guide · AI and student information · last reviewed 18 October 2026
Using AI with student information in NSW schools
NSW government schools follow the Department of Education's guidelines on generative AI, the PPIP Act and the HRIP Act. This guide sets out what they say about student information, and how a school can work within them.
At a glance
- Staff must not enter student work or personal, sensitive or confidential information into AI tools the Department has not reviewed.
- Some identifying information may be entered only into NSWEduChat and certain approved tools.
- Parent consent does not change that rule; Department approval does.
- Catholic and independent schools set their own rules.
General information, not legal advice. Last reviewed 18 October 2026; rules change, so check the sources below and confirm with your department.
What the department says (government schools)
The Guidelines regarding the use of generative AI (updated 13 October 2026) say staff have access to free AI tools "not yet reviewed by the department", and must use professional judgement, "including not inputting student work or personal, sensitive or confidential information".
They add: "Ensure no private or sensitive information about individuals or the department is entered into AI tools." The Department recommends NSWEduChat, "built by the department for safe and secure use".
"Other tools may be approved for use once the department has assessed cyber security, safety and ethical risks." And: "Note for NSWEduChat and certain approved tools, some personal identifying information may be entered as data is secured."
More detailed AI guidelines for staff sit behind the Department's login and could not be read for this guide.
What the law says
- Privacy and Personal Information Protection Act 1998: 12 Information Protection Principles, regulated by the Information and Privacy Commission (IPC).
- Health Records and Information Privacy Act 2002: health information, which the Department's legal bulletin says includes "mental health or a disability".
- Mandatory Notification of Data Breach scheme: in effect since 28 November 2023 for NSW public sector agencies, including government schools.
- NSW AI Assessment Framework: "All NSW Government agencies must comply with the NSW AI Operational Policy and apply the AI Assessment Framework when required." This binds the Department as an agency, not individual schools.
Parent consent
The Audit Office (June 2026) reports that the Department "requires schools to obtain product specific parental consent when using a third-party product outside the marketplaces", using Department templates.
For free tools, staff check Assessed IT "to confirm if parental consent is required".
"Generally, the department is required to obtain consent before making recordings of students, though some exceptions apply."
No public AI-specific consent rule was found. Consent does not lift the guideline on entering personal information into tools the Department has not reviewed.
What staff can and can't put into AI
Staff can
- Use NSWEduChat as the Department recommends
- Enter some identifying information into NSWEduChat and certain approved tools
- Use AI for work that contains no personal, sensitive or confidential information
- Write notes and reports themselves in software with AI switched off
Staff can't
- Enter student work into AI tools the Department has not reviewed
- Enter personal, sensitive or confidential information into those tools
- Enter private or sensitive information about individuals into AI tools
- Treat a tool as approved before the Department has assessed it
Reports and family communication
The public guidelines say nothing specific about reports, judging achievement or communicating with families. The general rule is careful human review of AI output.
The staff-only guidelines may say more. Check them before using AI for anything that goes home.
Approvals and assessments
| Step | What it involves |
|---|---|
| Marketplaces first | From Term 3 2025, schools "must only purchase online learning tools from contracted suppliers" on the Online Learning Tools Marketplace. Student administration products are outside it and sit with the Administration Marketplace for Schools. |
| Outside the marketplaces | The Audit Office notes schools can contract with vendors outside the marketplaces. The Department expects an Assessed IT check (ratings "allowed", "use with caution" or "do not use") and product-specific parental consent. |
| Due diligence and privacy | The Department provides a due diligence vendor checklist. A privacy impact assessment is recommended by the IPC; the Audit Office notes PIAs are "not mandatory under legislation". |
| AI approval | The Department assesses "cyber security, safety and ethical risks" before an AI tool is approved, and registers AI use cases on the AIAF Platform. |
Timelines. From 30 September 2026, agencies use the AIAF Platform for all new AI use case registrations and assessments. The Audit Office's recommendations, including a risk-based approach to privacy impact assessments, are due by July 2027. No published timeline for AI tool approval.
Catholic and independent schools
The Department's guidelines and the AI Assessment Framework bind government schools and the Department. Catholic and independent schools follow the federal Privacy Act and their own rules.
NSW Catholic dioceses set their own rules; some endorse specific AI tools for staff. CEnet published a Framework for the Use of Generative AI in Catholic Education (2024), and a national Catholic AI governance framework is in draft (2026).
Independent Schools NSW (formerly AISNSW) has an AI Implementation Framework and an AI Tools Endorsement Scale for members (members only).
Using Descant within these rules
Descant is not currently a Department-approved AI tool, so NSW government schools use it with AI off unless the Department assesses and approves its AI features.
AI is off unless your school adds it
Recording, AI drafting and AI summaries are an optional paid add-on, off unless your school adds them. A school can switch AI off at any time. With AI off, nothing about a student is sent to an AI model, and case management, referrals, support plans, consent records and notes staff write themselves keep working.
Require recorded parent consent before AI runs
With this setting on, AI processes a student's information only when the school has recorded consent from a parent or carer. In NSW government schools consent alone does not lift the department's position on identifiable information, so use it only once the department has approved AI use.
Documents families sign online (coming)
Families will be able to read and sign other school documents online. Parents and carers can already give consent through a secure link. No AI is involved in signing.
Staff review every AI draft
Drafts are labelled as AI-assisted, stay with the staff member, and are never sent to families automatically. Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
See the NSW privacy compliance page for the privacy principles and assessment steps, how Descant keeps student data safe, our privacy policy, and note templates staff can write from with AI off.
Questions to ask your department
- How does a vendor apply to have its AI features assessed, so it becomes one of the "certain approved tools"? What is the timeline?
- Do the staff-only guidelines add rules on audio recordings, health and wellbeing information, reports to parents or judging achievement?
- Is a student wellbeing and case-management tool in scope for the Administration Marketplace for Schools, and when is the next intake?
- With AI switched off for the whole school, is the tool treated as ordinary software, outside the generative AI guidelines?
- What consent is needed to audio-record a support session with a student for transcription?
Contact: [email protected], or your school's Digital Learning or ITD contact.
Sources
Each source was read on 18 October 2026. Dates are those shown on the page or document.
- Guidelines regarding the use of generative AI (updated 13 October 2026)
- Audit Office NSW: Security and privacy of student information (tabled 29 June 2026)
- Technology 4 Learning news, issue 122 (page updated 11 June 2026)
- NSW AI Assessment Framework (read 18 October 2026)
- Privacy and the use of third-party web and cloud-based services (page dated February 2023)
This guide is general information, not legal advice. It describes public rules as at 18 October 2026, and makes no claim that Descant is approved by any department.
Other states and territories
The national picture: frameworks, ST4S and the Privacy Act. Other guides in the series: Victorian schools, Queensland schools, South Australian schools, Western Australian schools, Tasmanian schools, Northern Territory schools, ACT schools.