Filtering and monitoring in schools

The duty in one paragraph

Keeping children safe in education (KCSIE) 2026 says governing bodies and proprietors should do all they reasonably can to limit children’s exposure to online risks from the school’s IT system. They should make sure the school has appropriate filtering and monitoring systems and that a review of their effectiveness is carried out at least once every academic year (paragraph 173).

KCSIE 2026, in force since 1 September 2026, adds detail on how that review happens. It should be carried out by “the SLT member responsible for filtering and monitoring, with the support of the school’s designated safeguarding lead and IT support”. It should include checks that filtering is working on all internet-connected devices in all relevant locations, and “a record should be kept of these checks”.

What counts as “appropriate” is for each school to decide, informed partly by its Prevent duty risk assessment (paragraph 174). KCSIE also warns against “over blocking” that unreasonably restricts what children can be taught (paragraph 163).

Filtering and monitoring: the difference

The DfE’s filtering and monitoring standards define the two terms:

Filtering is preventative. It blocks access to illegal, inappropriate and potentially harmful content, including AI-generated content.
Monitoring is reactive. It shows what users are doing on devices and raises reports or alerts. It doesn’t block anything. Monitoring includes staff watching screens as they walk round a classroom, as well as software.

The standards also say that no filtering system is 100% effective, so staff supervision still matters.

The four standards

KCSIE paragraph 175 summarises the DfE’s standards. Schools should:

identify and assign roles and responsibilities to manage filtering and monitoring systems
review filtering and monitoring provision at least annually
block harmful and inappropriate content without unreasonably affecting teaching and learning
have effective monitoring strategies that meet their safeguarding needs

The standards page says schools “should already be meeting” all four.

Who does what

Role	What the DfE standards give them
Governors or proprietor	Overall strategic responsibility. Name a senior leader and a governor responsible for meeting the standards.
Senior leadership team	Scope needs, including generative AI. Buy the systems, document what is blocked or allowed and why, review effectiveness and oversee reports. Make sure staff are trained and act on reports.
Designated safeguarding lead	Lead on safeguarding and online safety. Check reports, respond to safeguarding concerns that filtering and monitoring raise, and give governors assurance that the systems work and are reviewed.
IT support, in-house or contracted	Maintain the systems, provide reports and complete actions after concerns or checks. Help with buying, risk, reviews and checks.
All staff	Supervise pupils on devices, and report anything that gets through, is wrongly blocked or seems broken.

KCSIE says the DSL’s lead responsibility includes “online safety and understanding the filtering and monitoring systems and processes in place”, and that this should be explicit in the job description (paragraph 127 and Annex B).

Filtering and monitoring isn’t only the IT provider’s job. KCSIE says all staff should get safeguarding training at induction that includes “an understanding of the expectations, applicable roles and responsibilities in relation to filtering and monitoring” (paragraphs 12 and 153), and online safety updates at least annually (paragraph 154).

Policies and parents

KCSIE says the school’s approach to online safety should be reflected in its child protection policy, which should include appropriate filtering and monitoring on school devices and school networks (paragraph 169). The DfE standards add that monitoring procedures should be reflected in the acceptable use policy and other relevant policies, such as privacy notices, and that pupils, staff, parents and carers should know about them.

KCSIE also suggests telling parents and carers what systems the school uses to filter and monitor online use (paragraph 172).

What the standards expect of the system

Neither KCSIE nor the DfE standards name approved products. KCSIE says what is appropriate is a matter for each school (paragraph 174), and the standards set requirements any system should meet. The main ones:

The filtering provider should be a member of the Internet Watch Foundation (IWF), signed up to the Counter-Terrorism Internet Referral Unit (CTIRU) list, and update its blocklists from both. No one in the school or trust, including system administrators, should be able to disable or override those blocklists.
Filtering should apply to school-managed devices, including those taken off site, unmanaged devices under a bring-your-own-device scheme, and guests using the school internet. Devices the school doesn’t manage should be on a separate network.
There should be at least separate pupil and staff filtering profiles, not one blanket setting.
Any temporary exception, such as for a system update, must be approved and documented by the senior leader responsible, and the DSL should assess the safeguarding implications.

For what “appropriate” filtering and monitoring means in practice, KCSIE points to the UK Safer Internet Centre’s guidance and SWGfL’s provider checking tool (paragraph 177).

The annual review: a checklist

The standards say the review should involve the senior leadership team, the DSL, IT support and the responsible governor. It should look at:

the pupils’ risk profile, including age, special educational needs and English as an additional language
what the filter currently blocks or allows
how technology is used, including any bring-your-own-device policy
where generative AI products are used in school
technical limits, such as whether the system can handle real-time, dynamic, personalised or AI-generated content
outside influences such as county lines, and any relevant safeguarding incidents
what the curriculum needs, for example in RSHE and PSHE
related policies, including how temporary exceptions are approved
what checks happen now and how actions are followed up

Record the results and actions. The standards say the record should be available to anyone entitled to inspect it. Review again, between annual reviews, when a safeguarding risk is found, working practice changes, new devices or AI tools arrive, or there are major software or network changes.

Checks and the log

Checks are part of the review. How often they happen depends on the school’s risks. They should confirm that filtering covers school-owned devices (including those taken home), every site, and the right content for pupil, staff and guest accounts. Keep a log of when each check took place, who did it, what was tested and what action followed. The standards suggest using a testing tool, such as the one from SWGfL, to confirm that illegal child abuse content, terrorist content and adult content are blocked.

Monitoring reports

The standards say a monitoring plan should, as a minimum, include weekly reports highlighting incidents, and immediate reports for high-risk incidents. Pupils and staff should know monitoring is in place.

Generative AI

KCSIE 2026 widens its description of online risk. The “contact” risk now includes harmful interaction with “generative AI applications that simulate this”, and the “conduct” risk includes explicit images “generated using AI” (paragraph 165). It points schools to the DfE’s guidance on generative AI in education and its AI resources for staff (paragraphs 167 and 168).

The filtering and monitoring standards say schools should consider whether they need a system that can handle AI-generated content. Schools introducing a generative AI product should assess the risks against the DfE’s Generative AI: product safety standards. Those standards expect AI products to have filtering built in that holds for a whole conversation, to log prompts and responses, and to alert the DSL to possible safeguarding disclosures.

KCSIE also suggests the DfE’s “Plan technology for your school” service for self-assessing against the standards (paragraph 176).

For the other changes in KCSIE 2026 and which parts each member of staff must read, see our guide to KCSIE 2026: who needs to read what.

Common questions

What is filtering and monitoring in safeguarding in schools?

Filtering blocks access to illegal, inappropriate and potentially harmful content on the school's IT system, including AI-generated content. Monitoring shows what users are doing on devices and raises reports or alerts, but doesn't block anything. KCSIE 2026 treats both as part of a school's safeguarding duty to limit children's exposure to online risks, and the DfE's filtering and monitoring standards set out what good looks like.

Who is responsible for filtering and monitoring in schools?

Governing bodies and proprietors have overall strategic responsibility. The DfE standards say they should name a member of the senior leadership team and a governor to make sure the standards are met. The DSL leads on safeguarding and online safety, including acting on what filtering and monitoring finds, and IT support, in-house or contracted, maintains the systems and provides reports.

How often should schools review filtering and monitoring?

At least once every academic year (KCSIE 2026 paragraph 173). The DfE standards also say to review when a safeguarding risk is identified, working practice changes, new technology such as generative AI tools is introduced, major software updates happen, or the network or device set-up changes. Checks on the filtering happen in between, as often as the school's risks suggest, and are logged.

What does KCSIE 2026 say about filtering and monitoring?

Paragraph 173 says governing bodies and proprietors should make sure there are appropriate filtering and monitoring systems and that their effectiveness is reviewed at least once every academic year, by the senior leader responsible with the DSL and IT support. Reviews should include checks that filtering works on all internet-connected devices in all relevant locations, and a record of those checks should be kept.

What does KCSIE 2026 say about generative AI?

It names generative AI applications that simulate harmful contact as an online risk, and includes explicit images generated using AI. It points schools to the DfE's guidance on using generative AI in education and to its generative AI product safety standards, which explain how filtering and monitoring apply to AI tools.

Is the DSL responsible for filtering and monitoring?

The DSL takes lead responsibility for safeguarding and child protection, including online safety and understanding the filtering and monitoring systems in place, and this should be in their job description. The DSL does not run the systems. IT support does that, and a named senior leader is responsible for the review.

What are the new changes to KCSIE 2026?

For filtering and monitoring, KCSIE 2026 now says who carries out the annual review (the responsible senior leader, with the DSL and IT support), that it should include checks on all internet-connected devices, and that a record of the checks should be kept. Elsewhere it adds generative AI to the online risks, a new mobile phone policy section, Family Help, and changes to regulated activity. Our guide to KCSIE 2026: who needs to read what covers the wider changes.

Sources

Keeping children safe in education 2026 (DfE, statutory guidance, in force from 1 September 2026): paragraphs 12, 127, 153, 163 to 177 and Annex B. Last checked 20 October 2026.
Filtering and monitoring standards for schools and colleges (DfE, Meeting digital and technology standards, updated 16 September 2026). Last checked 20 October 2026.
Generative AI: product safety standards (DfE, updated 19 January 2026). Last checked 20 October 2026.
Appropriate filtering and monitoring (UK Safer Internet Centre). Last checked 20 October 2026.

This guide explains the official guidance in plain words. It isn’t legal advice. Your local safeguarding partnership’s procedures and your own policies also apply. If anything here is wrong or out of date, email support@pupilprotect.co.uk.

What do schools have to do about filtering and monitoring?