised purpose and approval route before a new AI use is adopted. Maintain approved tools, permitted users, settings, risk evidence and procurement records in a current register.
• Restricted data: Prohibit personal, sensitive or confidential information from entering an unauthorised service. Maintain data classifications, privacy notices, data-flow reviews, retention rules and escalation steps.
• Human oversight: Keep people accountable for checking outputs and making consequential educational or operational decisions. Maintain role-specific checking standards, support routes and escalation guidance.
• Student use: Require an authorised educational purpose, age-appropriate safeguards and clear task expectations. Maintain classroom rules, access settings, monitoring arrangements and learning materials.
• Disclosure: Require material AI assistance to be acknowledged under the relevant school or assessment rule. Maintain current examples of when and how to acknowledge assistance.
• Assessment: Connect AI use to the school’s authenticity, assessment and malpractice controls. Maintain assignment conditions, authentication evidence and suspected-misuse procedures.
• Incidents: Require privacy, safeguarding, security and assessment concerns to be reported through the relevant route. Maintain triage, containment, evidence, notification and response procedures.
• Ownership: Name an accountable owner and formal approval route. Maintain operational contacts, advisers, decision records and the meeting rhythm.
• Review: Set a review schedule and material change triggers. Maintain version history, monitoring evidence and scheduled checks.

For schools and colleges in England, the Department for Education’s guidance on generative AI in education connects intended use with safeguarding, age restrictions, filtering, monitoring and professional responsibility. International schools can use it as a jurisdiction example, but should not treat it as a universal rule.

The same boundary applies to data. The DfE’s data-protection guidance for generative AI in schools advises schools in scope to understand how tools process personal data and involve the relevant data protection or technical lead. The policy should establish the requirement. The live data-flow evidence and approval record belong in maintained controls.

For assessment, formal policy should connect to the applicable rules rather than reproduce changing conditions. JCQ’s guidance on AI use in assessments applies within its defined scope. It should not be generalised to every classroom activity or jurisdiction. TopSchool’s guide to AI and assessment in schools can support the separate decision about evidence of learning and assessment design.

Risks to test before approval

The overloaded policy

The policy names products, settings, examples, forms, contacts and operational steps. It appears precise, but begins ageing as soon as one detail changes. Staff cannot tell which version is current, and routine changes repeatedly return to the formal approval process.

The hollow policy

The policy asks people to use AI responsibly, protect data and apply human judgement without defining a boundary or linking to an operating control. It stays current because it says little. Staff are left to make their own rules.

The orphaned hand-off

Changing detail has been moved out of policy, but the destination has no maintainer, version or review trigger. The formal rule is sound while its operating route quietly becomes unreliable.

The false universal

A useful requirement from one jurisdiction, qualification or provider is written as if it applies everywhere. Assign local review for legal, safeguarding, contractual and assessment questions before approval.

UNICEF’s Guidance on AI and Children offers a child-centred review lens covering safety, privacy, fairness, transparency, accountability and inclusion. It is a lens for testing the whole boundary, not a ready-made school policy.

Recommendation

Approve an AI policy boundary only when every material expectation has four connected records:

1. The stable rule approved through the school’s policy route.
2. The named control that holds changing detail.
3. The local review needed for this setting.
4. The event that should reopen the decision.

This keeps policy concise without making it vague. It also exposes missing governance. A rule with no operating route is not usable. A practice with no approved boundary is not accountable.

Questions for the approval meeting

• Can staff identify the non-negotiable rule without reading a product manual?
• Can the school change an approved-tool list without reopening the policy?
• Does every changing detail have an exact destination and named maintainer?
• Are policy links, control versions and review triggers visible to the people who need them?
• Have local legal, safeguarding, contractual and assessment questions been assigned for review?
• Can the accountable owner explain how one current AI use moves from proposal to approval, operation, incident response and review?

If any answer is no, revise the boundary or its maintained controls before approval. The aim is not the shortest possible policy. It is a policy that carries the right decisions and remains trustworthy while the technology around it changes.