What’s changed

The model policy, the Approved Tools Register, the DPIA template, the vendor question bank, the four rules poster, the candidate briefing, the letter for parents, the governor one-pager and the glossary. All in Word and PDF, all under CC BY-NC-SA 4.0, all built from clause library v1.0. Version history starts here.

Ten questions, a check of your answers, then a draft policy in Word, assembled from clause library v1.0. No AI writes any of it. Your answers stay in your browser and travel in the link, so there is no account to make, and a policy built from a saved link can be rebuilt from the newest library.

A ready-to-run staff session on AI and the rules, with facilitator notes, three role inserts and an attendance log, downloads with no sign-up. A thirty-minute online course covers the same ground for anyone who misses the session, with a certificate at the end. Both free.

On 30 September 2026 the Information Commission replaced the Information Commissioner as the UK's data protection regulator. It has said it will continue to be known as the ICO, so that is what this site and the book call it.

Nothing in a school's own documents needs to change. Privacy notices that say "the ICO" are still right. Two things to watch: the regulator owes a statutory code of practice on AI and automated decision-making, including children's data, with no deadline yet, and its guidance on DPIAs is under review following the Data (Use and Access) Act.

The 2026 edition applies from 1 September. It adds AI to two of its four online risks, so that harmful interaction with a generative AI app that simulates another user counts as contact risk and explicit images generated using AI count as conduct risk. Its definition of nudes and semi-nudes now includes images wholly generated by AI. And it points schools that choose to use generative AI to the DfE's guidance and free staff modules.

It does not name nudification apps or chatbots, and it does not require an AI policy. The expectation that filtering and monitoring can handle AI-generated content comes from the DfE's separate filtering and monitoring standard, updated on 16 September 2026, which asks every school to consider whether its solution can.

For a school's own documents: the child protection policy should say that nudes include AI-generated ones, and this year's filtering and monitoring review should record what the filter can and cannot see.