Keeping children safe in education 2026 (KCSIE) folds AI into safeguarding that already exists. It adds AI to two of its four online risks, counts AI-generated nudes as nudes, points schools that use generative AI to the DfE's guidance, and spells out who reviews filtering and monitoring, and how often.
It is statutory guidance, in force since 1 September 2026, and schools and colleges in England must have regard to it. It does not require an AI policy, an AI lead or a ban on AI tools. The words "chatbot" and "nudification" do not appear in it at all.123
This guide sets out what the text says, what is new this year and what isn't, and who has to do what. Most of it lands on people and routes a school already has. The practical centre is one question for the filtering provider, asked in writing.
The harms, named #
Paragraph 165 sorts online risk into four areas: content, contact, conduct and commerce. Two of them now name AI.4
Contact risk is "being subjected to harmful online interaction with other users or generative AI applications that simulate this". Conduct risk includes "making, sending and receiving explicit images, including those generated using AI".56
A new explainer near the front defines nudes and semi-nudes for the whole document. Images may be "digitally altered or wholly generated using artificial intelligence, including what are sometimes described as 'deepfakes' or 'deep nudes'". So wherever KCSIE says nudes, Part one included, it means AI-made ones too.7
The child protection policy should cover "consensual and non-consensual making or sharing of nudes and semi-nudes, including those generated using AI" (paragraph 193). Part five adds that every incident involving shared nudes needs "a safeguarding response", proportionate to the age, development and circumstances of the children involved (paragraph 530).89
For images of under-18s, "it isn't a real photo" was no way out even before this edition. The UKCIS advice, last updated in March 2024, counts computer-generated images, including those made with "deepfake apps" and "AI text-to-image generators", as indecent images.1011
What the 2026 edition does not do is name nudification apps, the tools that turn an ordinary photo into a fake nude. The criminal law has moved on them anyway: making or supplying a tool for generating fake intimate images has been an offence since 29 June 2026.12
The route for an AI-generated image of a pupil is the UKCIS one. It goes to the DSL immediately, and never later than the same day. Staff do not view, copy, print, share, store or save it, or ask a pupil to send or delete it, and they leave the questions to the DSL.13
What this means for us
No new machinery is needed, only certainty that the old route applies. An AI-made image of a pupil is a nudes incident: it goes to the DSL, not to IT, and nobody forwards it "for evidence".
When the harmful contact is a chatbot #
The contact change is the one most likely to be missed. It puts a harmful conversation with an AI app in the same place as a harmful conversation with a person, which makes it a concern about a child, not a content-blocking problem.
Pupils already use AI this way. In Public First's online survey of 4,021 people aged 11 to 24 in England, carried out from 18 to 27 August 2026, 32.6 per cent of secondary pupils said they had used AI to talk through problems or how they were feeling.1415
RSHE now teaches the same risk. Under the guidance in force since 1 September 2026, secondary pupils are taught that AI chatbots "can pose risks by creating fake intimacy or offering harmful advice", so the DSL and whoever leads RSHE are working on one problem from two ends.1617
Products sold to schools are expected to keep their distance. The DfE's product safety standards say learner-facing tools should avoid "attempting to cultivate personal relationships with users", and should alert the DSL to patterns that suggest "emotional dependence".18
A companion app on a pupil's own phone, at home or on mobile data, answers to none of that and sits outside the school filter. So a worrying pupil conversation with a chatbot goes where any contact concern goes: to the DSL, recorded like any other.
What is new this year, and what isn't #
Annex C, the DfE's own summary of changes, lists "Updated definitions of online risk categories", the new explainer on nudes and semi-nudes, and "Added guidance and resources on safe and effective use of Generative AI in education". That last item is two short paragraphs (167 and 168) pointing schools that "choose to use Generative AI" to the DfE's guidance and its online staff modules.1920
There is no separate AI section. Annex A also gains a link to CEOP and Internet Watch Foundation guidance on AI-generated child sexual abuse material.21
The filtering wording is fuller: governing bodies and proprietors should "ensure that a review of their effectiveness is carried out at least once every academic year". The review falls to "the SLT member responsible for filtering and monitoring, with the support of the school's designated safeguarding lead and IT support". The checks should cover "all internet-connected devices in all relevant locations", and "a record should be kept of these checks" (paragraph 173).2223
The DfE's consultation response says plainly that this adds no new requirement, because the same expectations were already in its filtering and monitoring standards. It also says those responsible for governance "are not expected to undertake these checks personally".24
Carried over, with no change listed in Annex C: the DSL's lead responsibility for online safety, including "understanding the filtering and monitoring systems and processes in place", written into the job description (paragraph 127). The same goes for training all staff in online safety, including their part in filtering and monitoring, at induction and at least once a year after that (paragraphs 12, 153 and 154).2526
One change reaches everyone. The condensed version of Part one has been withdrawn, so governing bodies and proprietors should now ensure that staff who do not work directly with children read Part one as well. The DfE's new one-page overview for all staff is "intended to complement, not replace" it.27
A last oddity: paragraph 177 still calls the DfE's product rules "Generative AI: product safety expectations". They have been standards since January 2026, and that is the name to search for.2829
The filtering gap #
Filtering and monitoring do different jobs. In the DfE standard's words, filtering "is preventative" and monitoring "is reactive": one stops a user reaching something, the other watches what users do and raises alerts.30
Generative AI tests both. Once a tool is allowed through, what it writes or draws is made on the spot for one user, so it sits on no list of known bad pages. And AI now lives inside things a school is unlikely to block, such as search results and the office platform.
Whether a product can see and judge that generated content varies, and so does its reach into apps as opposed to browsers. The DfE standard asks the annual review to establish "how and where any generative AI web and in-application products are used", and any "technical limitations, such as whether your solution can monitor and filter real-time, dynamic, personalised or AI-generated content".31
It adds that every school "should consider whether a filtering and monitoring solution that can handle real-time, dynamic, personalised and AI-generated content is required". The standard is guidance rather than law, but KCSIE points to it, and paragraph 177 asks governing bodies and proprietors to "discuss with IT staff and service providers what more needs to be done".3233
Nobody can answer that from the school's side of the screen. It needs the provider's answer, in writing, filed with the review.
The question to ask, in writing
How does your product handle AI tools and AI-generated content, including the AI features built into search engines and our office platform?
The answer goes in the review record. If generated content is invisible to the product, record that as a finding: it moves the weight onto supervision, the choice of tools pupils can reach, and teaching.
A situation #
A pupil shows a member of staff a fake nude image of a teacher that is going round a year-group chat. The member of staff does not look further, screenshot or forward it, and tells the DSL straight away: pupils making and sharing explicit images is conduct risk in KCSIE's own terms, and the same chat may hold images of pupils, which the DSL handles under the UKCIS advice. The headteacher, or whoever looks after staff welfare, supports the teacher, who may be the victim of a crime, since creating a fake intimate image of an adult without their consent has been an offence since 6 February 2026. The DSL and headteacher decide together about devices, parents, the platform and the police, with the UK Safer Internet Centre's helpline for professionals on hand for advice; "it isn't a real photo" changes nothing about any of it.34
Five asks, one owner each #
- The SLT member responsible for filtering and monitoring runs this year's review with the DSL and IT support, sends the provider the question above in writing, and files the answer with the record of checks.
- The DSL checks that the child protection policy covers AI-generated nudes and the UKCIS route, and that staff training covers fake images and chatbot contact as well as filtering and monitoring.
- Governors or proprietors name the governor responsible for filtering and monitoring, and ask to see the review record and the provider's answer, without doing the checks themselves.
- Whoever manages IT or the filtering contract finds out which AI tools, apps and built-in AI features the product can see, including on school devices taken home, and logs each check.
- All staff read Part one in full and know the route: an AI-made image of a pupil, or a worrying pupil conversation with a chatbot, goes to the DSL the same day, and nobody forwards or saves it.
What changed in this guide #
[launch date]: First published, written against KCSIE 2026, the DfE filtering and monitoring standard, the generative AI product safety standards, the UKCIS advice on sharing nudes and the RSHE guidance, as in force on 28 September 2026.
Sources #
- Keeping children safe in education 2026, DfE, statutory guidance in force from 1 September 2026 (paragraphs 12, 127, 153 to 154, 165 to 168, 173 to 177, 193, 530 and 554, the explainer on nudes and semi-nudes, and Annexes A and C)
- Keeping children safe in education 2026: part one, overview for all staff, DfE, 7 July 2026, in force from 1 September 2026
- Keeping children safe in education 2026: government consultation response, DfE, July 2026 (pages 17 to 21, 34 to 36 and 48)
- Filtering and monitoring: core standard, in Meeting digital and technology standards in schools and colleges, DfE, updated 16 September 2026
- Generative AI: product safety standards, DfE, updated 19 January 2026
- Generative artificial intelligence (AI) in education, DfE, updated 12 August 2025
- Sharing nudes and semi-nudes: advice for education settings working with children and young people, UKCIS, updated March 2024
- Relationships education, relationships and sex education (RSE) and health education, DfE statutory guidance, July 2025, in force from 1 September 2026 (secondary RSE, "Online safety and awareness", points 5, 7 and 15)
- Data (Use and Access) Act 2025, section 138, legislation.gov.uk, in force 6 February 2026
- Crime and Policing Act 2026, section 99, legislation.gov.uk, in force 29 June 2026
- Public First, AI in Education polling tables, Table 24, online survey of 4,021 people aged 11 to 24 in England, 18 to 27 August 2026, for Seldon and Bunting, Britain's Greatest Education Opportunity Ever, September 2026
Sources opened on 28 September 2026.
Free template
AI and your child: letter for parents
What you allow, what you teach, who to tell.
The facts behind this guide
Every claim above is numbered to one of these records. Each gives the source’s own words where it can, the paragraph or section, and the date it was last read.
- 01
KCSIE 2026 is statutory guidance, in force from 1 September 2026. Schools and colleges in England must have regard to it; it does not have the force of law in itself.
“must have regard to it”
Keeping children safe in education 2026, About this guidance, page 5. Dated 7 July 2026. Read 28 September 2026.
- 02
KCSIE 2026 does not require an AI policy, an AI strategy, a named AI lead, an AI training record, a stance on pupil use, or a ban on AI tools.
Keeping children safe in education 2026, whole document. Dated 7 July 2026. Read 28 September 2026.
- 03
KCSIE 2026 never mentions nudification apps and sets no duty to assess apps. Any page saying it "names nudification apps as a risk schools must assess" is wrong.
Keeping children safe in education 2026, whole document. Dated 7 July 2026. Read 28 September 2026.
- 04
Paragraph 165 sorts online risk into four areas: content, contact, conduct and commerce. AI appears in two of them, contact and conduct, not in all four.
Keeping children safe in education 2026, paragraph 165. Dated 7 July 2026. Read 28 September 2026.
- 05
Contact risk now includes harmful online interaction with generative AI applications that simulate other users. KCSIE does not use the words "chatbot" or "companion".
“being subjected to harmful online interaction with other users or generative AI applications that simulate this”
Keeping children safe in education 2026, paragraph 165. Dated 7 July 2026. Read 28 September 2026.
- 06
Conduct risk includes making, sending and receiving explicit images, including those generated using AI.
“making, sending and receiving explicit images, including those generated using AI”
Keeping children safe in education 2026, paragraph 165. Dated 7 July 2026. Read 28 September 2026.
- 07
A new explainer near the front defines nudes and semi-nudes for the whole document, and says the images may be digitally altered or wholly generated using AI, including deepfakes and deep nudes. Wherever KCSIE says nudes, it includes AI-made ones.
“digitally altered or wholly generated using artificial intelligence, including what are sometimes described as 'deepfakes' or 'deep nudes'”
Keeping children safe in education 2026, explainer on nudes and semi-nudes, page 6. Dated 7 July 2026. Read 28 September 2026.
- 08
The child protection policy should cover the consensual and non-consensual making or sharing of nudes and semi-nudes, including those generated using AI.
“consensual and non-consensual making or sharing of nudes and semi-nudes, including those generated using AI”
Keeping children safe in education 2026, paragraph 193 (footnote 145 to paragraph 540 repeats the point). Dated 7 July 2026. Read 28 September 2026.
- 09
Every incident involving shared nudes needs a safeguarding response, proportionate to the age, development and circumstances of the children involved. KCSIE does not say "a full safeguarding response".
“a safeguarding response, with a proportionate approach that considers the age, development, and circumstances of the children involved”
Keeping children safe in education 2026, paragraph 530. Dated 7 July 2026. Read 28 September 2026.
- 10
The UKCIS advice on sharing nudes and semi-nudes for education settings was last updated on 11 March 2024.
Sharing nudes and semi-nudes: advice for education settings working with children and young people, publication page. Dated 11 March 2024. Read 28 September 2026.
- 11
The UKCIS advice counts computer-generated images, including those made with deepfake apps and AI text-to-image generators, as indecent images of children.
“deepfake apps”
Sharing nudes and semi-nudes: advice for education settings working with children and young people, definitions. Dated 11 March 2024. Read 28 September 2026.
- 12
Making or supplying a tool for generating purported intimate images ("nudification" tools) has been an offence since 29 June 2026 (Crime and Policing Act 2026, section 99). This is criminal law, not KCSIE.
Crime and Policing Act 2026, section 99; commencement by SI 2026/689, regulation 2. Dated 29 April 2026. Read 28 September 2026.
- 13
An incident involving nudes or semi-nudes goes to the DSL as soon as possible. Staff must not intentionally view the image unless there is good and clear reason, and do not copy, print, share, store or save it, or ask a pupil to send or delete it.
“must not intentionally view any nudes and semi-nudes unless there is good and clear reason to do so”
Sharing nudes and semi-nudes: advice for education settings working with children and young people, initial response. Dated 11 March 2024. Read 28 September 2026.
- 14
Public First's poll for the report was an online survey of 4,021 people aged 11 to 24 in England, carried out from 18 to 27 August 2026, weighted by age, gender and region. "Secondary" means Years 7 to 11; "college" means college and school sixth form. Unweighted bases: 1,326 secondary pupils and 930 college and sixth form students unless a table says otherwise.
AI in Education: polling tables (Public First for Seldon and Bunting), methodology sheet. Dated 22 September 2026. Read 27 September 2026.
- 15
32.6 per cent of secondary pupils and 44.9 per cent of college and sixth form students have used AI to talk through problems or how they are feeling.
AI in Education: polling tables (Public First for Seldon and Bunting), Table 24 (secondary 32.57 per cent weighted, base 1,326). Dated 22 September 2026. Read 28 September 2026.
- 16
The statutory RSHE guidance published in July 2025 applies to teaching from 1 September 2026.
Relationships education, relationships and sex education (RSE) and health education (statutory guidance), publication page, updated 1 September 2026. Dated July 2025. Read 28 September 2026.
- 17
Secondary pupils are taught that AI chatbots can pose risks by creating fake intimacy or offering harmful advice.
“That AI chatbots are an example of how AI is rapidly developing, and that these can pose risks by creating fake intimacy or offering harmful advice.”
Relationships education, relationships and sex education (RSE) and health education (statutory guidance), secondary RSE, online safety and awareness, pages 15 to 17. Dated July 2025. Read 28 September 2026.
- 18
Learner-facing products should avoid attempting to cultivate personal relationships with users, should not anthropomorphise, should avoid the potential for emotional dependence, and should alert the DSL to patterns that suggest emotional dependence.
“attempting to cultivate personal relationships with users”
Generative AI: product safety standards, emotional and social development; mental health. Dated 19 January 2026. Read 28 September 2026.
- 19
Annex C, the DfE's own list of changes for 2026, includes updated definitions of the online risk categories, the new explainer on nudes and semi-nudes, and added guidance and resources on the safe and effective use of generative AI in education.
“Added guidance and resources on safe and effective use of Generative AI in education”
Keeping children safe in education 2026, Annex C. Dated 7 July 2026. Read 28 September 2026.
- 20
KCSIE 2026 has no separate AI section. Two short paragraphs inside "Online safety" point schools that choose to use generative AI to the DfE's guidance and its online staff modules.
“choose to use Generative AI”
Keeping children safe in education 2026, paragraphs 167 and 168. Dated 7 July 2026. Read 28 September 2026.
- 21
Annex A gains a link to CEOP and Internet Watch Foundation guidance on AI-generated child sexual abuse material.
Keeping children safe in education 2026, Annex A. Dated 7 July 2026. Read 28 September 2026.
- 22
Governing bodies and proprietors should ensure that a review of the effectiveness of filtering and monitoring is carried out at least once every academic year, by the SLT member responsible for filtering and monitoring with the support of the DSL and IT support, covering all internet-connected devices in all relevant locations, with a record kept of the checks. This is "should", and the consultation response says it adds no new requirement.
“ensure that a review of their effectiveness is carried out at least once every academic year”
Keeping children safe in education 2026, paragraph 173. Dated 7 July 2026. Read 28 September 2026.
- 23
The filtering and monitoring review falls to the SLT member responsible for filtering and monitoring, supported by the DSL and IT support.
“the SLT member responsible for filtering and monitoring, with the support of the school's designated safeguarding lead and IT support”
Keeping children safe in education 2026, paragraph 173. Dated 7 July 2026. Read 28 September 2026.
- 24
The DfE's consultation response says the fuller filtering and monitoring wording does not introduce new requirements, because the same expectations were already in its filtering and monitoring standards, and that those responsible for governance are not expected to undertake the checks personally.
“not introduce new requirements”
Keeping children safe in education 2026: government consultation response, pages 35 and 36 (pages 17 and 18 on the nudes wording). Dated July 2026. Read 28 September 2026.
- 25
The DSL should take lead responsibility for online safety, including understanding the filtering and monitoring systems and processes in place, and this should be in the job description. It is not a 2026 change: Annex C lists none.
“understanding the filtering and monitoring systems and processes in place”
Keeping children safe in education 2026, paragraph 127 and Annex B. Dated 7 July 2026. Read 28 September 2026.
- 26
All staff should receive safeguarding and child protection training, including online safety and an understanding of their roles in filtering and monitoring, at induction, with updates as required and at least annually. The training paragraphs do not mention AI.
“as required, and at least annually”
Keeping children safe in education 2026, paragraphs 12, 153 and 154 (paragraph 12 points to 173 to 177 for filtering and monitoring). Dated 7 July 2026. Read 28 September 2026.
- 27
The condensed version of Part one (the old Annex A) has been withdrawn. Annex C says all staff are expected to read Part one in full; KCSIE's own wording is "should". The DfE's new one-page overview for all staff is intended to complement, not replace, Part one.
“intended to complement, not replace”
Keeping children safe in education 2026, page 7; Annex C; the one-page overview (kcsie-2026-part-one). Dated 7 July 2026. Read 28 September 2026.
- 28
Paragraph 177 still refers to the DfE's "Generative AI: product safety expectations" (the pre-January 2026 name) and asks governing bodies and proprietors to discuss with IT staff and service providers what more needs to be done. Paragraphs 173 to 177 never mention AI-generated content.
“discuss with IT staff and service providers what more needs to be done”
Keeping children safe in education 2026, paragraph 177. Dated 7 July 2026. Read 28 September 2026.
- 29
The DfE's product rules for generative AI are now "Generative AI: product safety standards". First published as expectations on 22 January 2025, they were renamed and extended on 19 January 2026 with new standards on cognitive development, emotional and social development, mental health, and manipulation.
“to include new standards on cognitive development, emotional and social development, mental health, and manipulation”
Generative AI: product safety standards, publication page, change history. Dated 19 January 2026. Read 28 September 2026.
- 30
In the standard's words, filtering is preventative and monitoring is reactive.
“is preventative”
Filtering and monitoring standards for schools and colleges (Meeting digital and technology standards in schools and colleges), the core standard, definitions. Dated 16 September 2026. Read 28 September 2026.
- 31
The annual review should establish how and where any generative AI web and in-application products are used, and any technical limitations, such as whether the solution can monitor and filter real-time, dynamic, personalised or AI-generated content.
“how and where any generative AI web and in-application products are used”
Filtering and monitoring standards for schools and colleges (Meeting digital and technology standards in schools and colleges), the core standard, review checklist. Dated 16 September 2026. Read 28 September 2026.
- 32
The standard asks every school and college to consider whether a filtering and monitoring solution that can handle real-time, dynamic, personalised and AI-generated content is required. This expectation is in the DfE standard, not in KCSIE.
“should consider whether a filtering and monitoring solution that can handle real-time, dynamic, personalised and AI (artificial intelligence)-generated content is required”
Filtering and monitoring standards for schools and colleges (Meeting digital and technology standards in schools and colleges), the core standard. Dated 16 September 2026. Read 28 September 2026.
- 33
The filtering and monitoring standard is guidance ("DfE's recommended approach"), not statute, and says schools should already be meeting it. The 2030 date applies to the set of six core digital standards as a whole.
“You should already be meeting this standard”
Filtering and monitoring standards for schools and colleges (Meeting digital and technology standards in schools and colleges), the core standard. Dated 16 September 2026. Read 28 September 2026.
- 34
Creating, or requesting the creation of, a purported intimate image of an adult without consent has been an offence since 6 February 2026 (Sexual Offences Act 2003 sections 66E and 66F, inserted by section 138 of the Data (Use and Access) Act 2025). It matters when a member of staff is targeted.
The Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026, SI 2026/31, SI 2026/31, made 15 January 2026; DUAA 2025 section 138. Dated 15 January 2026. Read 28 September 2026.
Cite this guide
Wes (2026). What KCSIE 2026 says about AI, deepfakes and filtering. School AI Governance, reviewed 28 September 2026. https://schoolaigovernance.co.uk/guides/kcsie-2026-ai-deepfakes-filtering
Free to use, adapt and share in education under CC BY-NC-SA 4.0. Each section heading carries its own link, so a reference can point at one part.