What the UK DfE AI Guidance Gets Right, And What It Misses

The UK Department for Education published its AI guidance for schools in 2024, and it was broadly welcomed. After months of schools making it up as they went along, here was an official document that said, essentially, "Yes, you can use AI. Here are some things to think about." For many school leaders, that was enough. Permission to proceed.

But I have read 33 international frameworks on AI in education. And when you place the DfE guidance alongside the other 32, its strengths become clear, and so do its gaps. This is not a criticism of the DfE. They produced a pragmatic document in a fast-moving space. But pragmatism has limits, and school leaders need to know where those limits are.

What It Gets Right

The DfE guidance does three things well.

First, it takes a permissive rather than prohibitive stance. It does not ban AI in schools. It does not mandate specific tools or approaches. It acknowledges that AI is already in classrooms and that schools need the autonomy to manage it locally. Compared to some jurisdictions that have swung between outright bans and uncritical adoption, the DfE's measured approach is sensible.

Second, it foregrounds data protection. The guidance is clear that schools must comply with UK GDPR when using AI tools, and it specifically warns about student data being processed by third-party AI systems. This is the right emphasis. In my audit work, data protection is one of the areas where schools most consistently fall short; not because they do not care, but because they do not fully understand what their AI tools are doing with student data.

Third, it acknowledges the workload argument. The guidance recognises that AI can reduce teacher workload, marking, planning, administration, and positions this as a legitimate reason for adoption. For teachers drowning in paperwork, this matters. It gives them institutional cover to explore tools that might genuinely help.

What It Misses

Here is where I need to be direct, because these gaps have real consequences for schools that treat the DfE guidance as sufficient.

No teacher competency framework. The DfE guidance tells schools to think about AI but does not define what teacher AI competency looks like. UNESCO has published an entire framework on this, the AI Competency Framework for Teachers, that maps out knowledge, skills, and dispositions across multiple levels of proficiency. The OECD has identified specific skills pipelines for educators in the AI era. The DfE guidance has... a suggestion that schools should provide training.

This is not a small gap. Without a competency framework, schools have no way of knowing what "good" CPD looks like, no way of measuring whether their training is working, and no shared language for discussing teacher readiness. I have worked with schools where "AI training" meant a single twilight session on ChatGPT prompts. That is not competency development. It is awareness-raising at best.

No risk classification for educational AI. The EU AI Act classifies AI systems used in education as high-risk. This is a legal designation with specific compliance obligations around documentation, human oversight, transparency, and bias testing. The DfE guidance does not adopt any risk classification system. It treats all AI use in schools as broadly equivalent, whether you are using ChatGPT to brainstorm lesson ideas or using an AI system to profile student behaviour and predict outcomes.

These are not equivalent. An AI tool that helps a teacher draft a worksheet has a fundamentally different risk profile from an AI tool that flags students as "at risk" based on algorithmic analysis. Schools need a framework for distinguishing between them, and the DfE guidance does not provide one.

No assessment integrity framework. This is the gap that keeps me up at night. The DfE guidance acknowledges that AI creates challenges for assessment but does not provide a framework for managing them. It essentially says "schools should think about this" and leaves it there.

Meanwhile, exam boards are updating their regulations, universities are rewriting academic integrity policies, and international frameworks like the IB have published detailed guidance on AI and assessment. Schools following only the DfE guidance are operating without a playbook on one of the most consequential challenges AI poses to education.

What does a robust assessment integrity framework look like? It includes clear definitions of acceptable and unacceptable AI use, differentiated by task type. It includes detection strategies that go beyond AI detection tools (which, as research consistently shows, are unreliable). It includes assessment redesign principles that make AI assistance less relevant, such as process-based assessment, oral defence, and in-class supervised tasks.

No governance structure guidance. The DfE guidance does not tell schools how to govern AI at an institutional level. It does not recommend forming an AI steering group. It does not suggest terms of reference, reporting lines, or review cycles. It assumes that existing school governance structures will absorb AI oversight naturally.

They will not. AI touches curriculum, assessment, data protection, safeguarding, HR, procurement, and student welfare simultaneously. It does not sit neatly within any existing governance structure, and without a dedicated mechanism for oversight, decisions get made in silos; the IT department approves tools without consulting teachers, teachers adopt tools without consulting data protection officers, and senior leaders have no visibility over what is actually happening.

No international or cross-jurisdictional lens. This matters more than you might think, even for schools in England. Many English schools use AI tools developed in the US, which means student data may be processed under different privacy regimes. And for British international schools, of which there are thousands worldwide, the DfE guidance simply does not account for operating in jurisdictions with different legal frameworks, cultural expectations, and regulatory requirements.

A British international school in Dubai, for example, must consider UAE data protection law, the school's own British curriculum standards, and potentially the EU AI Act if it processes data of EU citizens. The DfE guidance offers no help with this complexity.

What Schools Should Do

I am not suggesting schools ignore the DfE guidance. It is a reasonable starting point and it carries institutional legitimacy that matters when you are explaining AI decisions to parents and governors. But it is a starting point, not an endpoint.

Here is how I would supplement it.

Layer UNESCO's teacher competency framework on top of your CPD provision. Use it to build a progression model for teacher AI literacy that goes beyond one-off training. Measure where your staff are now and set targets for where they need to be.

Adopt a risk classification approach, even an informal one. Map every AI tool your school uses against a simple risk matrix: low risk (teacher productivity tools with no student data), medium risk (student-facing tools with limited data processing), high risk (tools that assess, profile, or make decisions about students). Apply proportionate governance to each tier.

Build an assessment integrity policy that goes beyond "do not use ChatGPT to write your essay." Define acceptable AI use for different assessment types, invest in assessment redesign, and train staff in detecting AI-assisted work through pedagogical methods rather than unreliable detection software.

Establish an AI steering group with cross-functional representation. Include senior leadership, teaching staff, IT, data protection, and where possible student and parent voice. Give it a clear remit: review AI tools before adoption, monitor compliance, and report to governors on a regular cycle.

And if you operate internationally, audit your AI use against the frameworks that apply to your jurisdiction, not just the DfE. The AI Literacy Audit Tool was designed precisely for this: it cross-references your school's readiness against 33 frameworks simultaneously, giving you a picture that no single national guidance document can provide.

The DfE got the tone right. Schools needed permission to engage with AI, and they got it. But permission is not the same as preparation, and the distance between the two is where the real work lies.