AI can now do a real share of your website compliance work. It still can’t do the deciding.

Until recently, using artificial intelligence for school website compliance meant pasting a policy into ChatGPT or Google Gemini and asking for a summary. That’s changed. AI can now read your whole website, compare it with what schools are expected to publish online, and tell you what looks missing, thin or out of date in a few minutes. What it can’t do is take responsibility for the answer.

This guide is for headteachers, school business managers, governors and trust leaders who want to use AI tools to support compliance work without losing control of it. Schools and trusts face real pressure here, so it’s worth getting right. It covers what you have to publish, where AI genuinely helps, where it doesn’t, what the data protection rules say, and how we’ve built AI into the Schudio CMS now that the Schudio AI Suite is live.

The short answer

If you only read one section, make it this one.

• AI is good at the trawling. Reading every page, matching it against a list of requirements and spotting a missing report or an outdated document is exactly the kind of repetitive work it does well.
• People are still responsible. The Department for Education is clear that the quality of anything produced with AI remains the responsibility of the professional and the organisation who produced it.
• Treat every flag as a draft. A good AI audit tells you where to look. Someone at your school decides whether it’s right.
• Keep pupil data out of it. Compliance checks only need your public website, so there’s no reason for a tool to touch personal data at all. That’s the simplest way to comply with data protection law.
• Watch the source, not just the lists. New duties often start in law months before the official DfE pages mention them.

What must schools publish online?

Website compliance isn’t a single list. It’s a collection of statutory requirements and expectations from several places, and they differ depending on the type of school you are. Maintained schools, academies and multi academy trusts each have their own list.

Maintained schools and academy websites

The Department for Education sets out the core expectations on two pages: what maintained schools must publish online and what academies, free schools and colleges should publish online. Both were last updated on 24 October 2024. For maintained schools most items are legal duties. For academy websites many come through the academy’s funding agreement, so the wording is “should”, but the expectation is just as real, and parents use the same information whichever type of school their child attends.

Contact details, policies and the rest

Between them, the current DfE requirements cover your contact details, admissions arrangements, Ofsted reports, exam and assessment results, curriculum information, the behaviour policy, the complaints procedure, SEND information, pupil premium and PE and sport premium reports, governance structure and governor details, charging and remissions policies, equality objectives and the public sector equality duty, and more. That’s a lot of policies and documents for schools to keep current, and each one needs reviewing on its own timetable.

Duties that sit outside the DfE lists

Some duties don’t appear on either page at all. Keeping children safe in education drives your safeguarding and child protection information. The accessibility regulations require a statement explaining how accessible your website is. For trusts, the Academy Trust Handbook adds its own list.

Two recent examples show why this matters. Since 1 September 2026 schools in England must publish their allergy safety policy on their website, under section 34 of the Children’s Wellbeing and Schools Act 2026, commenced by SI 2026/933. And the Academy Trust Handbook 2026, effective from 1 October 2026, requires multi academy trusts to publish a summary statement of how funds are distributed across their schools by 31 January, so the first is due by 31 January 2027. Neither appears on the two DfE pages yet.

Why compliance work suits AI so well

Most compliance problems aren’t neglect. They’re drift. A policy gets replaced and the old link stays on another page. A governor’s term ends and their name stays on the governance page. A review deadline passes and nobody is reminded. None of it is anyone’s fault. It’s what happens when a job this constant lands on staff in schools who already have another job.

Our own audit data shows the pattern clearly. In The State of School Website Compliance, based on 247 audits of 205 schools during 2025, the average score was 80.2%. That sounds healthy, but only 6.5% of those websites were fully compliant, 39.3% scored below 80%, and governance information was missing or incomplete on nearly half (49.8%). Most schools are close. Very few are completely right, and the ones that are rarely stay that way for long.

Finding drift means trawling through every page and every document, again and again. That’s slow, dull work for a person, and it carries a real risk of something being missed. It’s exactly where AI helps schools most, because it can identify the small problems that build up between checks.

What generative AI tools can help with

Used well, generative AI takes on the administrative tasks of checking and drafting, which frees your team to do the thinking. Here’s where AI tools earn their place in schools.

Reading the whole site at once

Large language models can scan hundreds of pages and documents in the time it takes to make a coffee, and compare what they find with a framework of requirements. Instead of checking one page at a time before an inspection, you can check everything, whenever you like. Good systems built for schools do this against the same framework every time, so results are comparable from one check to the next.

Spotting what’s thin or stale

A good AI application doesn’t just ask “is there a SEND page?” It looks at whether the page says enough. A PE and sport premium report with no figures, a curriculum heading with nothing under it, or a SEND information report untouched for two years are the gaps that matter, and the ones a simple checklist misses.

Drafting clearer page copy

Generative AI tools are useful for turning a long policy into a short, parent friendly summary, or for drafting the introduction to a page that’s never had one. Anything drafted still needs a careful read, because the tool doesn’t know your school the way you do. It’s a useful starting point, not a finished page for parents.

Keeping documents and dates consistent

AI can spot policies with no review deadline, documents with mismatched version numbers, and links that now lead nowhere. These are small issues, but they’re the ones parents and inspectors notice, and they cause real confusion. AI tools are very good at finding them.

Why human expertise still decides

AI can tell you where to look. It can’t make the judgement for you, and it shouldn’t try.

Interpreting grey areas in the guidance

DfE guidance has plenty of grey areas. Does a trust-wide policy satisfy the requirement for a particular academy in the trust? Does your local authority’s admissions arrangement mean you link rather than publish? These need someone who understands the context and the subject, which is why training your staff matters as much as the tool.

Applying local knowledge

An AI tool won’t know that your child protection procedures follow a particular local authority’s arrangements, that someone on the board resigned last week, or that the new behaviour policy goes to governors next month. Your team does.

Taking responsibility

Only people can be accountable. The DfE’s policy paper on generative AI in education puts it plainly: “Any content produced requires critical judgement to check for appropriateness and accuracy.” Ofsted is equally clear that it judges outcomes, not tools. Its guidance says: “We do not look at AI as a stand-alone part of our inspections, and we do not directly evaluate the use of AI, nor of any AI tool.” So there are no special Ofsted expectations about using AI. What matters is whether the information on your website is right.

Artificial intelligence and data privacy

This is the part school leaders ask about most, and rightly so.

Your school is still the controller

The Information Commissioner’s Office says in its guidance on AI and data protection that “Overall accountability for data protection compliance lies with the controller, ie your organisation.” Using a third party tool doesn’t hand that responsibility to the supplier. Schools remain responsible for how any personal data is used, whichever providers they choose.

DPIAs and appropriate safeguards

The ICO also says that in the vast majority of cases using AI will trigger the legal requirement for a data protection impact assessment, where personal data is involved. The DfE recommends that personal data isn’t put into generative AI tools at all, and where it must be, that you put appropriate safeguards in place in line with data protection legislation and your own data privacy policies. Special category data, such as health or SEND information about pupils, needs particular care.

The simple fix: keep pupil data out

Website compliance checking doesn’t need any personal data. Your website is already public, so a well designed tool can work entirely from what you’ve published. If a supplier’s compliance tool asks to connect to your MIS or any system that holds information about children, ask why, and involve your data protection officer before you agree.

Copyright and AI images

The DfE paper also warns about “secondary infringement”, which can happen when AI outputs trained on unlicensed material are published, for example on a school or college website. Use edtech tools your school is licensed to use, and check anything AI produces before it goes online.

What AI school website compliance looks like with Schudio

When we first wrote this guide, our AI features were still in development. They’re now live, and they’re the main improvement we’ve made to how we support schools with compliance. The Schudio AI Suite is built into the Schudio CMS, and its compliance side is explained in full on our AI and compliance page. Here’s the short version.

Built on 2,500+ audits

The AI audits run on the same requirements work behind the 2,500+ compliance audits we’ve carried out and our monthly compliance workshops. It reviews your whole site, not one page at a time, against what maintained schools must publish and what academies and trusts should publish, plus duties from Keeping children safe in education, the Academy Trust Handbook and the accessibility regulations. That means academy schools, maintained schools and trusts are each checked against the requirements that actually apply to them.

Draft, review, sign off

Nothing is marked complete automatically, however clear a flag looks. The audit saves as a draft. Your team then works through it, agreeing with what it found, correcting anything it got wrong and adding context it didn’t have, and it’s signed off once someone at your school is happy.

It also gets to know your school. Feedback on one audit carries into the next, so it learns which flags were right and which were noise for your site. There’s no limit on how often you run it, at no extra cost.

Ahead of the official lists

Every item carries its true status: must, should, or not yet in force, with the source named so you can check it yourself. We watch the Acts, commencement regulations and statutory guidance, not just the two DfE pages, so when a new duty like the allergy safety policy comes into force our schools hear about it from us straight away. We never upgrade a should into a must, and we never say nothing has changed without checking again.

Part of a wider compliance system

Finding a gap is half the job. Keeping it closed is the other half. The AI audits sit alongside Document Groups (publish a document once and it updates everywhere), policy review reminders, weekly compliance updates for clients, training and support resources and, for multi academy trusts, the MAT Portal, which gives the central team one view of compliance across every school in the trust.

What it will not do

It doesn’t make you compliant. It doesn’t publish anything. It doesn’t replace anybody, because the honest version is that the same people get further in the same time. And it doesn’t touch pupil data. You can read more on how we handle your data, and there’s a fuller look at the whole Suite in our guide to AI school website software.

How to introduce AI tools safely: a checklist

Whichever tool you use, these steps keep AI use safe, transparent and useful.

• Start with a clear question. “What’s missing or out of date on our website?” is a good first job for AI. “Make us compliant” isn’t.
• Check what the tool checks against. Ask whether it covers maintained schools and academies separately, trust duties, and duties from outside the DfE lists. A tool that can’t tell you this is a risk in itself.
• Ask how it handles change. Does it tell you when new statutory requirements come into force, and does it name the source?
• Keep personal data out. Prefer systems that work from your public website only, and ask suppliers to identify exactly what they collect.
• Involve your DPO early. Agree whether a DPIA is needed and record the decision.
• Name who signs off. Decide which member of staff reviews each AI audit, and who has the final say.
• Write it into your AI policy. Say what AI is used for, what it isn’t, and how outputs are checked.
• Build in training. Make sure the people using it understand its limitations as well as its benefits. Our workshops and training resources are a good place to start, and they support staff development as well as the tool itself.
• Run it regularly. A check every half term, or after any big update, catches drift before it becomes a problem.
• Keep evidence. A signed off audit is a useful record for governors and inspectors that your website is looked after all year.

Common mistakes to avoid

Treating a pass as proof

An AI tool can confirm a page exists. It can’t confirm that what’s on it is right for your school. Always read the flagged pages yourself.

Relying only on the DfE lists

The two DfE pages are updated last. The allergy safety policy duty has been in force since 1 September 2026 and still isn’t on either of them.

Pasting sensitive documents into open tools

Open, public AI tools may keep or learn from what you give them. Don’t paste draft policies containing names, safeguarding information or pupil details into them.

Publishing AI drafts without a read

AI writes confidently, even when it’s wrong. A policy summary with the wrong review date, or invented details, is worse than no summary at all.

Only checking before an inspection

Last minute checks cause pressure and miss things. Little and often, all year, is calmer and more reliable, and it’s an essential part of an Always Ready approach.

Forgetting the trust level

Trusts have their own duties, from governance details and executive pay to the new funds distribution statement. A school by school check won’t catch a gap on the trust website, so academy trust leaders need a view across every academy and the trust itself.

AI in the education sector: a crucial role, kept in proportion

AI won’t transform education overnight, and it doesn’t need to. For school websites, its crucial role is taking the trawling off your desk so your team can spend its time on judgement, which is the bit only people can do. Used that way, it gives you something rarer than a perfect score: the peace of mind that comes from knowing where you stand, all year round.

Frequently asked questions

Can AI make our school website compliant?

No, and be wary of any supplier who says theirs can. AI can review your website and tell you what looks missing, thin or out of date. Someone at your school then decides whether that’s right and does something about it.

Is it safe to use ChatGPT or Google Gemini for compliance?

For drafting summaries of policies that are already public, these tools are generally fine, provided someone checks the result. Don’t put personal data or unpublished safeguarding information into them, and follow your school’s AI policy.

Will Ofsted judge our use of AI?

Ofsted says it doesn’t directly evaluate the use of AI or any AI tool. It looks at the impact, so what matters is that the information on your website is accurate and up to date.

Do we need a DPIA to use an AI compliance tool?

If the tool processes personal data, the ICO says a DPIA will usually be required. If it only reads your public website, the risk is much lower, but talk to your DPO and record the decision either way.

How often should we check our website?

At least once a term, and after any significant change, such as a new policy, a change of governors or a new admissions round. Many schools also check before governors’ meetings so the board can see where things stand. With the Schudio AI Suite you can run an audit as often as you like at no extra cost.

How do we get the Schudio AI Suite?

It’s included as standard on every new Schudio website. Existing Schudio schools and trusts can add it to their current website at any time as a fixed add-on to their annual fee, without waiting for renewal. For trusts, it’s one decision for the whole trust.

Where to go next

If you’d like to see how the requirements fit together, download our School Website Requirements Guide, which is kept up to date. For a walkthrough with time for questions, join our free monthly compliance workshop. And if you’d like to see the AI audits working on a real school website, get in touch. It takes about fifteen minutes.