Pupil use of AI

Home › Pupil use of AI

Pupils aren’t covered by the staff policy. Bringing them into scope is a deliberate, carefully guarded decision. It shouldn’t happen by default, and it shouldn’t be allowed to creep in.

What it is

An optional module that extends the policy to pupil use of AI, but only once both conditions are in place: first, a DPIA completed for the specific tools and processing; and second, an age-appropriate AI education plan covering AI literacy, misinformation, deepfakes and responsible use. If pupil use isn’t permitted, you should delete the module, and pupils stay out of scope.

Why it’s important

Two things are easy to confuse, and mustn’t be. A tool’s terms may require parent or guardian agreement for younger users; a named person obtains and records that. Separately, your UK GDPR lawful basis for processing pupils’ data comes from the DPIA, and will rarely be consent. Where a pupil-facing tool processes children’s data, the ICO Children’s Code applies: the child’s best interests come first, settings default to high privacy, and profiling is off by default. Using a tool below its stated minimum age, or without the agreement it requires, is likely to breach both the tool’s terms and data protection law.

Pupils are taught what AI can and can’t do: how to recognise deepfakes, misinformation and impersonation, and how to avoid over-reliance, including on tools that simulate conversation or companionship. Declining pupil use, where meeting these conditions isn’t practical, is a perfectly reasonable and defensible choice.