AI Governance for Schools
How to Write a School AI Acceptable Use Policy That Covers Deepfakes, Privacy, and Staff Risk
Many school AI policies are still too narrow. A credible policy needs to govern classroom use, staff use, data handling, image abuse, and reporting pathways together.
A lot of school AI acceptable use policies still read like emergency plagiarism guidance from 2023. They focus on whether students can use generative AI for assignments, whether teachers can use it for lesson planning, and whether outputs should be disclosed. Those are useful questions, but they are not the full policy problem anymore.
Australia's policy direction has moved beyond that. The Australian Framework for Generative AI in Schools is designed to guide the responsible and ethical use of generative AI across school communities, including leaders, teachers, support staff, service providers, parents, and students. That broader frame matters because AI risk in schools is no longer only about academic integrity. It is also about privacy, security, safety, explainability, fairness, and community trust.
At the same time, eSafety has warned that deepfake abuse is already affecting Australian school communities and that tools used to create synthetic explicit images are easy to access, easy to use, and causing serious harm. That means an AI policy that says nothing about image manipulation, impersonation, non-consensual content, or abuse reporting is already incomplete.
A stronger school AI policy should cover at least five areas. First, permitted use: what students and staff may use AI for, and under what disclosure rules. Second, prohibited use: including deepfakes, impersonation, harassment, image manipulation, fabricated evidence, and unauthorised use of student or staff data in external tools. Third, data handling: what information may or may not be entered into public or third-party AI systems. Fourth, approval and procurement: who can adopt new AI tools and what privacy and security review is required. Fifth, escalation and support: how staff, students, and families report misuse and how incidents are handled.
Schools should also write for the real audience, not just for legal completeness. The policy should be understandable to parents, practical for teachers, and specific enough that school leaders can enforce it. A policy that sounds sophisticated but does not tell a teacher what to do after a deepfake complaint is not a good policy.
