Education
Education on infrastructure you own
Pupil data stays on infrastructure you control. AI tools used in school meet safeguarding requirements by design. Your Ofsted evidence does not depend on a vendor’s documentation.
UK education providers are navigating a genuine tension: AI tools are increasingly present in schools, but the safeguarding and data protection frameworks that govern pupil data are not optional. The DfE and NCSC have both published guidance. KCSIE 2025 now includes specific AI safeguarding provisions. Schools that have deployed AI tools without assessing them against these frameworks are carrying risk they may not have mapped.
The regulatory weight
The frameworks that bear on AI and data infrastructure in UK education:
Keeping Children Safe in Education (KCSIE) 2025
Paragraph 143 (updated for 2025) addresses AI safeguarding specifically. Schools must consider AI tools in the context of online safety and safeguarding risk. Governors and trustees have oversight responsibility. The guidance is not advisory.
DfE Generative AI in Education guidance
Published 2023, updated 2024. Covers responsible use, data protection obligations, and expectations for schools using AI tools in teaching, assessment, and administration. Schools are expected to have assessed any AI tools they deploy.
UK GDPR and UK DPA 2018 — children's provisions
Children's personal data carries additional protections. The ICO's Age Appropriate Design Code (Children's Code) applies to online services likely to be accessed by children. Schools processing pupil data with AI tools need to have documented lawful basis and completed Data Protection Impact Assessments (DPIAs).
Online Safety Act 2023
Relevant to AI tools used in communication or content generation contexts within schools. Schools need to understand what safeguarding obligations the tools they deploy carry.
We build DPIA documentation and KCSIE AI-safety assessment into every deployment from the start, rather than retrofitting them once the build is done.
Why sovereignty matters specifically here
Pupil data is some of the most sensitive personal data a UK organisation processes. Children cannot meaningfully consent to data processing. Parents and governors reasonably expect that pupil data is held and processed on infrastructure the school controls — not on external systems governed by terms the school cannot fully audit.
Three practical issues arise with off-premises AI deployments in education. A school using a cloud-hosted AI tool for teaching or assessment cannot always confirm that pupil data is not used for model training; vendor terms in this area vary and change. A DfE or Ofsted inquiry into AI use in school will ask what tools are deployed and what assessments were completed; the answer needs to be documented and accurate. A Multi-Academy Trust deploying AI across multiple schools needs consistent data governance across the trust — informal tool adoption by individual schools creates a governance gap that central administration has to close retrospectively.
Three typical engagements
School platform deployment
Self-hosted collaboration, communication, and administrative infrastructure for a school or MAT. Pupil data held on UK infrastructure the school controls. DPIA documentation included.
AI safeguarding advisory
Assessment of current or planned AI tool deployments against KCSIE 2025 paragraph 143, DfE AI guidance, and UK DPA children's provisions. Documented findings, risk register, and remediation recommendations. Fixed scope, fixed price.
Compliance documentation for Ofsted
Preparation of information governance and AI safeguarding documentation suitable for Ofsted inspection evidence. Covers data protection policies, AI tool assessments, and governor oversight records.
Proof
Case studies in this sector are in preparation. Work in this area is ongoing; we will publish when client permission is confirmed.
Start here
Fixed scope. Fixed price. No day rates. We will map your current AI and data infrastructure against KCSIE, DfE guidance, and UK DPA children’s provisions on a 30-minute call and tell you exactly what the work involves.
Book a scoping call