Reference
The glossary
Thirty terms, one honest line each. Enough to follow any meeting where these words are used at you.
- AI (artificial intelligence)
- Generative AI
- Large language model (LLM)
- Prompt
- Hallucination
- Training data
- Agentic AI
- Deepfake
- Nudification app
- Automated decision-making (ADM)
- Controller and processor
- Lawful basis
- Special category data
- DPIA (data protection impact assessment)
- DPA (data processing agreement)
- DPO (data protection officer)
- UK GDPR and the Data (Use and Access) Act 2025
- ICO
- Children's Code
- KCSIE
- DSL (designated safeguarding lead)
- Filtering and monitoring
- JCQ and Ofqual
- NEA and the declaration of authentication
- AI detector
- Shadow AI
- Approved Tools Register
- Product safety standards (DfE)
- Ofsted and AI
- Clause library
Printable A4 sheet: Word document (16 KB) or PDF (81 KB). Free to adapt under CC BY-NC-SA 4.0.
- AI (artificial intelligence)
The umbrella marketing term. In schools it almost always means one of the entries below.
- Generative AI
Tools that produce new content (text, images, audio or code) on request. Chatbots are the familiar face, and the assistants now built into office, search and school software are the quiet one.
- Large language model (LLM)
The engine inside a chatbot, trained on vast amounts of text to predict plausible continuations. It predicts; it does not know.
- Prompt
Everything you type or attach. Prompts can contain personal data, which makes them a data protection matter as well as a writing one.
Source: Generative artificial intelligence (AI) in education, guidance text.
JCQ rules on AI in coursework: what centres actually have to do
- Hallucination
A fluent, confident output that is wrong, produced because the machine's job is plausibility, not truth. The DfE's word for the remedy is critical judgement.
Source: Generative artificial intelligence (AI) in education, guidance text.
- Training data
The material a model learned its patterns from. Whether a supplier trains on your data is a contract question; the DfE's standards forbid commercial use of pupils' and teachers' work without the copyright owner's consent.
Source: Generative AI: product safety standards, intellectual property; Generative artificial intelligence (AI) in education, intellectual property.
- Agentic AI
Tools that take actions rather than only producing content: browsing, connecting to software, completing multi-step tasks, sending messages. The shift from creates to does.
- Deepfake
Convincing fake audio, images or video of a real person. In a school it is a safeguarding matter, never a prank, and KCSIE's definition of nudes and semi-nudes now includes images wholly generated by AI.
Source: Keeping children safe in education 2026, explainer on nudes and semi-nudes, page 6; Relationships education, relationships and sex education (RSE) and health education (statutory guidance), secondary RSE, online safety and awareness.
- Nudification app
A tool that turns an ordinary photo into a fake nude image. Making or supplying one has been a criminal offence since 29 June 2026. KCSIE 2026 does not use the word; its rules on nudes and semi-nudes cover the images such tools make.
Source: Crime and Policing Act 2026, section 99; commencement by SI 2026/689, regulation 2; Keeping children safe in education 2026, whole document; Keeping children safe in education 2026, explainer on nudes and semi-nudes, page 6.
- Automated decision-making (ADM)
A decision with a legal or similarly significant effect on a person, taken with no meaningful human involvement. Since 5 February 2026 UK GDPR Articles 22A to 22D set the rules: people must be told, be able to object, get a human to look again and contest the outcome.
Source: UK GDPR, Articles 22A to 22D: automated decision-making, Articles 22A to 22D; commencement by SI 2026/82, regulation 2(j); The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82, regulation 2(j).
- Controller and processor
The controller decides why and how personal data is used; for pupil data that is the school or the trust. The processor handles it on the controller's instructions; most edtech suppliers, on paper at least. Accountability stays with the controller.
Source: Data protection in schools, Responsibilities.
- Lawful basis
The legal footing for using personal data. For a state school, academy trust or college doing its core work it is usually public task; legitimate interests is closed to public authorities for their public tasks, and consent is rarely the right answer.
Source: Lawful basis: public task, the page, updated 28 August 2026; UK GDPR, Article 6: Lawfulness of processing, Article 6(1), closing words; DPA 2018 section 7; FOIA 2000 Schedule 1 paragraphs 52, 52A and 53.
- Special category data
Personal data with extra legal protection: health, ethnicity, religion, sexual orientation, biometrics and a few more. SEND and medical information about pupils is the kind schools hold most.
- DPIA (data protection impact assessment)
A written assessment of the risks of a new use of personal data, done before it starts, required where the risk is likely to be high. AI plus pupils' data almost always meets that test.
Source: UK GDPR, Article 35: Data protection impact assessment, Article 35(1); Guidance on AI and data protection: accountability and governance implications, accountability and governance implications; Data protection impact assessments (DPIAs) guidance, When do we need to do a DPIA?; Examples of processing likely to result in high risk.
- DPA (data processing agreement)
The contract that binds a processor to the controller's instructions. It is where a supplier's promises about training, storage, deletion and breaches become enforceable.
- DPO (data protection officer)
The data protection officer, which every maintained school, academy and college must have. The DPO advises, monitors and challenges; the DPO does not draft, approve and sign everything, and must not decide on their own advice.
Source: UK GDPR, Article 37: Designation of the data protection officer, Article 37(1)(a); UK GDPR, Article 39: Tasks of the data protection officer, Article 39(1)(c); Article 38(6); Data protection in schools, Role of data protection officers (with uk-gdpr-article-37).
- UK GDPR and the Data (Use and Access) Act 2025
The UK GDPR and the Data Protection Act 2018 are the data protection law schools work under. The Data (Use and Access) Act 2025 amended them; its main changes, including the new automated decision-making rules, came into force on 5 February 2026.
Source: The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82, regulation 2(j); The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82, regulation 3(a); DPA 2018 section 164A.
- ICO
The UK's data protection regulator. On 30 September 2026 the Information Commission replaced the Information Commissioner and kept the name ICO. It also owes a statutory code of practice on AI and automated decision-making, with no deadline set.
Source: ICO governance changes confirmed for 30 September 2026, ICO news, 15 September 2026, updated 17 September; SI 2026/1015 made 10 September 2026; HCWS337, 14 September 2026; Regulations requiring the ICO to prepare a code of practice on AI and automated decision-making, SI 2026/425, the regulations.
- Children's Code
The ICO's Age Appropriate Design Code, for online services children are likely to use. It is why consumer AI tools carry age limits. It binds the providers; schools are not in scope, though the edtech they buy often is.
Source: The Children's code and education technologies (edtech), the page; Data protection in schools: Procuring educational technology (EdTech), the section.
- KCSIE
Keeping children safe in education, the DfE's statutory safeguarding guidance for schools and colleges in England. Revised every year; the 2026 edition applies from 1 September 2026, and schools must have regard to it.
Source: Keeping children safe in education 2026, About this guidance, page 5.
- DSL (designated safeguarding lead)
The designated safeguarding lead. AI-related harm, whether a fake image or a worrying conversation with a chatbot, goes to the DSL the same day, not to IT. The DSL also leads on online safety, including understanding the filtering and monitoring in place.
Source: Keeping children safe in education 2026, paragraph 127 and Annex B; Sharing nudes and semi-nudes: advice for education settings working with children and young people, initial response.
Does your school need a DPIA for AI tools? What KCSIE 2026 says about AI, deepfakes and filtering
- Filtering and monitoring
Filtering blocks harmful destinations; monitoring watches activity and raises alerts. KCSIE asks for an annual review of their effectiveness, and the DfE's separate filtering and monitoring standard asks every school to consider whether its solution can handle AI-generated content.
Source: Filtering and monitoring standards for schools and colleges (Meeting digital and technology standards in schools and colleges), the core standard, definitions; Keeping children safe in education 2026, paragraph 173; Filtering and monitoring standards for schools and colleges (Meeting digital and technology standards in schools and colleges), the core standard.
- JCQ and Ofqual
The Joint Council for Qualifications publishes the regulations approved exam centres follow, including the rules on AI in assessed work. Ofqual regulates qualifications and assessments in England, and its guidance sets what awarding bodies may do with AI.
Source: AI Use in Assessments: Your role in protecting the integrity of qualifications, title page; the JCQ AI page; Ofqual's approach to regulating the use of artificial intelligence in the qualifications sector, the page.
JCQ rules on AI in coursework: what centres actually have to do
- NEA and the declaration of authentication
Non-examined assessment is coursework, where most AI assessment risk lives. The declaration of authentication is the candidate's signed statement that the work is their own and any AI use is acknowledged; whether it has been signed decides whether a concern stays in the centre or goes to the awarding body.
Source: Instructions for conducting non-examination assessments (GCE and GCSE) 2026/27, Appendix 4; Suspected Malpractice: Policies and Procedures, 4.5; the M1 form at Appendix 8.
JCQ rules on AI in coursework: what centres actually have to do
- AI detector
Software that claims to spot AI-written text. JCQ does not require it, endorses none, and says a detector's output is one part of a holistic judgement; Ofqual says it is evidence, never the sole determinant. A score is never proof on its own.
Source: AI Use in Assessments: Your role in protecting the integrity of qualifications, section 8, page 13; Artificial intelligence malpractice and assessment: advice note, the note.
JCQ rules on AI in coursework: what centres actually have to do
- Shadow AI
Staff using unapproved tools quietly, usually because the approved ones are worse or nobody has said what is allowed. The reason for rule one, and a policy problem before it is a people problem.
- Approved Tools Register
The live list of every AI tool the school allows, who may use it, for what, with which data, and when it is next reviewed. Appendix A to the AI policy, and the answer to the question inspectors, parents and auditors ask first.
- Product safety standards (DfE)
The DfE's "Generative AI: product safety standards", written for suppliers and useful to schools when judging a product. Renamed from expectations and extended in January 2026 to cover cognitive development, emotional dependence, mental health and manipulation.
Source: Generative AI: product safety standards, publication page, change history; Generative AI: product safety standards, introduction.
- Ofsted and AI
Ofsted's inspection information says inspectors do not directly evaluate AI tools and there is no expectation that a school uses AI. What they look at is the quality of decision-making about AI, which is what a policy and a register show.
Source: Inspection information for state-funded schools, for use from September 2026, the page, AI section.
- Clause library
The fixed, human-written clauses the policy builder assembles into a school's AI policy. No AI writes any of it; the same answers always give the same policy, and every output carries the library's version number.