Descant

guide · AI and student information · last reviewed 18 October 2026

Using AI with student information in ACT schools

ACT public schools follow the Education Directorate's position on the use of AI in ACT public schools, the ACT Government AI Policy and the Information Privacy Act 2014. This guide sets out what they say about student information.

At a glance

  • No student's personal information, including name, behaviour and learning capacity, may be entered into generative AI.
  • Staff may use generative AI for low to medium risk tasks, such as agendas, formatting and lesson materials.
  • Only tools that pass Directorate and whole-of-government assessments are endorsed.
  • The federal breach scheme does not generally cover ACT government agencies.

General information, not legal advice. Last reviewed 18 October 2026; rules change, so check the sources below and confirm with your department.

What the department says (government schools)

The position "applies to all generative AI tools used in ACT public schools and by all directorate staff". Generative AI "is available for staff to use for low to medium risk use cases", and staff "should refrain from using generative AI for high-risk use cases, such as personally identifiable data".

"No student's personal information, including but not limited to, their name, age, location, assessment work, behaviour and learning capacity, may be entered into generative AI." No exception for endorsed tools is stated.

The Minister's answer to a question on notice (December 2025): teachers use AI "under a human-in-the-loop model", "not to enter any sensitive or personally identifiable information", and "Only AI tools that meet Directorate and whole-of-government privacy, security and safety assessments are endorsed".

What the law says

  • Information Privacy Act 2014: 13 Territory Privacy Principles. The OAIC performs some ACT Information Privacy Commissioner functions under an arrangement with the ACT.
  • Health Records (Privacy and Access) Act 1997: governs health records.
  • Data breaches: "it is not mandatory for ACT agencies to comply with the NDB scheme", except for tax file number information (OAIC, 2023). ACT Government policy is to report significant privacy breaches to the OAIC voluntarily.
  • ACT Government AI Policy (May 2025): it applies where initiatives "Use generative AI capabilities, even if these capabilities are part of standard commercially available products", and "Directorates must manage AI risk through use of the assurance self-assessment tool".

"Any software application that requires sign-in also requires third-party permission forms."

A student trial of an AI notebook tool "requires parent or carer and student consent".

No public consent route lets student personal information go into generative AI. Consent does not lift the rule.

What staff can and can't put into AI

Staff can

  • Use generative AI for low to medium risk tasks, such as agendas, formatting and lesson materials
  • Use tools the Directorate has endorsed
  • Keep a person in the loop on all AI output
  • Write notes and reports themselves in software with AI switched off

Staff can't

  • Enter any student's personal information into generative AI
  • Enter a student's name, age, location, assessment work, behaviour or learning capacity
  • Use generative AI for high-risk uses such as personally identifiable data
  • Treat consent as an exception to the rule

Reports and family communication

No public rule on AI reports or family communication was found. The Minister's examples of medium-risk use include "formative assessment items"; nothing permits AI judgements about students.

Because student personal information cannot be entered, AI drafting of student-specific documents does not fit the position.

Approvals and assessments

StepWhat it involves
Directorate endorsementTools are endorsed after Directorate and whole-of-government privacy, security and safety assessments. The school does not classify the tool itself.
Permission formsSoftware that needs sign-in also needs third-party permission forms from families.
AI Policy self-assessment"Completed self-assessments must be submitted to the AIAG for contestability review." Directorates report AI initiatives twice a year for an AI register.
Staff risk matrixA risk matrix for teachers is on the internal ConnectED Service Portal.

Timelines. ACT Government AI Policy v1.0: May 2025 (page updated 17 March 2026). No published timeline for Directorate endorsement.

Catholic and independent schools

The position binds ACT public schools and Directorate staff. Catholic and independent schools follow the federal Privacy Act and its Notifiable Data Breaches scheme.

Check with Catholic Education Canberra-Goulburn, AISACT or your school board about AI rules. No public sector-wide AI rule was found for either.

The ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system.

Using Descant within these rules

ACT public schools use Descant with AI off. AI use would need the Directorate to change or waive the rule, most likely through a Directorate-led pilot.

AI is off unless your school adds it

Recording, AI drafting and AI summaries are an optional paid add-on, off unless your school adds them. A school can switch AI off at any time. With AI off, nothing about a student is sent to an AI model, and case management, referrals, support plans, consent records and notes staff write themselves keep working.

Require recorded parent consent before AI runs

With this setting on, AI processes a student's information only when the school has recorded consent from a parent or carer. In ACT government schools consent alone does not lift the department's position on identifiable information, so use it only once the department has approved AI use.

Documents families sign online (coming)

Families will be able to read and sign other school documents online. Parents and carers can already give consent through a secure link. No AI is involved in signing.

Staff review every AI draft

Drafts are labelled as AI-assisted, stay with the staff member, and are never sent to families automatically. Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.

See the ACT privacy compliance page for the privacy principles and assessment steps, how Descant keeps student data safe, our privacy policy, and note templates staff can write from with AI off.

Questions to ask your department

  1. Does "No student's personal information ... may be entered into generative AI" apply to a contracted, Australian-hosted tool used only by staff for record-keeping, which does not train on or keep data?
  2. Is there any route, such as endorsement or a pilot, under which staff may use AI to transcribe and draft notes about identified students?
  3. What does Directorate assessment involve for student support software with AI switched off, and how long does it take?
  4. Would Directorate use of AI features count as an "AI initiative" needing a self-assessment to the AI Advisory Group?
  5. Does the Health Records (Privacy and Access) Act 1997 apply to school wellbeing and disability notes?

Contact: [email protected] (Digital Strategy, Services and Transformation).

Sources

Each source was read on 18 October 2026. Dates are those shown on the page or document.

This guide is general information, not legal advice. It describes public rules as at 18 October 2026, and makes no claim that Descant is approved by any department.

Other states and territories

The national picture: frameworks, ST4S and the Privacy Act. Other guides in the series: Victorian schools, NSW schools, Queensland schools, South Australian schools, Western Australian schools, Tasmanian schools, Northern Territory schools.

Common questions

Something we haven't answered? Ask us and a person from the team will reply.

Ask a question
Can ACT public school staff put student information into an AI tool?

No. The Directorate's position says no student's personal information, including name, age, location, assessment work, behaviour and learning capacity, may be entered into generative AI.

Does the federal Notifiable Data Breaches scheme apply to ACT public schools?

Not generally. The OAIC says it is not mandatory for ACT agencies, except for tax file number information. ACT Government policy is to report significant breaches to the OAIC voluntarily. The scheme does apply to non-government schools.

Who decides whether a tool can be used?

The Directorate, after Directorate and whole-of-government privacy, security and safety assessments. Schools do not classify tools themselves.

Does parent consent change the AI rule?

No. Software that needs sign-in needs third-party permission forms, but the rule against entering student personal information into generative AI has no consent exception.

Talk to us about AI settings for your school

Tell us a little about your school and we'll show you how it would work for your team.

  • A made-up school like yours to explore for 14 days
  • We check each request by hand and reply within two school days
  • Made-up students only: no real student information needed

Prefer email? Write to [email protected].

(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.

What would you like help with? (optional)
Prefer a call? Tell us when you’re free

School days are busy. Tell us when you can actually pick up, in your school’s local time, and we’ll call then.

Days
Times

Descant is a business name of Grounded Scribe Pty Ltd. We collect these details only to reply to your enquiry and, if you ask, to call you. We keep your enquiry on record so we can follow it up. It also reaches us by email through our email provider, which processes it in the United States. We won't add you to a mailing list unless you ask. See our privacy policy for how to access or correct your details, or to make a complaint.