Keeping children safe in education 2026 has been in force since 1 September. It does not require an AI policy, an AI lead, an AI training record or a ban on any tool. The words "chatbot" and "nudification" do not appear in it anywhere.
That is not what most summaries of it say, so it is worth being plain about what the text does.
It adds AI to two of its four online risks. Contact risk is now "being subjected to harmful online interaction with other users or generative AI applications that simulate this". Conduct risk includes "making, sending and receiving explicit images, including those generated using AI". The other two risks, content and commerce, are unchanged.
It adds an explainer near the front which says that nudes and semi-nudes include images "digitally altered or wholly generated using artificial intelligence". So wherever the document says nudes, Part one included, it means AI-made ones as well.
And it spells out, more fully than before, who reviews filtering and monitoring and how often: at least once every academic year, by the senior leader responsible, with the DSL and IT support, with a record kept of the checks.
The misreading goes like this: AI is new, KCSIE now mentions it, therefore the school needs new machinery. A policy, a lead, a tool. The DfE's own consultation response says the filtering wording introduces no new requirement, because the same expectation was already in its standards. The guidance folds AI into routes the school already runs. The job is to make sure those routes know AI is theirs.
Three places where that matters.
First, images. An AI-made nude of a pupil is a nudes incident, and the route is the one in the UKCIS advice: it goes to the DSL immediately, and never later than the same day. Staff do not view, copy, forward or save it, and they do not ask the pupil to delete it. In a staff briefing the instinct to screenshot "for evidence" is the thing to name and stop. The guide sets out the harms and the route here: https://schoolaigovernance.co.uk/guides/kcsie-2026-ai-deepfakes-filtering#the-harms-named
Second, conversations. The contact change puts a harmful exchange with an AI app in the same place as a harmful exchange with a person. That makes it a concern about a child, not a blocking problem for IT. Pupils already use AI this way: in Public First's survey of 4,021 people aged 11 to 24 in England, carried out in August 2026, 32.6 per cent of secondary pupils said they had used AI to talk through problems or how they were feeling. A worrying chatbot conversation goes where any contact concern goes, to the DSL, and is recorded like any other: https://schoolaigovernance.co.uk/guides/kcsie-2026-ai-deepfakes-filtering#when-the-harmful-contact-is-a-chatbot
Third, the filter. Filtering blocks destinations. Generative AI makes new content on request, for one user, so it sits on no list of known bad pages, and it now lives inside search results and the office platform. Whether a product can see and judge that content varies, and nobody can tell from the school's side of the screen. The DfE's filtering standard asks the annual review to establish how and where generative AI is used and what the product's technical limits are. So the review needs one question put to the provider in writing: how does your product handle AI tools and AI-generated content, including the AI features built into search and our office platform? The answer goes in the review record, whatever it is: https://schoolaigovernance.co.uk/guides/kcsie-2026-ai-deepfakes-filtering#the-filtering-gap
None of this needs a new post or a new policy. It needs the DSL, the senior leader who holds filtering, whoever manages the IT contract and the governor who asks for the review record to know which part is theirs.
The guide, with every paragraph number and the date each source was read, is free: https://schoolaigovernance.co.uk/guides/kcsie-2026-ai-deepfakes-filtering
Parents get the same ground in one page. The letter for parents says what the school allows, what it teaches and who to tell, and it is free to download and adapt: https://schoolaigovernance.co.uk/templates/letter-for-parents
Wes Akram is an exams officer, data manager and DPO at a secondary school, and the author of The School AI Governance Handbook: for the slightly overwhelmed. Everything on schoolaigovernance.co.uk is free.
The facts behind this article
Every claim above is numbered to one of these records. Each gives the source’s own words where it can, the paragraph or section, and the date it was last read.
- 01
KCSIE 2026 is statutory guidance, in force from 1 September 2026. Schools and colleges in England must have regard to it; it does not have the force of law in itself.
“must have regard to it”
Keeping children safe in education 2026, About this guidance, page 5. Dated 7 July 2026. Read 8 November 2026.
- 02
KCSIE 2026 does not require an AI policy, an AI strategy, a named AI lead, an AI training record, a stance on pupil use, or a ban on AI tools.
Keeping children safe in education 2026, whole document. Dated 7 July 2026. Read 8 November 2026.
- 03
KCSIE 2026 never mentions nudification apps and sets no duty to assess apps. Any page saying it "names nudification apps as a risk schools must assess" is wrong.
Keeping children safe in education 2026, whole document. Dated 7 July 2026. Read 8 November 2026.
- 04
Paragraph 165 sorts online risk into four areas: content, contact, conduct and commerce. AI appears in two of them, contact and conduct, not in all four.
Keeping children safe in education 2026, paragraph 165. Dated 7 July 2026. Read 8 November 2026.
- 05
Contact risk now includes harmful online interaction with generative AI applications that simulate other users. KCSIE does not use the words "chatbot" or "companion".
“being subjected to harmful online interaction with other users or generative AI applications that simulate this”
Keeping children safe in education 2026, paragraph 165. Dated 7 July 2026. Read 8 November 2026.
- 06
Conduct risk includes making, sending and receiving explicit images, including those generated using AI.
“making, sending and receiving explicit images, including those generated using AI”
Keeping children safe in education 2026, paragraph 165. Dated 7 July 2026. Read 8 November 2026.
- 07
A new explainer near the front defines nudes and semi-nudes for the whole document, and says the images may be digitally altered or wholly generated using AI, including deepfakes and deep nudes. Wherever KCSIE says nudes, it includes AI-made ones.
“digitally altered or wholly generated using artificial intelligence, including what are sometimes described as 'deepfakes' or 'deep nudes'”
Keeping children safe in education 2026, explainer on nudes and semi-nudes, page 6. Dated 7 July 2026. Read 8 November 2026.
- 08
An incident involving nudes or semi-nudes goes to the DSL as soon as possible. Staff must not intentionally view the image unless there is good and clear reason, and do not copy, print, share, store or save it, or ask a pupil to send or delete it.
“must not intentionally view any nudes and semi-nudes unless there is good and clear reason to do so”
Sharing nudes and semi-nudes: advice for education settings working with children and young people, initial response. Dated 11 March 2024. Read 28 September 2026.
- 09
Public First's poll for the report was an online survey of 4,021 people aged 11 to 24 in England, carried out from 18 to 27 August 2026, weighted by age, gender and region. "Secondary" means Years 7 to 11; "college" means college and school sixth form. Unweighted bases: 1,326 secondary pupils and 930 college and sixth form students unless a table says otherwise.
AI in Education: polling tables (Public First for Seldon and Bunting), methodology sheet. Dated 22 September 2026. Read 27 September 2026.
- 10
32.6 per cent of secondary pupils and 44.9 per cent of college and sixth form students have used AI to talk through problems or how they are feeling.
AI in Education: polling tables (Public First for Seldon and Bunting), Table 24 (secondary 32.57 per cent weighted, base 1,326). Dated 22 September 2026. Read 28 September 2026.
- 11
Governing bodies and proprietors should ensure that a review of the effectiveness of filtering and monitoring is carried out at least once every academic year, by the SLT member responsible for filtering and monitoring with the support of the DSL and IT support, covering all internet-connected devices in all relevant locations, with a record kept of the checks. This is "should", and the consultation response says it adds no new requirement.
“ensure that a review of their effectiveness is carried out at least once every academic year”
Keeping children safe in education 2026, paragraph 173. Dated 7 July 2026. Read 8 November 2026.
- 12
The DfE's consultation response says the fuller filtering and monitoring wording does not introduce new requirements, because the same expectations were already in its filtering and monitoring standards, and that those responsible for governance are not expected to undertake the checks personally.
“not introduce new requirements”
Keeping children safe in education 2026: government consultation response, pages 35 and 36 (pages 17 and 18 on the nudes wording). Dated July 2026. Read 28 September 2026.
- 13
The annual review should establish how and where any generative AI web and in-application products are used, and any technical limitations, such as whether the solution can monitor and filter real-time, dynamic, personalised or AI-generated content.
“how and where any generative AI web and in-application products are used”
Filtering and monitoring standards for schools and colleges (Meeting digital and technology standards in schools and colleges), the core standard, review checklist. Dated 16 September 2026. Read 28 September 2026.