What is harmful sexual behaviour, and how should schools respond to child-on-child abuse?

Child-on-child abuse

Keeping children safe in education (KCSIE) 2026 says all staff should know that children can abuse other children, that it can happen inside and outside school and online, and that it is a safeguarding issue for both the victim and the alleged perpetrator (paragraphs 31 and 35). Staff should be clear on the school’s policy and speak to the designated safeguarding lead (DSL) or a deputy whenever they have a concern (paragraph 33).

Paragraph 37 lists the forms it most often takes:

• bullying, including cyberbullying and prejudice-based bullying
• discriminatory behaviour, including racism and faith-targeted abuse
• abuse in children’s intimate relationships
• physical abuse, and serious assault or the threat of harm with a weapon
• sexual violence and sexual harassment, including online
• causing someone to engage in sexual activity without consent
• making or sharing nudes and semi-nudes
• upskirting
• initiation or hazing

KCSIE warns that dismissing behaviour as “banter”, “part of growing up” or “boys being boys” can lead to a culture of misogyny and an unsafe environment, where children come to accept abuse as normal and stop reporting it (paragraph 34). Even if there are no reports in a school, it doesn’t mean it isn’t happening.

What KCSIE 2026 changed

Part five, on child-on-child sexual harassment and sexual violence, has been “substantially rewritten to highlight the progressive continuum from harmful sexual behaviour through to sexual violence”. It now:

• opens with how schools should respond to “all signs, reports and concerns” of HSB, not just sexual harassment and violence (paragraph 529)
• asks schools to recognise “the escalatory nature of misogyny” and the value of early identification (paragraph 530)
• says every incident of nude or semi-nude image sharing needs a safeguarding response, consensual or not (paragraph 530)
• adds a section on HSB and its continuum (paragraphs 534 to 538)
• adds a new route, referral to Family Help (paragraphs 585 to 595)

The expanded examples: AI images, hazing and “banter”

Annex C says KCSIE 2026 expanded the child-on-child abuse content in Part one to stress that it is a safeguarding issue for both the victim and the alleged perpetrator, that it is preventable, and that it may involve serious physical harm or threats with weapons (paragraphs 35 to 37). Three examples matter most for day-to-day practice:

• AI-generated sexual imagery. A new explainer in “About this guidance” says nudes and semi-nudes include images that are “digitally altered or wholly generated using artificial intelligence”, including so-called “deepfakes” or “deep nudes”. The list in paragraph 37 covers “consensual and non-consensual making or sharing of nudes and semi-nudes”, and the policy list in paragraph 193 adds “including those generated using AI”. So a fake image of a pupil made by another pupil is handled as child-on-child abuse, not just an online-safety or behaviour issue. Staff should not view or forward it (see sharing nudes and semi-nudes). KCSIE also lists the CEOP and Internet Watch Foundation guidance on AI-generated child sexual abuse material among its further resources.
• Initiation and hazing. Paragraph 37 lists “initiation/hazing type violence and rituals”, meaning harassment, abuse or humiliation used to initiate someone into a group, which “may also include an online element”. Paragraph 193 repeats it in the list the child protection policy must cover. Think about sports teams, clubs, year-group traditions and group chats.
• “Banter”. Paragraph 34 says that dismissing sexual harassment as “just banter”, “just having a laugh”, “part of growing up” or “boys being boys” can lead to a culture that normalises abuse, so children stop reporting it. The same words appear in the zero-tolerance statement the policy should include (paragraph 193) and in Part five (paragraph 530).

Paragraph 32 also asks all staff to recognise that racism, faith-targeted abuse and other discriminatory behaviour can have a significant impact on a child’s welfare, and to treat it as a safeguarding matter where appropriate.

Harmful sexual behaviour and the continuum

KCSIE says HSB is an umbrella term for behaviour online, face to face or both, and “should always be considered within a child protection context” (paragraph 534).

Children’s sexual behaviour sits on a wide continuum, “ranging from normal and developmentally expected to inappropriate, problematic, abusive or violent” (paragraph 535). This is the Hackett continuum, which the NSPCC uses in its HSB framework. Behaviour that is problematic, abusive or violent is developmentally inappropriate.

Age and development are critical when judging behaviour. Sexual behaviour between children may be harmful if there is a significant age gap, typically more than two years, or if one child is pre-pubescent and the other is not. A younger child can still abuse an older one if they hold power, for example because of a disability or size (paragraph 536).

HSB can progress along the continuum, and early action on behaviour such as misogyny can stop it escalating to sexual harassment or violence. KCSIE also notes that children who display HSB have often experienced abuse and trauma themselves and should be offered support (paragraph 538).

Responding to a report

Paragraph 558 sets out good practice for the member of staff who hears a report:

• if possible, have two staff present, one of them the DSL or a deputy
• don’t view or forward illegal images of a child
• don’t promise confidentiality
• listen, use the child’s own language, and ask only open questions
• write a record as soon as you can, of what the child said, without your own interpretation
• tell the DSL straight away if they weren’t there

After a report of sexual violence, the DSL should carry out an immediate risk and needs assessment covering the victim, other possible victims, the alleged perpetrator, the wider school and the place where it happened. For sexual harassment, the need for one is decided case by case (paragraph 568).

Where rape or assault by penetration is reported, the alleged perpetrator should be removed from any shared classes with the victim while the facts are established. KCSIE says this is not a judgement on guilt.

Four ways to manage a report

The DSL leads the decision, considering the victim’s wishes, the nature of the incident, the children’s ages and development, any power imbalance, whether it is a one-off or a pattern, and wider risks such as exploitation (paragraph 571). Paragraph 574 sets out four common routes:

1. Manage internally. For example, one-off incidents of HSB or sexual harassment, using the behaviour policy and pastoral support.
2. Universal services and community-based early help. Support for the children without a referral to statutory services. This can be combined with managing internally.
3. Referral to Family Help, including targeted early help and children’s social care. Where a child has been harmed, is at risk of harm or is in immediate danger, refer to children’s social care.
4. Report to the police. For rape, assault by penetration or sexual assault, the starting point is to pass it to the police, usually alongside a referral to children’s social care. This still applies if the alleged perpetrator is under 10, and the police take a welfare approach (paragraph 598).

Schools should not wait for a social care or police investigation before protecting the children involved, but should work with those agencies so as not to jeopardise it.

Recording

Under every route, KCSIE repeats the same line: “All concerns, discussions, decisions and their rationale should be clearly recorded in writing.” Risk and needs assessments should be recorded and reviewed regularly too.

Record what happened and what was said, in the child’s words, rather than labels. Describe the behaviour, and leave conclusions about the child to the DSL’s assessment. Keep the record on each child’s safeguarding file, so a pattern can be seen over time.

Policy

The child protection policy should cover child-on-child abuse, including how reports are recorded, investigated and dealt with, how all children involved are supported, a zero-tolerance statement, and the school’s approach to sharing nudes, including AI-generated images (paragraph 193).