AI in Schools: Opportunity, Responsibility and Risk – What School Leaders Need to Know
Artificial intelligence is increasingly becoming part of everyday school life. From supporting lesson planning and drafting communications to analysing information and reducing administrative workloads, the opportunities are considerable.
However, as AI technology becomes more sophisticated, the questions schools need to ask are changing.
It is no longer simply about whether staff should use AI tools. It is increasingly about what those tools can access, what they can do with information and who remains responsible when something goes wrong.
Recent announcements from the Information Commissioner’s Office (ICO) highlight why schools, academies and multi-academy trusts need to consider these questions carefully.
The ICO’s latest warning: AI systems are becoming more autonomous
On 8 October 2026, the ICO announced that ten major AI developers had made, or committed to making, improvements to their data protection arrangements following regulatory scrutiny.
The improvements included greater transparency about personal data processing, stronger mechanisms for individuals to exercise their rights and better assessments of data protection safeguards.
At the same time, the ICO launched a consultation examining the risks associated with agentic AI.
Unlike conventional AI tools, which generally respond to individual prompts, agentic AI systems can undertake tasks, use other software, access information and interact with external systems with varying degrees of independence.
The ICO is particularly interested in how organisations manage data security, transparency, accountability, automated decision-making and lawful processing.
The consultation closes on 20 November 2026.
Original ICO announcement:
What does this mean for schools?
Consider two examples.
Example 1: Using AI to draft a letter
A school administrator uses an approved AI tool to help draft a general letter to parents about attendance expectations.
No identifiable pupil information is entered into the system.
The administrator reviews the draft before sending it.
Provided the tool has been appropriately assessed and approved, this represents a relatively straightforward use of AI.
Example 2: Using AI to analyse pupil information
A school introduces an AI assistant that can access its management information system, attendance records, behaviour information and SEND documentation.
The system can identify patterns, produce reports and potentially recommend or initiate actions.
This introduces significantly greater data protection considerations.
The school must understand precisely what information the system can access, how that information is processed, whether it is shared with other organisations and what safeguards prevent inappropriate access or disclosure.
If the system can independently perform actions, the school must also consider how those actions are authorised, monitored and controlled.
The distinction is important: using AI to produce information is not necessarily the same as allowing AI to access and act upon information already held by the school.
Schools already have legal responsibilities
The ICO’s latest announcement does not introduce a new legal requirement for schools.
However, existing UK GDPR and Data Protection Act 2018 responsibilities continue to apply when personal data is processed using AI.
Schools must consider several established principles.
1. Lawfulness, fairness and transparency
Schools must identify an appropriate lawful basis for processing personal data and ensure individuals receive suitable information about how their information is used.
Where special category data is involved, such as certain health information, an additional legal condition will generally be required.
2. Data minimisation
Only personal information necessary for a specific purpose should be processed.
For example, if an AI tool is being used to improve the wording of a letter, does it genuinely need the pupil’s name, date of birth, medical history or safeguarding information?
In many cases, it will not.
3. Security
Schools must implement appropriate technical and organisational measures to protect personal data.
This includes understanding how AI suppliers store, process, retain and secure information.
4. Accountability
Schools and trusts must be able to demonstrate that their processing activities comply with data protection legislation.
Using an external AI provider does not automatically transfer responsibility away from the school.
5. Data protection impact assessments
Where the proposed processing is likely to result in a high risk to individuals’ rights and freedoms, a Data Protection Impact Assessment (DPIA) is legally required.
This may be particularly relevant where AI is used to process sensitive pupil information, profile individuals or support significant decisions about children.
The need for a DPIA should be considered before introducing the technology.
What does the Department for Education say?
The Department for Education already provides specific guidance on generative AI and data protection in schools.
It advises schools to understand how AI tools use personal data, ensure that tools are approved and seek advice from their Data Protection Officer or IT lead.
Importantly, the DfE warns against entering identifiable pupil information into AI tools without first establishing that doing so is appropriate and secure.
Schools should also consider whether information entered into a system could be used to train AI models.
The DfE guidance reinforces an important principle:
The fact that an AI tool is readily available does not mean it is automatically appropriate for use with school information.
Schools should have clear arrangements for approving AI tools and communicating acceptable use to staff.
DfE guidance:
Six questions every school should ask before introducing AI
Schools do not necessarily need lengthy new policies for every AI application.
However, they should be able to answer six practical questions before introducing tools that process personal information.
1. What information will the AI tool access?
Will it process publicly available information, routine administrative data or sensitive pupil records?
The level of risk will vary considerably.
2. Has the school approved the tool?
Staff should not independently introduce AI systems involving personal data without appropriate organisational approval.
3. Where will the information go?
Schools should understand where information is stored, who can access it, whether subprocessors are involved and whether international transfers take place.
4. Can the information be used to train AI models?
The school’s contractual arrangements and supplier assurances should clearly address how information is used.
5. Who checks the outputs and actions?
AI-generated information may be inaccurate, incomplete or misleading.
Where an AI system can take actions, appropriate authorisation and human oversight become particularly important.
6. Has the DPO been consulted?
The Data Protection Officer should be involved appropriately and early, particularly where a new system introduces significant processing risks.
Cyber security remains a leadership responsibility
AI governance cannot be considered separately from wider cyber security arrangements.
On 8 October 2026, the National Cyber Security Centre (NCSC) issued a warning about sophisticated cyber activity targeting organisations internationally.
The advisory highlighted techniques involving compromised networks, automated tools and attempts to obtain sensitive information.
Although the warning was not directed specifically at schools, it reinforces the importance of maintaining effective cyber security arrangements.
Schools increasingly rely on interconnected systems containing significant amounts of personal information.
Introducing additional AI tools and integrations may create new routes through which information can be accessed or disclosed.
Schools should therefore ensure that their cyber security arrangements keep pace with changes in technology.
NCSC announcement:
A reminder from recent ICO enforcement
The importance of maintaining appropriate security arrangements was also reinforced by an ICO update on 7 October 2026.
The regulator confirmed the conclusion of its long-running enforcement proceedings involving DSG Retail Limited following a significant cyber attack.
The case reinforced the responsibility of organisations to implement and maintain appropriate technical and organisational security measures.
Although the proceedings concerned legislation predating the UK GDPR, the underlying message remains relevant.
Organisations must take reasonable and appropriate steps to protect the personal information they hold.
For schools, this means ensuring that technology decisions, supplier arrangements, information governance and cyber security are considered together.
ICO enforcement update:
Should schools stop using AI?
No.
AI offers considerable opportunities to reduce administrative workload, support teaching and learning and improve organisational efficiency.
The challenge is not to prevent innovation but to ensure that innovation takes place responsibly.
A proportionate approach should consider the intended purpose, the information being processed, the potential risks and the safeguards required.
A tool used to generate generic lesson resources will not necessarily require the same level of scrutiny as a system processing safeguarding information or making recommendations about individual pupils.
Schools should avoid treating all AI applications as presenting identical risks.
Equally, they should avoid assuming that a tool is safe simply because it is popular, widely available or provided by a familiar technology company.
What should school leaders do now?
There is no new statutory deadline arising from the ICO’s October announcement.
However, it provides a timely opportunity for schools and trusts to review their existing arrangements.
We recommend that schools:
Review which AI tools are currently being used by staff.
Establish a clear process for approving new AI applications.
Ensure staff understand what personal information can and cannot be entered into AI systems.
Review supplier arrangements where AI tools process personal data.
Consider whether existing privacy notices and policies adequately explain relevant AI processing.
Complete DPIAs where required.
Ensure that AI governance forms part of wider information governance and cyber security discussions.
These actions will help schools demonstrate that they are approaching AI responsibly while continuing to benefit from emerging technology.
Final thoughts
Artificial intelligence is developing rapidly, and its potential applications in education will continue to expand.
For school leaders, the central question is no longer simply whether AI can help.
It is whether the school understands how the technology works, what information it processes and how the organisation maintains appropriate control.
The ICO’s latest announcement reinforces something that has always been fundamental to good data protection:
Technology may change, but accountability remains.
Schools should embrace opportunities to improve efficiency and outcomes while ensuring that the personal information entrusted to them remains appropriately protected.
How SchoolDPO can help
SchoolDPO provides practical data protection and information governance support to schools, academies and trusts.
We can support schools with reviewing AI-related data protection arrangements, assessing proposed processing activities, advising on DPIAs, reviewing privacy notices and developing proportionate policies and procedures.
If your school is introducing AI tools or would like to review its existing information governance arrangements, please get in touch.
SchoolDPO – practical data protection support for schools.
Comments