Write your school's AI policy.

1.1Why we have this policy. This policy sets out how the school uses artificial intelligence (AI), including generative AI tools that write text, make images or sound, or answer questions. It helps staff, learners and parents use AI in ways that support learning, protect privacy and keep everyone safe, within the law that applies to the school.

We take a balanced approach: clear rules, with use that grows as learners grow, and staff who model careful, honest use.

1.2Our principles. Everything in this policy follows six principles.

• Children's best interests first. A child's best interests are of paramount importance in every matter concerning the child (Constitution s28(2); Children's Act s9), and that includes how the school uses AI.
• People first. AI supports teachers and learners. It never replaces the relationship between them, or a teacher's professional judgement.
• Learning before shortcuts. We use AI where it helps learners think, not where it does the thinking for them.
• A person checks every output. AI can be wrong, biased or out of date. Whoever uses it checks what it produces and stays responsible for it.
• Privacy and fairness. Everyone has the right to privacy (Constitution s14), and no learner is disadvantaged because they have less access to devices, data or paid tools.
• Open about AI. Staff and learners say when and how they have used AI.

2.1Who and what this covers. This policy applies to all staff (teaching and support staff, temporary staff and volunteers), to learners, and to anyone who works with learners on the school's behalf. It covers AI used for school work, for school business or with learners, on school devices and school accounts, and on learners' and staff's own devices when they are used at school, on the school network or for school work.

It also covers AI-made or AI-altered images, video, audio or messages of learners or staff that are shared with, or affect, members of the school community, including those made at home on a personal phone. The school acts on them as far as its code of conduct for learners and the law allow (see the questions for the school's lawyer in the legal basis appendix); conduct by staff is dealt with under their employer's procedures.

2.2How it fits with our other policies. This policy works alongside the code of conduct for learners, which the governing body adopts under the Schools Act (s8(1)), the data protection (POPIA) policy and PAIA manual, the child protection and safeguarding procedures, the assessment policy, the anti-bullying policy and the acceptable use (ICT) policy. Where two policies cover the same thing, the stricter rule applies.

2.3Definitions.

• Artificial intelligence (AI): computer systems that do tasks we usually link to human thinking, such as recognising patterns, making predictions or producing language.
• Generative AI: AI that produces new text, images, audio, video or code in response to a prompt. Chatbots and image generators are examples.
• Approved tool: an AI tool listed in the school's AI tools register for a stated use and group of users (Appendix A).
• Child: under POPIA, a person under 18 who is not legally competent to act or decide in matters concerning themselves without the help of a competent person (POPIA s1).
• Competent person: someone legally competent to consent to an action or decision about a child, such as a parent or guardian (POPIA s1).
• Personal information: information about an identifiable, living person (or an existing organisation, where applicable), including their education history, identifying numbers, contact details, biometric information, opinions and other people's views about them (POPIA s1). A learner's photo, marks, reports and behaviour notes are personal information.
• Processing: anything done with personal information, such as collecting, storing, using, sharing or deleting it (POPIA s1). Typing or uploading it into an AI tool is processing.
• Responsible party: the body that decides why and how personal information is processed; for this policy, the school (POPIA s1).
• Operator: a person or company that processes personal information for the school under a contract or mandate, without coming under its direct authority, such as an AI provider that stores learners' work (POPIA s1).
• Special personal information: information about a person's religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or alleged criminal behaviour (POPIA s26).
• Biometrics: identifying a person from physical, physiological or behavioural characteristics, such as fingerprints, retinal scans or voice recognition (POPIA s1).
• Deepfake: an image, audio or video made or changed with AI that resembles a real person or event and would falsely appear to be real (based on EU AI Act Art 3(60)).

3.1The School Governing Body. The governance of a public school is vested in its governing body, and its professional management is undertaken by the principal under the authority of the Head of Department (Schools Act s16(1) and s16(3)). The School Governing Body (SGB) adopts this policy and any big change to it, receives a report on the AI tools register and on serious AI incidents at least once a year, and makes sure this policy fits the school's other policies.

3.2The principal. The principal leads this policy day to day, appoints the AI Lead, makes sure staff are trained, and decides how breaches are handled, following the school's procedures.

3.3The AI Lead. The AI Lead keeps the AI tools register, checks new tools before they are approved, keeps a log of AI incidents and questions, arranges training, answers questions from staff and parents, keeps the tools' age rules up to date and leads the review of this policy.

3.4The Information Officer. Every school has an Information Officer under POPIA: for a public body, the information officer defined in PAIA, and for a private body, its head (POPIA s1). The Information Officer may take up these duties only once the school has registered them with the Information Regulator (POPIA s55(2)), and deputies may be designated (s56). The Information Officer encourages and oversees compliance, deals with requests and works with the Regulator (s55(1)), and makes sure the school has a compliance framework, does personal information impact assessments and holds awareness sessions on POPIA (POPIA Regulations, reg 4(1)(a), (b) and (e)).

For AI, the Information Officer checks the privacy side of any tool that will process personal information, keeps the operator agreements and reports security compromises to the Information Regulator.

Who the Information Officer of a public school is has not been settled, so the school confirms it with its lawyer (the first question in the legal basis appendix) and records the name here.

3.5All staff. Staff follow this policy, use only approved tools for school work, check what AI produces, keep personal information safe, tell learners what each task allows, and report concerns.

3.6Learners. Learners use AI only as this policy and their teachers allow, say when they have used it, keep their own and other people's personal information private, and tell a teacher if something online worries them.

3.7Parents and guardians. Parents and guardians are told about this policy and the tools their children use, give consent where the school relies on it or a tool's provider requires it, and are welcome to raise questions with the AI Lead.

4.1Only approved tools. Staff and learners use only the AI tools listed in the AI tools register for school work and school business, and only for the uses and the users listed there. Using any other tool for school work needs the AI Lead's approval first.

4.2How a tool is approved. Before a tool goes on the register, the AI Lead and the Information Officer check:

1. What it is for, and whether it helps teaching, learning or school work enough to be worth using.
2. The provider's own age rules, and which phases, if any, may use it.
3. What happens to what people type or upload: whether it is kept, shared or used to train the provider's AI, and whether that can be switched off.
4. Whether it needs personal information at all. If it does, the Information Officer does a personal information impact assessment (POPIA Regulations, reg 4(1)(b)), and the school signs the written operator agreement POPIA requires (POPIA s21(1)).
5. Where the information is stored and processed, which ground in POPIA s72(1) allows any transfer abroad, and whether prior authorisation is needed (POPIA s57(1)(d)).
6. For tools learners use: content filtering that works on every device, safety settings the school controls, no human-like friend or companion features, and help that gives hints before full answers.
7. Accessibility, cost, whether it works on low bandwidth or offline, what it costs in mobile data, and how the school can stop using it and have its data deleted.

4.3Tools we do not use. The school does not use AI to read or infer the emotions of learners or staff, and does not use AI proctoring that watches faces, eyes or voices to judge behaviour in tests. No tool built to make sexual images of real people is allowed on school devices or accounts.

This follows the EU AI Act, which has banned AI that infers emotions in education institutions since 2 February 2025, except for medical or safety reasons (EU AI Act Art 5(1)(f)), treats AI that monitors learners in tests as high-risk (Annex III, point 3), and bans AI used to make non-consensual intimate images or child sexual abuse material from 2 December 2026 (Art 5(1)(ba) and (bb)). That law does not bind a South African school directly, but it is a useful benchmark. These tools also rely on biometric information, which POPIA treats as special personal information (POPIA s26).

4.4School accounts. The school does not give learners school-managed AI accounts. Learners only use AI where a teacher sets it up through an approved tool, and never through personal accounts.

4.5The tools' own age rules. Every tool is used within its provider's own age rules, and the stricter of those rules and this policy applies. The AI Lead checks the rules each term and before a new group of learners uses a tool, and records them in the register.

Age rules as the providers stated them on 12 October 2026. These change often. Check each provider's current terms before relying on this table.

Education apps built on AI models such as Claude, GPT or Gemini set their own age rules, so check the rules of the app itself, not those of the company that made the model. For example, Anthropic lets organisations build products for under-18s only with extra safeguards, such as age checks, a child-safety system prompt and telling users they are talking to AI.

No provider we checked names South Africa, so their default ages apply here. Under POPIA every learner under 18 is a child, so a provider's age rule never replaces the school's own lawful ground or a parent's consent (POPIA s1, s34 and s35(1)).

Many providers' minimum age of 13 matches United States law: under the Children's Online Privacy Protection Rule, a child is under 13, and covered online services need verifiable parental consent before they collect a child's personal information (16 CFR 312.2 and 312.5(a)). The US school records law, FERPA, applies to US schools that receive US federal education funds (34 CFR 99.1), not to South African schools.

4.6Free and personal accounts. Anything typed into a free or personal AI account may be kept by the provider and used to train its AI, so we treat it as public. Staff do not put school information into personal accounts unless the register allows that tool for that use and no personal information is involved. Learners are never asked to open personal accounts on AI tools for school work.

5.1What staff may use AI for. With approved tools, staff may use AI for:

• Planning and resources: lesson plans, worksheets, questions, examples and ideas.
• Adapting for different needs: simpler or richer versions, scaffolds, and support in other languages.
• Admin and communication: drafting letters, newsletters, agendas and minutes.
• Drafting feedback: first drafts of feedback on work that has had names and personal details removed.

Any other use needs the agreement of the principal first.

5.2A person checks everything. Staff read, check and edit anything AI produces before they use it: facts, sources, bias, and whether it suits the learners and the curriculum. AI can invent facts and references that look real. The member of staff stays responsible for the final work, whatever tools helped.

5.3Keep personal information out. POPIA requires the school to keep personal information secure (POPIA s19(1)), to have a written agreement with any operator that processes it (s21(1)), and to process a child's personal information only on a ground the Act allows (s34 and s35(1)). So staff never enter learners' or colleagues' personal information into an AI tool unless the register approves that tool for it. In every other tool they remove names and anything else that could identify a person first. Special personal information, such as health, religion or biometric information, never goes into an AI tool.

5.4Be open about it. Staff say when AI has helped to produce something others rely on, such as a resource shared with colleagues, and they show learners what careful, honest use looks like. When the school shares an AI-made image, audio or video that looks real, it says it was made with AI, in line with what the EU AI Act requires of deepfakes from 2 August 2026 (EU AI Act Art 50(4)).

5.5People make the decisions. Under POPIA, a person may not be subject to a decision that has legal consequences for them, or affects them to a substantial degree, based solely on automated processing that profiles them, for example their performance, reliability or conduct, unless a narrow exception applies (POPIA s71(1) and (2)).

The school goes further: AI is never the only basis for a decision about a learner or a member of staff, including admissions, discipline, support needs, promotion, marks that count, hiring and other employment matters. A person decides and can explain the decision. The EU AI Act treats AI used for these decisions in education and employment as high-risk (EU AI Act Annex III, points 3 and 4). If AI ever helps to assess job applicants, it must not discriminate unfairly (Employment Equity Act s6(1) and s9), and any psychological or similar assessment must meet the conditions in section 8 of that Act, including certification by the HPCSA or another authorised body (Employment Equity Act s8, as amended by the Employment Equity Amendment Act s4). An AI tool that scores personality or aptitude may count as such an assessment.

5.6Feedback drafts. Staff may ask an approved tool to draft feedback on learners' work only after removing names and personal details, and only in a tool that does not use the work to train its AI. The teacher edits the feedback and owns it.

5.7Marking. Staff do not use AI to mark learners' work or to decide marks.

5.8Reports to parents. Teachers write report comments themselves. AI is not used to write reports to parents.

5.9Learners' work belongs to them. Copyright in a learner's own work belongs to the learner as its author (Copyright Act s21(1)(a)). Staff do not upload learners' work to tools that keep it or use it to train AI, and never to free AI detectors, unless the learner and a parent have agreed.

5.10Copyright and AI. Copyright in teaching materials staff make in the course of their employment belongs to their employer, unless an agreement says otherwise (Copyright Act s21(1)(d) and (e)). For a work generated by a computer, the Act treats the person who made the arrangements for its creation as its author (Copyright Act s1, definition of author, paragraph (h)), but how this applies to AI output has not been settled. Staff and learners do not upload material they have no right to copy, such as textbooks or other publishers' material, into AI tools unless the licence allows it.

6.1Rules that grow with learners. How learners use AI depends on their phase. These rules apply at school and to school work done at home. Learners use only the tools the register allows for their phase, and always within each tool's own age rules.

6.2Foundation Phase (Grades R to 3). In the Foundation Phase, AI is teacher-led only. A teacher may use an approved tool in front of the class to show what AI is, to explore a question together and to talk about what it gets right and wrong. Learners do not use AI tools themselves, and no task asks them to. This follows the providers' own rules: most general AI tools are not for children under 13, and OpenAI says that with under-13s in education an adult must do the actual interaction.

6.3Intermediate Phase (Grades 4 to 6). In the Intermediate Phase, AI is teacher-led only. A teacher may use an approved tool in front of the class to show what AI is, to explore a question together and to talk about what it gets right and wrong. Learners do not use AI tools themselves, and no task asks them to. This follows the providers' own rules: most general AI tools are not for children under 13, and OpenAI says that with under-13s in education an adult must do the actual interaction.

6.4Senior Phase (Grades 7 to 9). In the Senior Phase, learners may use approved tools themselves for set tasks in class, with a teacher present. The teacher chooses the tool, sets the task and talks about the results with the learners. Learners use the tool the teacher sets up, never personal accounts.

6.5FET Phase (Grades 10 to 12). In the FET Phase, learners may use approved tools on their own, homework included, when a task allows it. They follow the level set for the task, keep a record of how they used AI and declare it. Where a tool's rules require it, a parent gives permission first.

6.6What learners may never do with AI.

• Hand in work made by AI as their own.
• Use AI in a task or test that does not allow it.
• Make or change images, video or voice recordings of real people, including other learners and staff.
• Use AI to bully, threaten, deceive or harass anyone, or to make sexual, violent or hateful content.
• Put their own or anyone else's personal information into an AI tool.
• Use AI friend or companion chatbots on school devices or during school activities.
• Try to get round a tool's safety settings or the school's filters.

6.7Learners' own devices. When learners use their own devices at school, the same rules apply, and they use the school network and school accounts where the school provides them. The school's filters do not reach a learner's own mobile data, so teachers supervise AI use in class.

7.1What the evidence says. In a controlled field experiment with close to a thousand high school learners, published after peer review in 2025, a general AI assistant raised practice scores by about 48 percent while learners were using it. Those learners then did about 17 percent worse than their classmates on a later test written without it. A version built with teaching safeguards, which gave hints rather than answers, largely removed that harm. The lesson is not that AI harms learning. It is that AI which hands over answers harms it.

No rigorous study of this kind has been done with primary-age children, so this school is careful in the early phases rather than confident.

7.2AI explains, learners produce. Where learners may use AI, they use approved tools to explain a concept, test their understanding, get feedback on their own draft or make practice questions. They do not use AI to produce the work that is being assessed.

A 2026 experiment with university students points the same way: those who used AI to explain concepts kept what they learned, while those who had it draft their writing lost the gain once AI was taken away. This comes from a preprint that has not yet been peer reviewed, so it is early evidence rather than settled.

7.3Designing tasks in an AI world. The practical answer to AI in assessment is how tasks are designed, not trying to detect AI. Teachers plan for:

• more writing done in class;
• oral checks, where a learner talks through their own work;
• marking the process and the drafts, not only the final piece;
• tasks tied to the learner's own context, classroom or community, which a general AI tool cannot produce.

The rules for how much AI a task allows, and for declaring it, are in the section on assessment and honesty.

7.4Foundations first. Reading, writing and number sense come before any tool. In the Foundation Phase and the Intermediate Phase, the school teaches without learner-facing AI, and teachers may use approved tools to prepare. More than eight in ten South African Grade 4 learners could not read for meaning in the PIRLS 2021 study, so the foundations are the priority.

7.5The teacher stays the teacher. AI does not replace a teacher's explanation, feedback or relationship with a class. A person reads, checks and owns anything AI helped produce before it reaches a learner or a parent, and the teacher remains accountable for every mark. The detail is in the section on how staff use AI.

8.1Every task states its level. Every assessed task and homework task says how much AI learners may use, using the four levels below. If a task does not say, Level 2: AI for ideas and planning applies. In phases where learners do not use AI themselves, Level 1: no AI applies.

The levels are adapted from the AI Assessment Scale by Mike Perkins, Leon Furze, Jasper Roe and Jason MacVaugh. No level is better than another: teachers choose the one that fits what the task is meant to show, and they may set different levels for different parts of a task.

8.2No-AI work is supervised. Nobody can check whether AI was used in work done at home, so when it matters that learners work without AI, they do that work under supervision, such as in class or in a test.

8.3Declaring AI use. When a task allows AI, learners declare it: the tool, the date, what they asked, and how they used the answer, on the declaration in Appendix B.

The school goes further than the DBE's example declaration, which only shows how to name the tool: for longer work, learners keep a record of their prompts and the AI's replies until marks are final, such as screenshots or a handwritten log.

8.4Showing the learning. Teachers build tasks so they can see learners' thinking: work started in class, plans and drafts checked along the way, and short conversations in which learners explain their work. A learner's own work shows understanding they could show again in a different setting.

8.5Detectors are never proof. AI detectors are not reliable, and they wrongly flag writing by people who write in a second language more often: in one study, seven detectors labelled more than half of a set of essays by non-native English writers as AI-made. That test was in English, not on South African learners, but it matters for every learner who writes in a language that is not their home language. A detector result is never proof, and never the only evidence of misconduct.

The school goes further than some exam bodies, which allow a detector result as one part of the evidence: if a teacher suspects misuse, they first talk to the learner about the work and how they made it, and learners' work is never uploaded to a free detector.

8.6What counts as misconduct. It is academic misconduct to:

• hand in work made by AI, in whole or in part, as their own;
• use AI in a task whose level does not allow it;
• leave out or misreport AI use in a declaration;
• include sources, quotations or data that AI made up, or that they have not checked;
• help another learner do any of these.

Suspected misconduct is handled under the assessment policy and the code of conduct for learners, fairly and with the learner heard first.

8.7Tests and exams. AI tools are not allowed in tests and exams unless the paper says so. Devices that could reach AI tools, including phones, smart watches, earbuds and other wearables, are kept out of exam rooms as the exam body requires.

NSC candidates sign the national examination pledge, which bans cellphones and any other electronic device during the examinations, though it does not name AI. The national task team on the 2025 NSC paper leak found that some candidates used ChatGPT to rework answers using leaked marking guidelines, and the Minister said exam controls would be updated for new technologies, including wearables.

8.8CAPS and the NSC. For practical assessment tasks (PATs) and other school-based assessment, learners complete the declaration of authenticity the Department of Basic Education requires and acknowledge any help from AI in it, as the DBE's 2026 Grade 12 Computer Applications Technology guidelines show. Visual Arts learners also follow Addendum C of the 2026 Visual Arts PAT on AI-generated imagery: AI images are inspiration only, learners record the sites and prompts in their sourcebook, and the final artwork must show enough of their own changes. The other 2026 PATs we checked ask only for a declaration that the work is the learner's own, so this policy's levels and declarations fill that gap. Teachers accept work only when they are satisfied it is the learner's own. The DBE's and the provincial department's rules on irregularities come first, and the AI Lead checks each year for new instructions on AI.

9.1Who is responsible. The school is the responsible party for personal information it decides to process, including in AI tools (POPIA s1). It must make sure POPIA's conditions for lawful processing are met when it decides how a tool will be used and while it is used (POPIA s8), including having a lawful ground for each use (POPIA s11(1)). The Information Officer leads this work, as set out in the Roles section.

9.2Learners' information is children's information. POPIA prohibits processing a child's personal information unless an exception in section 35 applies (POPIA s34): for example, the prior consent of a competent person, usually a parent or guardian (s35(1)(a)), or where the processing is necessary to establish, exercise or defend a right or obligation in law (s35(1)(b)). Putting a learner's information into an AI tool is processing (s1), so it happens only in approved tools, for a stated school purpose and on one of these grounds, and the Information Officer records which ground applies.

If no ground in s35(1) applies, the processing may go ahead only with the Information Regulator's authorisation under s35(2), which the Regulator gives on application where the processing is in the public interest and appropriate safeguards are in place. The Regulator's 2021 guidance note sets out how to apply.

9.3Special personal information and biometrics. POPIA prohibits processing special personal information, which covers religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information and alleged criminal behaviour, unless an authorisation in sections 27 to 33 applies (POPIA s26 and s27(1)). A school may process a learner's health information where necessary to give special support (s32(1)(c)).

The school goes further: no special personal information is put into an AI tool, and no tool that identifies people by their face, voice or other biometrics is used unless the Information Officer has confirmed a lawful basis in writing.

9.4Only what is needed, for a stated purpose. Personal information may be processed only if it is adequate, relevant and not excessive for the purpose (POPIA s10), collected for a specific, explicitly defined and lawful purpose (s13(1)) and kept no longer than needed (s14(1)), and using it in a new way must be compatible with the purpose for which it was collected (s15(1)). It must also be kept complete, accurate and not misleading (s16(1)).

So staff remove names and details that could identify a learner wherever they can, give an AI tool only what the task needs, delete AI conversations that hold personal information when they are no longer needed, and check anything AI writes about a person before it goes on record.

9.5Telling people. When the school collects personal information, it must take reasonably practicable steps to make sure people know what is collected and why, who will receive it, whether it will go to another country and the protection there, and their rights, including the rights to access, to correct, to object and to complain to the Information Regulator (POPIA s18(1); POPIA Regulations, reg 2, as amended in 2025).

So the school's privacy notice names the approved AI tools that process personal information, why and where the information goes, and parents are told before a learner uses a tool that needs their child's personal information beyond a school login. The school's record of its processing and its PAIA manual are updated when a tool is added (POPIA s17; PAIA s14(1) for a public body, s51(1) for a private body).

9.6Operators and written agreements. An AI provider that processes personal information for the school under a contract, without coming under its direct authority, is an operator (POPIA s1). It may process the information only with the school's knowledge or authorisation and must keep it confidential (s20). The school must have a written contract that makes the operator establish and maintain the security measures in section 19 (s21(1)), and the operator must tell the school immediately if there are reasonable grounds to believe the information has been accessed or acquired without authority (s21(2)). The agreement may be electronic (ECTA s12). The Information Officer checks that the provider's terms meet these requirements before the tool is approved.

9.7Keeping information safe. The school must secure personal information with appropriate, reasonable technical and organisational measures: it identifies foreseeable risks, puts safeguards in place, checks them regularly and updates them (POPIA s19(1) and (2)). For AI tools this means school accounts, settings that stop the provider training on school data where the provider allows it, and removing access when people leave.

9.8Information sent outside South Africa. Many AI tools store or process information outside South Africa. Personal information may go to a third party in another country only on a ground in POPIA s72(1): for example, the recipient is bound by a law, binding corporate rules or a binding agreement that gives an adequate level of protection, or the person concerned consents (POPIA s72(1)(a) and (b)).

Sending children's personal information, which covers most learners, or any special personal information to a third party in a country that does not provide an adequate level of protection needs the Information Regulator's prior authorisation first (s57(1)(d)). The school must notify the Regulator and may not start that processing until the Regulator has finished its investigation or said it will not investigate further (s58(1) and (2)). The Regulator says within four weeks whether it will investigate in more detail, and a more detailed investigation may not take longer than 13 weeks (s58(3) and (4)), so the school plans for that time. These steps do not apply where a code of conduct for the sector is in force (s57(3)), but we found no such code for schools when the sources for this policy were last checked (12 October 2026), so they apply. The Information Officer records the ground for each tool, and any authorisation, in the AI tools register.

9.9If something goes wrong. If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the school must notify the Information Regulator and the people affected, unless they cannot be identified (POPIA s22(1)), as soon as reasonably possible after it is discovered (s22(2)). The notice to the people affected must be in writing, for example by email, and must tell them enough to protect themselves (s22(4) and (5)). Since 1 April 2025 the Regulator requires these reports to be made through its eServices portal, not by email.

Anyone who thinks personal information has been put into the wrong tool, shared or accessed without authority tells the Information Officer at once.

9.10Access, correction and objection. People may ask whether the school holds personal information about them, and for the record or a description of it, including who has had access (POPIA s23(1)). They may ask for it to be corrected or deleted (s24(1)) and may object to some processing (s11(3)). This includes information held in AI tools on the school's behalf. Objections and requests to correct or delete are free and may be made in any convenient way, and the school tells the person in writing, within 30 days, what it has done (POPIA Regulations, regs 2 and 3, as amended in 2025).

9.11Monitoring school systems. The school may monitor the use of AI tools on its devices, network and accounts to keep learners safe and protect information, while respecting everyone's right to privacy (Constitution s14), and tells staff, learners and parents in advance what is monitored and why (POPIA s18(1)). Where monitoring would intercept communications while they are being sent, it is done only as RICA allows for the school's own systems: with the system controller's consent, for purposes such as detecting unauthorised use, and after reasonable efforts to tell users in advance (RICA s6(1) and (2)).

9.12Learners' work, photos and voices. Learners' work, photos, voices and videos are not put into AI tools that keep them or use them for training, and are never used to make new images or recordings of learners. Photos and recordings of learners are personal information, and a face or voice used to identify someone is biometric information (POPIA s1).

9.13When EU or UK law could apply. The EU's General Data Protection Regulation (GDPR) and the UK GDPR do not usually apply to a school in South Africa. They can apply if the school has an establishment in the EU or UK, or offers education to people who are in the EU or UK, for example through online classes, or monitors their behaviour there (GDPR Art 3(1) and (2); UK GDPR Art 3). They still matter: many AI providers must follow them, and they are a useful benchmark.

If the school starts to enrol or teach learners in the EU or UK, or joins a group based there, the Information Officer asks a lawyer whether these laws apply and this policy is updated.

9.14When the law is broken. Anyone may complain to the Information Regulator (POPIA s74(1)). If the school breaks POPIA, the Regulator can serve an enforcement notice (s95(1)) and a person affected can claim damages in court (s99(1)). Failing to comply with an enforcement notice is an offence that carries a fine or up to 10 years' imprisonment (s103(1) and s107). For an alleged offence, the Regulator may instead issue an infringement notice with an administrative fine of up to R10 million, subject to the Act's limits (s109(2)(c)), and the school may pay it, arrange to pay it in instalments or elect to be tried in court (s109(2)(d)). Starting processing that needs prior authorisation without notifying the Regulator is also an offence (s58(1), s59 and s107).

10.1Safeguarding comes first. AI risks are part of the school's child protection and online safety procedures. Every child has the right to be protected from maltreatment, neglect, abuse or degradation (Constitution s28(1)(d)). Staff report any concern about AI and a learner's safety or wellbeing straight away to the staff member named in those procedures (the child protection lead), as they would any other concern.

10.2Never make images of real people. No one may use AI to create or change images, video or voice recordings of real learners or staff. AI may never be used to make sexual or humiliating images of anyone, or fake videos or messages that accuse staff or learners of things they did not do. The school responds to such material made at home on a personal phone, once it is shared with or affects members of the school community, as far as its code of conduct and the law allow. South African schools have already had both: AI nude images of girls shared at one school, and AI videos accusing teachers of misconduct posted about another.

10.3AI-made sexual images and threats are crimes. Under the Sexual Offences Act, child pornography (the Act's term, often now called child sexual abuse material) includes any image, however created, of a person, real or simulated, who is or is shown as under 18, of an explicit or sexual nature (Sexual Offences Act s1). An AI-made sexual image of a learner falls within it. Creating, possessing, sharing, accessing or viewing it is an offence (s19A(1), (3) and (4)), as is possessing or creating it under the Films and Publications Act (s24B(1)).

Sharing an intimate image of a person, real or simulated and made by any means, electronically and without their consent, is an offence (Cybercrimes Act s16(1) and (2)(b)), and so is sharing a sexual image of an adult, however created, without consent where it causes harm (Sexual Offences Act s11A(1)). Sending an electronic message that threatens someone with violence or damage to property is also an offence (Cybercrimes Act s15).

Learners who make or share these images may themselves be children. A child under 12 has no criminal capacity and cannot be prosecuted (Child Justice Act s7(1)), and a child aged 12 or 13 is presumed to lack criminal capacity unless the State proves otherwise (s7(2)). From 14, that presumption no longer applies. Children who offend are dealt with under the Child Justice Act, which provides for diversion. Whatever the learner's age, the school still reports the matter and follows its child protection procedures for every learner involved, including the one who made the image.

10.4If an image like this appears. Staff do not copy, forward, save or show it to anyone, and do not look at it more than they must. They tell the child protection lead at once, who follows the child protection procedures and supports the learners involved. This applies wherever the image was made, at school or not.

To keep the evidence without spreading the image, staff write down where it was seen (the platform, the account name, the link, and the date and time), ask the platform to remove it, and give these details to the police. Child sexual abuse material can also be reported to the Film and Publication Board's online hotline. The school's legal adviser helps with anything further.

Anyone who knows, reasonably believes or suspects that a sexual offence has been committed against a child must report it immediately to a police official (Sexual Offences Act s54(1)), and failing to report is an offence (s54(2)(a)). A teacher who concludes on reasonable grounds that a child has been sexually abused must also report that conclusion in the prescribed form to a designated child protection organisation, the provincial department of social development or a police official (Children's Act s110(1)). So the school reports to the police immediately, and the teacher also makes the Children's Act report in the prescribed form. We found no court decision on whether an AI-made image of a real learner is a sexual offence committed against that learner for section 54, so the school reports it to the police in every case.

A learner or member of staff who is harassed, including with AI-made images or messages, can apply to a magistrate's court for a protection order, and a child may apply without a parent's help (Protection from Harassment Act s1, s2(1) and s2(4)).

10.5Harmful content. The school filters AI tools on its network and devices, and approved learner tools have their safety settings switched on. Filters are never perfect, so learners are taught to tell a teacher if an AI tool shows them something upsetting or asks for personal information.

10.6AI is not a friend. Learners are taught that AI tools are not people and cannot care about them. Companion or friend chatbots are not used at school. Staff watch for signs that a learner leans on an AI tool for comfort or advice, and follow up as a wellbeing concern.

10.7Fake messages and scams. AI can make convincing fake messages, voices and images, including messages that look as if they come from the school. Staff and learners are taught to check before they trust, and the school confirms important requests, such as payments or changes to bank details, through a second channel.

11.1No one is left behind. Every learner has the right to a basic education (Constitution s29(1)(a)), and AI should not widen gaps between learners. No task requires learners to use AI outside school or to pay for a tool. Where a task is built around AI, learners use it at school with an approved tool, and learners who do not use AI are never marked down for that.

11.2Check for bias. No one may unfairly discriminate against anyone, including through a policy, rule or practice that disadvantages people on grounds such as race, language, culture or disability (Constitution s9(4); PEPUDA s6 and s1, definition of discrimination). AI tools can repeat unfair ideas about people, languages and cultures, so staff check outputs for bias before using them, and teach learners to do the same.

11.3Our languages and cultures. Most AI tools learn mainly from English and from content made in other countries, so they can be wrong or careless in other South African languages and about our cultures, including when learners and parents use AI to translate. AI support in African languages is weak and uneven: in a 2023 test, an earlier ChatGPT model scored zero on translation between English and isiZulu. Newer tools are likely better, but this is a reason to check. Learners with strong written English also tend to get more out of AI, so teachers watch that it does not widen gaps. Staff check translations and cultural content with someone who knows the language or culture, and AI is never used to imitate cultural traditions in disrespectful ways.

The school gives parents the letter and summary about this policy in the languages its families use. A staff member or parent fluent in the language checks each translation; AI translation alone is not enough.

11.4Support for learners who need it. Where an approved tool helps a learner with a disability or a barrier to learning, for example by reading text aloud or simplifying it, the school may allow it in tasks and assessments in line with the support agreed for that learner and the exam body's rules on accommodations.

12.1Training for staff. All staff are trained on this policy and on safe, effective use of AI when they join and at least once a year, including privacy, safeguarding risks such as deepfakes, and how AI affects teaching and assessment. In the EU, organisations that use AI must take measures to support their staff's AI literacy (EU AI Act Art 4), a fair standard for any school.

12.2AI literacy for learners. Learners are taught about AI in ways that suit their age: what it is and is not, how it can be wrong or unfair, how to keep their information private and when not to use it. As they get older they also learn how to use it well, how to decide what to hand to AI and what to keep for themselves, and how AI systems are made.

AI literacy builds on the Coding and Robotics curriculum (Grades R to 9). In the Foundation Phase that subject is taught unplugged, with no devices, and devices are used from Grade 4, so lessons about AI can also be taught without a device.

Older learners also learn the law that protects them: POPIA, and why making or sharing fake sexual images of people is a crime.

12.3Help for parents. The school offers parents information about AI and this policy, for example at a parent evening or in a newsletter, including how to talk with their children about AI at home.

13.1Keeping parents informed. Parents receive this policy with the letter in Appendix D, and are told which approved tools their child will use and why.

13.2Consent. Before a learner uses a tool that needs their personal information beyond a school login, or whose provider requires a parent's permission, the school asks a parent or guardian for consent (or the learner, once they are 18). Where the school relies on consent for a child, a competent person must give it before the processing (POPIA s35(1)(a)); it must be voluntary, specific and informed (s1), the school must be able to prove it (s11(2)), and it may be withdrawn at any time (s11(2)). If consent is withdrawn, the learner does the work another way.

13.3AI at home. The school shares simple guidance for families: the tools' age rules, keeping personal details private, and helping children understand that an AI tool is not a person to confide in.

13.4Questions and concerns. Parents can raise questions or concerns about AI with the AI Lead. Complaints follow the school's usual complaints procedure, and anyone may also complain to the Information Regulator about how personal information is handled (POPIA s74(1)).

14.1Learners. When a learner breaks this policy, the school responds under the code of conduct for learners, which the governing body adopts after consulting learners, parents and educators and which must provide for due process, and disciplinary proceedings must be age-appropriate, in the learner's best interests and fair (Schools Act s8(1), s8(5)(a) and s8(5)(c)). The code must also take account of learners' cultural beliefs, religious observances and medical circumstances, and contain an exemption provision (s8(2) and s8(4)). The response is in proportion to what happened: a first, minor problem with AI use is usually a chance to teach; serious or repeated breaches, and anything that harms others, are handled as misconduct. A detector result is never enough on its own, and the learner is always heard first.

14.2Staff. Staff who break this policy are dealt with under the disciplinary procedures that apply to their employment. For educators employed by the provincial education department, that is the Employment of Educators Act, which sets out misconduct and serious misconduct (Employment of Educators Act s17(1) and s18(1)). Educators are also bound by the SACE Code of Professional Ethics, which includes respecting learners' privacy and confidentiality.

14.3Serious incidents. Anything that may be a crime, such as an AI-made sexual image of a learner, a threat or fraud, is reported as the law requires and handled under the child protection procedures, not only as a discipline matter: a sexual offence against a child is reported to the police at once (Sexual Offences Act s54(1)), a teacher who concludes on reasonable grounds that a child has been sexually abused reports it as the Children's Act requires (s110(1)), a threat of violence sent electronically may be an offence (Cybercrimes Act s15), and a data breach is reported to the Information Regulator (POPIA s22(1)), as set out above.

15.1Keeping track. The AI Lead keeps the AI tools register and a log of AI incidents and questions, and reports to the principal each term and to the SGB each year.

15.2Reviewing this policy. This policy is reviewed every year, and sooner if the law, an exam body's rules, a tool's terms or the school's needs change, because AI tools and the rules around them change fast. Staff and parents are asked for their views, and so are learners, in a way that suits their age (Children's Act s10). The SGB adopts any changes.

When the sources for this policy were last checked (12 October 2026), South Africa had no national AI policy in force and no Department of Basic Education guideline on AI in schools. The draft national AI policy was gazetted for comment in April 2026 and then withdrawn. A revised draft is expected, but the published timing has moved more than once and is not settled, so this policy does not predict a date. The Minister of Basic Education has also announced a review of the e-Education White Paper. Each review of this policy checks for these, and for any new circular from the provincial department.

15.3Adopting this policy. The school takes this policy through these steps before it applies:

1. Draft it, using this document as a starting point, and take it to the leadership team.
2. Consult staff, learners (through the Representative Council of Learners, where the school has one) and parents.
3. Ask the school's own legal adviser or a POPIA specialist to check it.
4. The governing body adopts it by resolution, recorded in the minutes.
5. Put the rules on AI misconduct into the code of conduct for learners, which the governing body adopts after consulting learners, parents and educators (Schools Act s8(1)), including its exemption provision (s8(4)).
6. Publish it and tell parents, in the languages families use.
7. Set the date of the next review.

15.4Approval.