Ethics of AI

Levels

Not yet

There is no AI policy.

Acquire

An AI policy exists, but few staff have read it.

Deepen

Staff know the policy, follow it and it is reviewed every year.

Create

Staff and pupils help review the policy and other schools adapt it.

Evidence that counts

• The current AI policy with a review date
• A record of staff reading or being briefed on the policy
• Minutes showing the policy was reviewed and approved

Legal requirements

• DfE guidance on generative AI in education (opens in a new tab)Schools can use generative AI to support teaching and reduce workload, but staff stay responsible for checking outputs for accuracy and appropriateness. Personal data should not be entered unless necessary and lawful, students' work must not be used to train AI tools without consent, and tools should meet the DfE's generative AI product safety standards.

Fixes

• FreeDownload the free AI Policy Starter Kit
• FreeRead the DfE guidance on generative AI in education (opens in a new tab)
• FreeBrowse the free Kompass blog on AI in schools
• FreeJoin a free Kompass livestream
• Kompass helpGet help from Kompass with a staff policy briefing

Levels

Not yet

The acceptable-use policy does not mention AI.

Acquire

The acceptable-use policy mentions AI for staff, but not for pupils.

Deepen

Staff and pupils sign an acceptable-use policy that covers AI, written in language they understand.

Create

Pupils help write the AI parts of the acceptable-use policy and it is shared with other schools.

Evidence that counts

• The staff acceptable-use policy with its AI section
• The pupil acceptable-use agreement with its AI section
• Signed agreements or a record of acceptance

Legal requirements

• DfE guidance on generative AI in education (opens in a new tab)Schools can use generative AI to support teaching and reduce workload, but staff stay responsible for checking outputs for accuracy and appropriateness. Personal data should not be entered unless necessary and lawful, students' work must not be used to train AI tools without consent, and tools should meet the DfE's generative AI product safety standards.

Fixes

• FreeUse the acceptable-use wording in the free AI Policy Starter Kit
• FreeRead the DfE guidance on generative AI in education (opens in a new tab)
• FreeUse the AILit framework to write pupil-friendly rules (opens in a new tab)

Levels

Not yet

The school has not carried out a data protection impact assessment (DPIA) for any AI tool.

Acquire

DPIAs have been done for some AI tools that handle pupil data, often after the tool was already in use.

Deepen

Every AI tool that handles pupil data has a DPIA before it is used, and the DPIA is reviewed when the tool or its use changes.

Create

DPIAs are reviewed each year with the data protection officer and governors, staff help identify risks, and the school shares its approach with other schools.

Evidence that counts

• Completed DPIAs for each AI tool that handles pupil data, dated before first use
• The data protection officer's sign-off on each DPIA
• Records of DPIA reviews after a tool or its use changed

Legal requirements

• UK GDPR and the Data Protection Act 2018 (opens in a new tab)The school is the controller for any student or staff personal data put into AI tools. It needs a lawful basis, a written processing agreement with each AI vendor, a data protection impact assessment for higher-risk uses, and staff should not enter personal data into tools the school has not approved. The Data (Use and Access) Act 2025 adds safeguards for significant automated decisions about people (from February 2026) and a duty to have a process for handling data protection complaints (from June 2026).
• General Data Protection Regulation (opens in a new tab)The school is the controller for any student or staff personal data put into AI tools. It needs a lawful basis, a processing agreement with each AI vendor (Article 28), a data protection impact assessment for higher-risk uses, and staff should not enter personal data into tools the school has not approved.

Fixes

• FreeRead the ICO guidance on data protection impact assessments (opens in a new tab)
• FreeUse the data protection section of the free AI Policy Starter Kit
• FreeCheck tools against the DfE generative AI product safety expectations (opens in a new tab)
• Kompass helpGet help from Kompass to review your DPIAs for AI tools

Levels

Not yet

Safeguarding policy and filtering do not consider AI tools.

Acquire

The safeguarding lead knows about AI risks, but filtering and monitoring have not been checked for AI.

Deepen

Filtering and monitoring are tested on AI tools and the safeguarding policy covers AI risks.

Create

The school tests new AI risks as they appear and shares findings with local safeguarding partners.

Evidence that counts

• The safeguarding policy with its AI section
• Records of filtering and monitoring checks on AI tools
• Safeguarding training materials that cover AI

Legal requirements

• Keeping children safe in education (opens in a new tab)The 2026 statutory safeguarding guidance names risks from AI chatbots and companion apps and from AI-generated images and deepfakes. Schools must have filtering and monitoring that meets the DfE standards, covers generative AI, and is reviewed at least once a year by a named senior leader with the designated safeguarding lead.

Fixes

• FreeRead Keeping children safe in education (opens in a new tab)
• FreeRead the DfE filtering and monitoring standards (opens in a new tab)
• FreeTest AI tools against the DfE generative AI product safety expectations (opens in a new tab)
• Kompass helpGet help from Kompass with safeguarding and AI training

Levels

Not yet

Assessment rules do not mention AI.

Acquire

Exam staff know the awarding body rules on AI, but teachers and pupils have not been told.

Deepen

Teachers and pupils know what AI use is allowed in each assessment and how to acknowledge it.

Create

The school designs assessments that make AI misuse unlikely and shares its approach with other schools.

Evidence that counts

• An assessment or malpractice policy with its AI section
• Pupil guidance on acknowledging AI use
• Records of staff briefings on awarding body AI rules

Legal requirements

• JCQ: AI use in assessments (opens in a new tab)Teachers may accept only work that is the student's own. Any AI use must be acknowledged, with the tool and date, and students keep a record of prompts and outputs. Staff must not sign the authentication declaration if in doubt, must report suspected misuse, and must not use AI as the sole means of marking.
• IB academic integrity policy (AI appendix) (opens in a new tab)AI tools are not banned, but AI-generated content is not the student's own work. Any use must be quoted, cited in the text and listed in the bibliography with the tool, prompt and date, and presenting unacknowledged AI output as your own is academic misconduct.
• Cambridge guidance on AI in coursework (opens in a new tab)Students may use generative AI in coursework only as Cambridge allows, such as initial research or brief quotes they discuss, and must acknowledge it with the tool, prompts and date. Unacknowledged use is plagiarism, and teachers must authenticate work as the student's own and report suspected malpractice.

Fixes

• FreeRead the JCQ guidance on AI use in assessments (opens in a new tab)
• FreeUse the academic integrity section of the free AI Policy Starter Kit
• FreeBrowse the free Kompass blog on AI in schools
• Kompass helpGet help from Kompass with training on AI and assessment

Levels

Not yet

Governors have not discussed AI.

Acquire

Governors have had one update on AI, but AI is not on the risk register.

Deepen

AI is on the risk register and governors review it at least once a year.

Create

A named governor challenges AI plans and governors share their approach with other boards.

Evidence that counts

• The risk register entry for AI
• Governor minutes discussing AI risk
• A named link governor for AI or digital

Fixes

• FreeRead the DfE guidance on generative AI in education (opens in a new tab)
• FreeListen to the free Kompass podcast on AI in schools
• FreeUse the free AI Policy Starter Kit for the governors' annual review
• Kompass helpGet help from Kompass with an AI briefing for governors

Levels

Not yet

Staff trust AI output and do not know where to report problems.

Acquire

Some staff check output for errors, but bias and unsafe content are rarely considered.

Deepen

Staff routinely check for errors, bias and unsafe content and report problems through a known route.

Create

Staff teach pupils and colleagues to spot problems and share examples to improve tools and guidance.

Evidence that counts

• Training materials on checking AI output
• A reporting route for problems with AI tools
• Logged reports of problems and what was done

Fixes

• FreeBrowse the free Kompass courses (opens in a new tab)
• FreeUse the free prompt library to practise checking AI output (opens in a new tab)
• FreeExplore the UNESCO AI competency framework for teachers (opens in a new tab)
• Kompass helpGet help from Kompass with training on checking AI output

Levels

Not yet

Staff do not know which tools are safe for personal data.

Acquire

Staff have been told not to enter personal data, but some still do.

Deepen

Staff follow the rule as routine and checks show personal data stays in approved tools.

Create

Staff help design safe ways of working and the school shares them with other schools.

Evidence that counts

• Staff guidance on personal data and AI
• Records of data protection training covering AI
• Spot checks or audit results

Legal requirements

• UK GDPR and the Data Protection Act 2018 (opens in a new tab)The school is the controller for any student or staff personal data put into AI tools. It needs a lawful basis, a written processing agreement with each AI vendor, a data protection impact assessment for higher-risk uses, and staff should not enter personal data into tools the school has not approved. The Data (Use and Access) Act 2025 adds safeguards for significant automated decisions about people (from February 2026) and a duty to have a process for handling data protection complaints (from June 2026).
• General Data Protection Regulation (opens in a new tab)The school is the controller for any student or staff personal data put into AI tools. It needs a lawful basis, a processing agreement with each AI vendor (Article 28), a data protection impact assessment for higher-risk uses, and staff should not enter personal data into tools the school has not approved.

Fixes

• FreeUse the data protection section of the free AI Policy Starter Kit
• FreeRead the ICO guidance on data protection impact assessments (opens in a new tab)
• FreeBrowse the free Kompass blog on AI in schools
• Kompass helpGet help from Kompass with data protection and AI training