Important Updates to Keeping Children Safe In Education 2026

The Department for Education has just released the latest Keeping Children Safe in Education (KCSIE) 2026 that comes into effect from 1^st September 2026. While many of the changes build on existing expectations, the latest guidance includes important updates around filtering and monitoring, strengthens accountability, brings emerging technologies into sharper focus, and reinforces that safeguarding responsibility must be led at a strategic level.

One of the most encouraging aspects of KCSIE 2026 is how closely it reflects concerns and recommendations that have been highlighted by the UK Online Harms Early Warning Working Group (EWWG). Earlier this year, we published guidance to help education settings protect children’s images from AI manipulation and abuse, following evidence that perpetrators were using images from school websites and using AI tools to create abusive content and facilitate blackmail attempts.

It is therefore excellent news to see many of these emerging risks now reflected within KCSIE’s statutory framework. For schools, this means that advice previously delivered through sector guidance is increasingly being reinforced through statutory safeguarding expectations.

One of the most significant changes is the requirement for schools and colleges to review the effectiveness of their filtering and monitoring systems at least once every academic year. While annual reviews have long been encouraged through the DfE’s Filtering and Monitoring Standards, KCSIE now embeds this expectation directly within statutory safeguarding guidance. Governing bodies and proprietors must ensure that:

– Appropriate filtering and monitoring systems are in place.
– Their effectiveness is reviewed annually.
– Schools can demonstrate that these reviews have taken place.

KCSIE 2026 also introduces much clearer accountability for filtering and monitoring reviews. The guidance states that reviews should be undertaken by the senior leadership team member responsible for filtering and monitoring, supported by the Designated Safeguarding Lead (DSL) and IT support.
This is an important development as it shows that responsibility can no longer sit solely within technical teams or be delegated entirely to third-party providers. Schools must be able to demonstrate leadership oversight, safeguarding expertise and technical understanding.

KCSIE also makes it clear that DSLs should understand filtering and monitoring systems and processes, and that this responsibility should be reflected in job descriptions. Staff safeguarding training should also cover filtering and monitoring expectations, roles and escalation procedures.

For the first time, KCSIE explicitly requires schools to keep records of filtering checks. Reviews should include testing filtering across internet-connected devices and locations, with a record of the checks undertaken. Schools should therefore consider and prepare to evidence:

– When checks took place.
– What devices and environments were tested.
– Any issues identified.
– The actions taken to address concerns.

The growing influence of artificial intelligence is reflected throughout. The guidance directly references the Department for Education’s work on generative AI product safety expectations and highlights the need for schools to understand how filtering and monitoring requirements apply to AI-powered tools.
This recognises that schools are increasingly adopting AI technologies while simultaneously managing new risks, including inappropriate AI-generated content, unsupervised interactions with AI systems, and data protection concerns.

Contact risks associated with the 4Cs framwork now explicitly include interactions with generative AI systems that simulate human conversation, while conduct risks include the making, sending or receiving of explicit images, including those created using AI. 

KCSIE 2026 adopts the term “nudes and semi-nudes” throughout the guidance when discussing images involving under-18s. The definition includes self-generated, digitally altered and entirely AI-generated images, including so-called “deepfake” or “deep nude” content. This aligns language more closely with existing UK Council for Internet Safety guidance and reflects the realities of image creation and manipulation.

Another important update is the stronger link between cyber security and safeguarding. KCSIE now references Cyber Security Standards for Schools and Colleges and makes clear that protecting personal information and maintaining appropriate cyber security systems forms part of safeguarding responsibilities.

As schools prepare for implementation from September 2026, we encourage schools to review their current strategies and ensure these new considerations are factored into their processes.