AI in the classroom: turning the national framework into a policy that actually works

Generative AI stopped being a novelty in Australian classrooms somewhere during 2025. The national policy scaffolding now exists — the Australian Framework for Generative AI in Schools (six principles, 25 guiding statements, reviewed and re-endorsed by Education Ministers in June 2025) and the National AI Plan released in December 2025 — and state systems are moving too, with NSW publishing its own guidance and building NSWEduChat as a department-controlled alternative to public chatbots. What most schools still lack is the last mile: a working policy, an approved-tools list and the technical guardrails to make either mean something.

Here's how we help schools close that gap — the governance and the IT, because in practice they fail together.

Start with the framework, not a blank page

The national Framework already gives you the structure: teaching and learning, wellbeing, transparency, fairness, accountability, and privacy and security. Your school policy just needs to make it concrete. At minimum, cover:

• Permitted and prohibited uses — separately for staff and for students, because they are different problems.
• Assessment rules: what's allowed per task, and how AI assistance must be declared. Ambiguity here creates your academic-integrity caseload.
• Privacy red lines: no student personal information, student work, health or family details entered into public AI tools. Ever. This is the single most common violation we see, and it's usually well-meaning teachers saving time.
• Transparency: students and families are told when AI is being used in ways that significantly affect them.
• Deepfakes and misuse: the 2024 Framework review specifically flagged AI-generated image abuse as an emerging risk in schools. Your policy needs a response path before the first incident, not after.

Build an approved-tools list — and mean it

An AI policy without an approved list is a suggestion. Assess each tool the way NSW assesses tools for its own guidance: where does data go, is it used for model training, is there an education agreement with appropriate terms, does it support school sign-on? Prefer education-specific deployments (or a system-provided option where your sector offers one) over consumer accounts. Then publish the list where staff actually look, and make requesting a new tool easy — a fast approval path is your best defence against shadow AI.

The technical guardrails that make policy real

1. Identity first. Approved tools should be accessed through school single sign-on, so access follows your account lifecycle and MFA — and disappears when a staff member leaves.
2. Filter and log the rest. Web filtering can block or warn on unapproved AI services on school networks and school-managed devices; via Intune, that policy follows 1:1 devices home. Logging gives you an honest picture of actual usage instead of an assumed one.
3. Data loss prevention. DLP rules in Microsoft 365 can catch student records and personal information being pasted out to web tools — turning your "privacy red line" from a poster into a control.
4. Review AI features inside tools you already own. Your LMS, office suite and classroom platforms are switching AI features on by default. Each one deserves the same privacy assessment as a new tool, because functionally it is one.

Bring staff along, or the policy fails quietly

Teachers are already using AI — surveys consistently show it saves them meaningful weekly hours on preparation and administration. A policy experienced as pure restriction gets ignored; one that pairs clear rules with training and genuinely useful approved tools gets adopted. Budget for professional development in the same breath as governance.

Review annually — this ground is still moving

The national settings are on an annual review cycle, state guidance keeps evolving, and vendors change their data practices with a changelog nobody reads. Put AI policy on the same yearly review calendar as your child-safety and privacy policies.