guide · AI and student information · last reviewed 18 October 2026
Using AI with student information in Western Australian schools
The Department of Education has no public generative AI policy for staff; its staff guidance is on its intranet. The public rules come from the Privacy and Responsible Information Sharing Act 2024, the Students Online in Public Schools procedures and the WA Government AI Policy and Assurance Framework.
At a glance
- The PRIS Act's privacy rules have applied to agencies, including public schools, since 1 July 2026; its breach scheme starts on 1 January 2027.
- Online services holding student information are checked against the staff-only Third Party Services Catalogue, or risk-assessed.
- AI-driven systems need the WA Government AI assurance self-assessment.
- Catholic and independent schools set their own rules.
General information, not legal advice. Last reviewed 18 October 2026; rules change, so check the sources below and confirm with your department.
What the department says (government schools)
No public Department of Education generative AI policy or staff guidance was found. Staff material is on Ikon, the staff intranet.
The Students Online in Public Schools procedures (v3.5, last updated 3 March 2023) tell site managers to "check the Third Party Services Catalogue on Ikon (staff only)" and, if a service is not listed, "request an online service risk assessment". They do not mention AI.
The Department's ClassmAIte pilot, a lesson-planning AI tool, was running in 60 schools in May 2026, with more than 100 expected by the end of 2026. The announcement says nothing about student data.
What the law says
- Privacy and Responsible Information Sharing Act 2024: 11 Information Privacy Principles. "Most of the privacy provisions of the PRIS Act will commence on 1 July 2026." It extends to contracted service providers.
- Breaches: "The notifiable information breach scheme will commence later, on 1 January 2027." Notification is due "As soon as reasonably practicable, but in any case within 30 days" of a reasonable suspicion.
- IPP 10 covers automated decisions: "ensuring appropriate safeguards are in place and that individuals can seek human intervention".
- Regulator: the Office of the Information Commissioner, established 1 July 2025.
Parent consent
Consent or notification follows "as specified in the Third Party Service Risk Report", with an annual parent process and "provisions to opt-out from using specific applications".
"Risk assessment and consent are not required for Department-provided online services."
No AI-specific consent rule was found.
What staff can and can't put into AI
Staff can
- Use services in the Third Party Services Catalogue, following its consent or notification advice
- Request a risk assessment for a service that is not listed
- Use AI for work that contains no personal information
- Write notes and reports themselves in software with AI switched off
Staff can't
- Use an unlisted online service holding student information without a risk assessment
- Skip the consent or notification level the Risk Report sets
- Use an AI-driven system without the AI assurance self-assessment
- Leave out the privacy impact assessment where the privacy impact is significant
Reports and family communication
No published limit on AI drafting reports or communicating with families was found.
IPP 10 requires safeguards for automated significant decisions and a way to seek human intervention. Descant drafts for staff and decides nothing, but ask the Department about documents shared with families.
Approvals and assessments
| Step | What it involves |
|---|---|
| Catalogue or risk assessment | Check the Third Party Services Catalogue (staff only), or request an online service risk assessment. |
| Consent or notification | Follow the Third Party Service Risk Report, using the procedures' notification and consent templates. |
| Privacy impact assessment | "Regulated entities are required to undertake a PIA where the performance of a function or activity involves the handling of personal information likely to have a significant impact on the privacy of individuals." |
| AI assurance | "Entities must use the self-assessment for any system or project that is driven by AI or automated decision making", whether "procured, built or otherwise sourced". Mid-range or higher residual risk goes to the AI Advisory Board. |
Timelines. PRIS Act privacy provisions: from 1 July 2026. Notifiable information breach scheme: from 1 January 2027. No published timeline for risk assessments.
Catholic and independent schools
Catholic Education Western Australia's AI Framework (v1.1, December 2024) says AI tools must be on its Approved Technology list, after review by CEWA.
AISWA's AI Guidelines for Schools 2024 page points schools to the Australian Framework for Generative AI in Schools.
Both sectors follow the federal Privacy Act and its Notifiable Data Breaches scheme.
Using Descant within these rules
In WA, ask the Department whether staff may use AI with student information, then follow the consent level the Risk Report sets; the consent setting can enforce it.
AI is off unless your school adds it
Recording, AI drafting and AI summaries are an optional paid add-on, off unless your school adds them. A school can switch AI off at any time. With AI off, nothing about a student is sent to an AI model, and case management, referrals, support plans, consent records and notes staff write themselves keep working.
Require recorded parent consent before AI runs
With this setting on, AI processes a student's information only when the school has recorded consent from a parent or carer. It works alongside any department approval your school needs.
Documents families sign online (coming)
Families will be able to read and sign other school documents online. Parents and carers can already give consent through a secure link. No AI is involved in signing.
Staff review every AI draft
Drafts are labelled as AI-assisted, stay with the staff member, and are never sent to families automatically. Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
See the WA privacy compliance page for the privacy principles and assessment steps, how Descant keeps student data safe, our privacy policy, and note templates staff can write from with AI off.
Questions to ask your department
- Do the Students Online procedures and the Catalogue cover staff-only tools that hold student information?
- Is there Department guidance on Ikon about staff entering student information or audio into third-party AI?
- Does a school-level purchase of AI-enabled software need the WA Government AI assurance self-assessment, and who submits it?
- Will the Department or the school complete the PRIS Act privacy impact assessment? Is there a template?
- What consent level would a staff-only AI note-drafting tool get in a Risk Report?
Contact: your school's ICT contact or the Department's privacy officer.
Sources
Each source was read on 18 October 2026. Dates are those shown on the page or document.
- OIC WA: privacy laws article (PDF) (April 2026)
- Students Online in Public Schools Procedures (v3.5, last updated 3 March 2023)
- WA Government AI Policy and Assurance Framework (updated 25 August 2026)
- ClassmAIte media statement (9 May 2026)
- AISWA: AI Guidelines for Schools 2024 (11 December 2023)
This guide is general information, not legal advice. It describes public rules as at 18 October 2026, and makes no claim that Descant is approved by any department.
Other states and territories
The national picture: frameworks, ST4S and the Privacy Act. Other guides in the series: Victorian schools, NSW schools, Queensland schools, South Australian schools, Tasmanian schools, Northern Territory schools, ACT schools.