¶ INSET pack: AI and the rules in our school

A ready-to-run staff session on which rules apply to AI in a school or college, who in the building holds each one, the check every AI answer needs, and the school's own rules. It downloads from the hub with no sign-up and covers the same ground as the free online course, AI and the rules: who holds what, so anyone who misses the session can take the course instead.

The session doesn't explain what AI is. Staff who want the basics can take the DfE's free Module 1, Understanding AI in education, before the session; nothing in the session depends on it.

What's in the pack #

• Slides: 21 for the main session and 4 for each role insert, in PowerPoint and PDF. A sources slide sits after slide 21 for reference; it isn't presented.
• Facilitator notes: in the slides' speaker notes, and as a Word document to print.
• Three ten-minute role inserts: exams, data protection and safeguarding.
• Four exercise cards for slide 13, each an AI answer printed beside the trusted source it should be checked against.
• The attendance log: one page, in Word and PDF.

Free to use, adapt and share in education under CC BY-NC-SA 4.0. JCQ material is paraphrased on the slides, because JCQ documents carry no reuse licence; keep it that way when adapting.

Before the session #

1. Fill in the school's own slides (8, 10, 17, 18, 19, 21 and the last slide of any insert) from the school's AI policy. The section below, "How the pack uses your school's own policy", says where each detail comes from.
2. Choose the exercise cards for the room and print them. For the subject card, ask each department to generate one short AI explanation of a topic from its specification the day before, on an approved tool, and print it beside the specification page. No pupil information goes into any tool to make an exercise.
3. Print the attendance log, or set it up as a form.
4. Decide who leads each part. Anyone who runs staff training can lead the main session; each insert works best led by the person who holds that role.

Timings #

• 50 minutes: the main session as written. Part 1, 5 minutes; part 2, 12 minutes; part 3, 18 minutes; part 4, 12 minutes; a few minutes to spare.
• 45 minutes: skip the question on slide 3, take slide 9 in one sentence unless governors are present, cut the exercise on slide 13 to 6 minutes, and take one answer on slide 14.
• 60 minutes: the main session plus one role insert, run after slide 20 so the log at slide 21 covers it. Inserts also run on their own, in a department meeting, an invigilator briefing or an office team meeting.

The main session #

Why we're here

1. AI and the rules in our school
2. What this session is, and isn't
3. It's already here
4. No single rulebook

The rules, and who holds them

5. Safeguarding: KCSIE 2026 and the DSL
6. Exams: JCQ and the exams officer
7. Data protection: UK GDPR, the ICO and the DPO
8. Choosing tools: the DfE's product safety standards
9. Governors and trustees
10. The map, with our names on it

The check

11. Fluent isn't the same as true
12. The check
13. Try it (8 minutes)
14. What did you find?
15. A detector score is never proof
16. When you suspect AI

Our rules

17. Our four rules
18. Our approved tools
19. Who to tell, and when
20. Five questions for this week
21. The record

The role inserts #

Ten minutes and four slides each. Run one at the end of a 60-minute session, or on its own for the people it concerns.

Exams insert

For teachers of qualification courses, invigilators and exams staff. Best led by the exams officer.

• E1. Assessed work, in four rules
• E2. The declaration decides the route
• E3. Candidates, and the exam room
• E4. Our centre

Data protection insert

For all staff. Best led by the DPO or the data lead.

• D1. What counts as personal information
• D2. Three ways our data meets AI
• D3. If something goes in that shouldn't
• D4. Our DPO, our register, our DPIAs

Safeguarding insert

For all staff. Best led by the DSL or a deputy.

• S1. AI harms are safeguarding matters
• S2. If a young person tells you
• S3. What filtering can't see
• S4. Our DSL team, and how to report

The attendance log #

Session details

• School or college
• Date, start time and length (minutes)
• Facilitator (name and role)
• Parts delivered: main session / exams insert / data protection insert / safeguarding insert
• AI policy version and date used on slides 17 to 19
• Pack version

Attendance, one row per person

• Name
• Role or team
• Staff group: teaching / support / leadership / governor or trustee / volunteer / other
• Main session (tick)
• Insert attended: exams / data protection / safeguarding (tick each)
• Signature or initials
• Notes (arrived late, left early)

Catching up, one row per person who missed it

• Name
• How completed: repeat session (date) or the free online course (certificate code)
• Date completed
• Checked by

The record

• Kept by (name and role)
• Where it is kept
• Keep until [date, from the school's retention schedule]
• Total reported to governors on [date]

How the pack uses your school's own policy #

Slide	What goes in	Where it comes from in a policy built with the policy builder	If there is no policy yet
8	Who approves new tools	Section 3, Roles and responsibilities: "[approving role] on the DPO's advice"	Ask the headteacher, and show "to be decided"
10	Names against each set of rules	Section 3, plus the people who hold each role now	The same, from the school's staffing list
17	The four staff rules	Section 5, core rules 5.1 to 5.4, word for word	The four rules poster, marked as interim and agreed by the headteacher
18	Approved tools, and how to propose one	Appendix A, the Approved Tools Register; section 7 for the proposal route	"Nothing approved yet: ask before using anything", with the register template started
19	Who to tell, and how fast	Section 10 (the DSL, the same day) and section 11 (the DPO, straight away)	The child protection policy and the data breach procedure
20	Open questions	Section 13, the review date and owner	The headteacher or whoever will own the policy
21	Where the policy and register live; the training record	Section 12, Training ("a record of that training is kept")	The staff handbook or shared drive location
E4	Exam centre details	Section 9, AI and assessments (exam centres only), and the malpractice policy	The exam malpractice policy
D4	DPO, DPIAs and the register	Section 8, Personal data and AI	The data protection policy
S4	The DSL team and the route	Section 10, Safeguarding, filtering and monitoring	The child protection policy

Sources #

1. Understanding AI in education: module 1, DfE, updated 19 May 2026
2. Safe use of generative AI in education: module 3, video transcripts, DfE, May 2026
3. Using AI in education: support for school and college leaders, video transcripts, DfE, May 2026
4. Generative artificial intelligence (AI) in education, DfE, updated 12 August 2025
5. Generative AI: product safety standards, DfE, updated 19 January 2026
6. Keeping children safe in education 2026, DfE, statutory guidance in force from 1 September 2026
7. Filtering and monitoring standards for schools and colleges, DfE, updated 16 September 2026
8. Sharing nudes and semi-nudes: how to respond to an incident (overview), UKCIS, updated 11 March 2024
9. AI Use in Assessments, JCQ, Revision two, 30 April 2025
10. General Regulations for Approved Centres, JCQ, effective 1 September 2026
11. Instructions for conducting examinations 2026/27, JCQ, effective 1 September 2026 (the key changes table, for paragraph 14.25)
12. Senior leadership team briefing pack: AI and coursework integrity, Ofqual, 9 March 2026
13. Artificial intelligence malpractice and assessment: advice note, Ofqual, 27 April 2026
14. Inspection information for state-funded schools, for use from September 2026, Ofsted, updated 28 August 2026
15. When do we need to do a DPIA?, ICO, updated 13 October 2025
16. ICO governance changes confirmed for 30 September 2026, ICO, 15 September 2026
17. UK GDPR, Article 33 and Article 35
18. Data protection in schools, DfE, updated 9 July 2026, including generative AI and data protection in schools