Descant

guide · AI and student information · last reviewed 18 October 2026

Using AI with student information in Australian schools

Each state and territory has its own privacy law and its own department rules on generative AI, and Catholic and independent schools add their own. This guide covers what applies nationally, compares the states, and links to a guide for each one.

At a glance

  • Seven of the eight government school systems limit or advise against identifiable student information in AI tools; Western Australia has no public Department AI policy.
  • In five, consent does not lift that limit: Victoria, NSW, the ACT, Tasmania and the Northern Territory.
  • ST4S does not currently assess AI services that process health and wellbeing data; a scope decision, not an assessment outcome.
  • From 10 December 2026, privacy policies must describe computer programs used in decisions that significantly affect people.

General information, not legal advice. Last reviewed 18 October 2026; rules change, so check the sources below.

The national framework

The Australian Framework for Generative AI in Schools (October 2023; its 2024 review, endorsed in June 2025, found it still fit for purpose) is a shared set of expectations, not law. Lines that matter for student information:

  • Privacy disclosure: school communities are "proactively informed about how and what data will be collected, used, and shared while using generative AI tools, and consent is sought where needed".
  • Protection of student inputs: staff "take appropriate care when entering information into generative AI tools which may compromise any individual's data privacy".
  • Human responsibility: "teachers and school leaders retain control of decision making and remain accountable for decisions that are supported by the use of generative AI tools".
  • Contestability: people affected have "opportunities to question, the use or outputs of the tools and any decisions informed by the tools".

ST4S and AI

ST4S does not currently assess AI services that process health and wellbeing data; that is a scope decision, not an assessment outcome. As at August 2026, the ST4S Excluded / High Risk list (marked "Updates in progress - 31 August 2026") also lists AI "Designed to process personal or sensitive information", AI that determines or predicts "student disability, learning difficulties", and administrative decision-making "which have a human in the loop step".

ST4S says an exclusion "does not necessarily indicate that tools or products with these features are unsuitable. It does mean that ST4S has not assessed that aspect", and recommends schools complete their own internal risk assessment. A Responsible AI standard is in pilot for suppliers that have already passed ST4S.

Federal Privacy Act changes

The federal Privacy Act covers Catholic and independent schools and their service providers. Three changes matter:

  • Automated decisions, from 10 December 2026. Privacy policies must describe where a computer program makes, or does something "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using their personal information.
  • Children's Online Privacy Code, due by 10 December 2026. The OAIC must register it by then. The exposure draft (31 March 2026) gives "online school management systems that monitor student performance" as an example of a service in scope, and proposes parental consent for under-15s, consent lasting no more than 12 months, and a privacy impact assessment for new services. The final code may differ.
  • A statutory tort for serious invasions of privacy, in force since 10 June 2025.

The OAIC's guidance on AI products (updated 17 January 2025) says privacy obligations apply to information put into an AI system and to what it produces, and that "Consent cannot be implied merely because an individual was notified of a proposed collection of personal information."

How the states compare

Government schools only. Each row links to the full guide.

State Department rule on AI Parent consent Breach notification Approvals
VIC No personal information or student audio loaded onto generative AI tools Opt-in consent needed, but does not lift the rule Department procedures (government); federal scheme (non-government) PIA; ST4S; School Software Panel from October 2027
NSW No personal, sensitive or confidential information in AI tools the Department has not reviewed Product-specific consent outside marketplaces; does not lift the rule Mandatory since 28 November 2023 Marketplaces or Assessed IT; Department AI approval
QLD No personal information in generative AI tools not approved by the department Valid consent for sensitive information Mandatory for departments since 1 July 2025 Information security assessment; FAIRA at department level
SA Department advises no personal information in public generative AI tools; staff guidance needs login No AI-specific rule found No statute; notify the Privacy Committee as soon as possible Department SACSF cloud and supplier risk assessment
WA No public Department AI policy; AI assurance self-assessment for AI-driven systems As the Third Party Service Risk Report sets, with opt-out From 1 January 2027 Catalogue or risk assessment; PIA where significant
TAS No sensitive or personally identifiable information as input to any generative AI tool No consent exception No mandatory scheme ITS Application Risk Assessment; endorsed list
NT No personal or sensitive information in generative AI; public or unclassified only Express consent for sensitive information and data leaving the NT; does not lift the rule No mandatory scheme Online and Cloud System Request; Department assessment by risk
ACT No student personal information entered into generative AI Permission forms for sign-in software; does not lift the rule Federal scheme not generally applicable; voluntary reporting Directorate endorsement; ACT AI Policy self-assessment

State and territory guides

Using AI with student information in Victorian schools The policy asks schools to direct staff not to load personal information about students onto generative AI tools, and not to upload audio or photos of students. Read → Using AI with student information in NSW schools Staff must not enter student work or personal, sensitive or confidential information into AI tools the Department has not reviewed. Read → Using AI with student information in Queensland schools Queensland Government guidance says personal information should not go into generative AI tools not approved by your department. Read → Using AI with student information in South Australian schools The Department recommends that schools and students don't enter personal information into generative AI tools such as public chatbots and image generators. Read → Using AI with student information in Western Australian schools The PRIS Act's privacy rules have applied to agencies, including public schools, since 1 July 2026; its breach scheme starts on 1 January 2027. Read → Using AI with student information in Tasmanian schools Sensitive or personally identifiable information must not be used as an input for any generative AI tool. Read → Using AI with student information in Northern Territory schools Staff must not upload personal and sensitive information into generative AI tools, and may only enter information marked public or unclassified. Read → Using AI with student information in ACT schools No student's personal information, including name, behaviour and learning capacity, may be entered into generative AI. Read →

Catholic and independent schools

The ISA/NCEC Privacy Compliance Manual (April 2025) has a section on AI. It notes that AI use "may pose serious privacy risks" and suggests a privacy impact assessment "for each AI system", contracts that stop providers using personal information for other purposes such as training, specific collection notices, human oversight and labelling of AI content.

Dioceses and schools set their own rules on top. The Melbourne Archdiocese Catholic Schools staff code (2025) says "We must not enter personally identifiable information or corporate data into such tools", and Catholic Education Western Australia's AI Framework (v1.1) requires AI tools to be on its Approved Technology list. See the Catholic schools and independent schools compliance pages.

Using Descant within these rules

  • AI off unless your school adds it. AI features are an optional paid add-on, and a school can switch AI off at any time. With AI off, nothing about a student is sent to an AI model, and case management, referrals, support plans, consent records and notes staff write themselves keep working.
  • AI only with recorded parent consent. Where your rules allow AI, a school can require recorded consent before AI processes a student's information.
  • Documents families sign online (coming). Families will be able to read and sign other school documents online, with no AI involved; consent through a secure link already works.
  • Staff review every AI draft. Drafts are labelled, stay with staff, and are never sent to families automatically. Processing is in Australia.

Read how Descant keeps student data safe, our privacy policy (including how AI is used in decisions), the state-by-state compliance pages, and the note templates staff can write from with AI off.

Sources

Each source was read on 18 October 2026. Dates are those shown on the page or document. State sources are in each guide.

This guide is general information, not legal advice. It describes public rules as at 18 October 2026, and makes no claim that Descant is approved or assessed by any department or by ST4S.

Common questions

Something we haven't answered? Ask us and a person from the team will reply.

Ask a question
Is the Australian Framework for Generative AI in Schools law?

No. It is a framework published by Education Ministers in October 2023. Its 2024 review, endorsed in June 2025, found it still fit for purpose. The rules that bind schools come from privacy law and from each department, diocese or school.

Does ST4S assess AI that drafts notes about students?

As at August 2026, no. The ST4S Excluded / High Risk list shows AI services that process health and wellbeing data, or are designed to process personal or sensitive information, as not assessed. ST4S says this means it "has not assessed that aspect", not that a tool is unsuitable, and recommends schools do their own risk assessment.

What changes on 10 December 2026?

Under the Privacy and Other Legislation Amendment Act 2024, organisations covered by the Privacy Act must describe in their privacy policy any computer program that makes, or does something substantially and directly related to making, a decision that could significantly affect a person, where personal information is used. The Children's Online Privacy Code must also be registered by that date.

Can a school rely on a privacy notice instead of consent for AI?

Not always. The OAIC says "Consent cannot be implied merely because an individual was notified of a proposed collection of personal information." Where consent is needed, it should be specific and recorded.

Which states let consent unlock AI use with student information?

In Victoria, NSW, the ACT, Tasmania and the Northern Territory, government school rules bar or limit identifiable student information in AI tools whatever consent is in place, so the department's approval or an exception comes first. In Queensland and Western Australia, consent sits alongside department approval. In South Australia, the staff guidance needs a login, so ask the Department.

Talk to us about AI settings for your school

Tell us a little about your school and we'll show you how it would work for your team.

  • A made-up school like yours to explore for 14 days
  • We check each request by hand and reply within two school days
  • Made-up students only: no real student information needed

Prefer email? Write to [email protected].

(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.

What would you like help with? (optional)
Prefer a call? Tell us when you’re free

School days are busy. Tell us when you can actually pick up, in your school’s local time, and we’ll call then.

Days
Times

Descant is a business name of Grounded Scribe Pty Ltd. We collect these details only to reply to your enquiry and, if you ask, to call you. We keep your enquiry on record so we can follow it up. It also reaches us by email through our email provider, which processes it in the United States. We won't add you to a mailing list unless you ask. See our privacy policy for how to access or correct your details, or to make a complaint.