Descant

guide · AI and student information · last reviewed 18 October 2026

Using AI with student information in Queensland schools

No public Department of Education generative AI policy for staff was found. In Queensland state schools the rules come from Queensland Government guidance on generative AI, the Department's procedure for non-departmental services and its consent rules. This guide brings them together.

At a glance

  • Queensland Government guidance says personal information should not go into generative AI tools not approved by your department.
  • The approved online services scheme starting 25 October 2026 does not cover services that need sensitive information, such as wellbeing or disability details; they still need valid consent.
  • FAIRA, the Foundational AI Risk Assessment, is for departments evaluating AI solutions; it is not required for every tool.
  • Catholic and independent schools set their own rules.

General information, not legal advice. Last reviewed 18 October 2026; rules change, so check the sources below and confirm with your department.

What the department says (government schools)

The QGEA guideline Use of generative AI in Queensland Government (updated 7 August 2025, non-mandated) says personal information "should not be shared with, input, or uploaded to generative AI products and services not approved for use by your department". Staff are "responsible for any AI-generated content" they use.

The Department's own AI tool for schools, Corella, keeps data "stored locally in Australia". Its privacy statement still says users "should not enter any personal information into the Corella application".

Unlike Victoria and the Northern Territory, no Queensland rule was found that bans personal information in tools the department has approved.

What the law says

  • Information Privacy Act 2009, as amended in 2023: the Queensland Privacy Principles (QPPs), regulated by the Office of the Information Commissioner.
  • Mandatory notification of data breaches has applied to departments since 1 July 2025. A breach at a contracted provider "may be a data breach of the agency".
  • Agencies must bind some contracted service providers to the QPPs.
  • QGEA AI governance policy (mandated, v2.0.0, August 2026): agencies "must align to Australia's AI Ethics Principles by applying the FAIRA", and when evaluating AI solutions prepare a FAIRA "or an agreed equivalent".

Parent consent

From 25 October 2026, schools can use approved online services "without requiring individual consent". But "Where an online service requires the disclosure of sensitive information, valid consent will still be required."

Under the new section 426A, a service that needs sensitive information about a student cannot be an approved online service. Student wellbeing, health and disability records are sensitive information, so the consent route applies.

Consent must be voluntary and current, and parents can revoke it (consent procedure, November 2025). No AI-specific consent rule was found.

What staff can and can't put into AI

Staff can

  • Use AI tools approved by the department
  • Use AI for work that contains no personal information
  • Use services that passed an information security assessment, with consent where needed
  • Write notes and reports themselves in software with AI switched off

Staff can't

  • Enter personal information into generative AI tools not approved by the department
  • Store or transmit SENSITIVE or PROTECTED information offshore
  • Use a non-departmental service without an information security assessment
  • Treat AI-generated content as someone else's responsibility

Reports and family communication

No explicit Queensland rule was found on AI writing reports for parents, judging achievement or communicating with families. The QCAA's AI page was unavailable on 18 October 2026.

The QGEA guideline makes staff responsible for any AI-generated content they use or share. Ask the Department and the QCAA before using AI for anything that goes home.

Approvals and assessments

StepWhat it involves
Information security assessment"Any other procurement of a non-departmental ICT service must also undertake an information security assessment" (Online Service Risk Review). Schools "should annually review these services".
ConsentPrincipals "accept responsibility for the personal information held in the service, which includes ensuring informed consent is gained".
ContractThe provider is bound to the QPPs as a contracted service provider, with terms on prompt breach reporting.
FAIRA (Department level)The Department prepares a FAIRA "or an agreed equivalent" when evaluating AI solutions; FAIRA LITE suits low-risk trials. Whether a school's purchase triggers one is for the Department to say.

Timelines. Approved online services scheme: from 25 October 2026. AI governance policy v2.0.0 (August 2026) and FAIRA framework v2.0.0 (September 2026) were reissued recently. No published timeline for information security assessments.

Catholic and independent schools

Catholic Education Queensland Ltd (CEQL) replaced QCEC on 1 January 2026; each of the five dioceses sets its own rules. Brisbane Catholic Education's privacy statement says its schools use AI systems provided by third parties.

Independent Schools Queensland offers AI resources for members; each school sets its own policy.

Both sectors follow the federal Privacy Act, and the ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system.

Using Descant within these rules

In Queensland, consent and department approval work together: check whether the department treats Descant's AI as approved, and get express consent for sensitive information.

AI is off unless your school adds it

Recording, AI drafting and AI summaries are an optional paid add-on, off unless your school adds them. A school can switch AI off at any time. With AI off, nothing about a student is sent to an AI model, and case management, referrals, support plans, consent records and notes staff write themselves keep working.

Require recorded parent consent before AI runs

With this setting on, AI processes a student's information only when the school has recorded consent from a parent or carer. It works alongside any department approval your school needs.

Documents families sign online (coming)

Families will be able to read and sign other school documents online. Parents and carers can already give consent through a secure link. No AI is involved in signing.

Staff review every AI draft

Drafts are labelled as AI-assisted, stay with the staff member, and are never sent to families automatically. Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.

See the Queensland privacy compliance page for the privacy principles and assessment steps, how Descant keeps student data safe, our privacy policy, and note templates staff can write from with AI off.

Questions to ask your department

  1. Is there a departmental generative AI procedure for staff, and does it allow identifiable student information in an assessed, Australian-hosted third-party tool?
  2. Does a school's use of a vendor tool with built-in AI trigger a departmental FAIRA? Who completes it, and is FAIRA LITE or an agreed equivalent acceptable?
  3. What does the Online Service Risk Review need from a vendor, and how long does it take?
  4. Does any Department or QCAA rule limit AI drafting of reports for parents, or AI in judgements of achievement?
  5. Would an "AI off" setup be treated as a non-AI service?

Contact: your school's ICT and privacy contacts in the Department of Education.

Sources

Each source was read on 18 October 2026. Dates are those shown on the page or document.

This guide is general information, not legal advice. It describes public rules as at 18 October 2026, and makes no claim that Descant is approved by any department.

Other states and territories

The national picture: frameworks, ST4S and the Privacy Act. Other guides in the series: Victorian schools, NSW schools, South Australian schools, Western Australian schools, Tasmanian schools, Northern Territory schools, ACT schools.

Common questions

Something we haven't answered? Ask us and a person from the team will reply.

Ask a question
Can Queensland state school staff put student information into an AI tool?

Queensland Government guidance says personal information should not go into generative AI tools not approved by your department. No public rule was found banning it in approved tools, but even the Department's own tool, Corella, asks users not to enter personal information. Check the Department's approval position first.

Is a FAIRA needed for every AI tool?

No. FAIRA is the Foundational AI Risk Assessment. The mandated AI governance policy asks departments evaluating AI solutions to prepare one "or an agreed equivalent"; the FAIRA framework itself is non-mandated. Ask the Department whether your use needs one.

Do we need parent consent?

For a service holding wellbeing, health or disability information, yes. The approved online services scheme from 25 October 2026 excludes services that need sensitive information, so "valid consent will still be required".

Does this apply to Catholic and independent schools?

The Queensland Government rules bind departments and state schools. Catholic and independent schools follow the federal Privacy Act and their own rules.

Talk to us about AI settings for your school

Tell us a little about your school and we'll show you how it would work for your team.

  • A made-up school like yours to explore for 14 days
  • We check each request by hand and reply within two school days
  • Made-up students only: no real student information needed

Prefer email? Write to [email protected].

(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.

What would you like help with? (optional)
Prefer a call? Tell us when you’re free

School days are busy. Tell us when you can actually pick up, in your school’s local time, and we’ll call then.

Days
Times

Descant is a business name of Grounded Scribe Pty Ltd. We collect these details only to reply to your enquiry and, if you ask, to call you. We keep your enquiry on record so we can follow it up. It also reaches us by email through our email provider, which processes it in the United States. We won't add you to a mailing list unless you ask. See our privacy policy for how to access or correct your details, or to make a complaint.