KCSIE 2026 Changes: Filtering, Monitoring, AI and Mobile Phones
Keeping Children Safe in Education 2026 is not a draft any more. It went through public consultation in spring 2026, was published in July and has applied since 1 September 2026. This page covers what it changed for online safety, what KCSIE 2025 changed before it, and how the filtering and monitoring wording has grown since 2022.
- Draft consulted on
- 12 February to 22 April 2026
- Final published
- 7 July 2026, with the government response
- In force
- 1 September 2026
- Replaces
- KCSIE 2025
- Summary of changes
- Annex C of the 2026 edition
Is KCSIE 2026 published, or still a draft?
Searches for "KCSIE 2026 draft" still turn up consultation summaries from the spring. Those describe proposals. The final text is what applies now, so check any summary you rely on was written after July 2026.
How to tell a draft summary from a final one: drafts talk about "proposed" changes and refer to the consultation, often citing an annex of proposals. The final edition lists its changes in Annex C and says it applies from 1 September 2026.
KCSIE is statutory guidance for schools and colleges in England. Schools must have regard to it, so departing from it needs a good, recorded reason. Wales, Scotland and Northern Ireland have their own guidance.
Paragraph numbers moved in 2026. The filtering and monitoring section now sits in Part two under online safety. Quote the edition and paragraph together in your policies so readers can find the text.
Turn the new yearly review into a test you can repeat
KCSIE 2026 asks a named senior leader to check filtering on all devices in all relevant locations and keep a record. Our hosted CIPA filter gives that check one set of category rules to test against, whichever building or device you pick.
- One category list serves classrooms, library and guest Wi-Fi alike
- Activity reports and a policy record can sit in the review file
- A private encrypted link keeps the same rules on laptops used off site
What KCSIE 2025 changed for online safety
KCSIE 2025 was published for information on 7 July 2025 and came into force on 1 September 2025. It was a light revision overall, but three changes matter for filtering and monitoring.
Misinformation joins content risk
Misinformation, disinformation (including fake news) and conspiracy theories were added to the examples of content risk. Teaching and source judgement carry most of this, not blocking news.
Generative AI product safety link
The filtering and monitoring section linked to the DfE product safety guidance for generative AI, published in January 2025, which explains how filtering and monitoring apply to AI tools.
Self-assessment service
Schools were pointed to the DfE "Plan technology for your school" service to check themselves against the filtering and monitoring standards and get recommendations.
Cyber security wording
The description of the cyber security standards was clarified.
Alternative provision
More detail on written safeguarding confirmations, provider addresses and regular review of placements.
Guidance pending
The 2025 edition noted that revised guidance on relationships, sex and health education and on gender questioning children was expected.
For the earlier history, read KCSIE 2022 changes, KCSIE 2023 changes and KCSIE 2024 changes.
KCSIE 2026 filtering and monitoring: from "regularly" to a defined yearly review
The DfE's own summary of 2026 changes quotes the updated filtering and monitoring wording. In practice it turns the standards' annual review into a KCSIE expectation with a named owner and a record.
KCSIE 2025 position
- Governors make sure appropriate systems are in place.
- Effectiveness reviewed "regularly" in KCSIE, with the standards asking for at least annually.
- Who leads the review set out in the standards rather than KCSIE.
- No KCSIE statement on which devices and locations must be checked.
- Record keeping described in the standards.
KCSIE 2026 position
- Governors make sure appropriate systems are in place.
- A review of effectiveness at least once every academic year.
- Carried out by the senior leader responsible for filtering and monitoring, supported by the DSL and IT support.
- Checks that filtering works on all internet-connected devices in all relevant locations.
- A record kept of those checks.
A named owner
The review belongs to the senior leader responsible for filtering and monitoring. The DSL and IT support take part but do not lead.
All connected devices
Think beyond laptops: tablets, interactive screens, shared desktops, staff devices and anything else that reaches the internet.
All relevant locations
Classrooms, library, boarding areas, guest Wi-Fi, and take-home devices used off site where your provision covers them.
Who does what in the 2026 review
| Role | Part in the review | What to bring |
|---|---|---|
| Senior leader | Carries out and leads the review, and owns the actions that follow. | Last year's record, open actions, any changes to devices, sites or suppliers. |
| DSL | Supports the review with the safeguarding view of the year. | Trends from monitoring reports, incidents, over-blocking complaints and new risks. |
| IT support | Supports the review and runs the device and location checks. | Device inventory, filter profiles, test results and any unfiltered devices. |
| Link governor | Makes sure the standards are met and reports to the governing body. | Questions from the board and last year's findings. |
| Provider | Not named in KCSIE, but often needed for evidence. | Written confirmation of illegal content list integration and any configuration reports. |
Our filtering and monitoring annual review checklist includes a device and location test grid you can use as the record of checks.
What the filter can show your named owner
The hosted filter keeps separate settings for each school or branch in one console, with activity reports and a log export for the review record. Rules stay on laptops off the network through a private encrypted link, and nothing is installed on the computers.
The four Cs, updated for AI in 2026
The 2026 summary of changes lists "updated definitions of online risk categories". Comparing the text, the clearest additions bring AI into contact and conduct risk, and extend the content examples.
Content
Illegal, inappropriate or harmful material. Examples now include extreme sexual or physical violence alongside misinformation, disinformation and conspiracy theories.
Broader than 2023Contact
Harmful interaction with other users, or with generative AI applications that simulate this. Grooming and peer pressure remain examples.
AI addedConduct
Behaviour that increases the chance of harm, such as making or sharing explicit images, including those generated using AI, and online bullying.
AI imagery addedCommerce
Online gambling, inappropriate advertising, phishing and financial scams.
Unchanged in focusFiltering helps most with content and commerce, for example by blocking Adult, Gambling and Malware / Phishing / Suspicious sites. Contact and conduct risks need monitoring, teaching and the safeguarding process. See deepfake and NSFW AI filtering and AI companions in schools.
Generative AI, mobile phones and self-assessment in KCSIE 2026
Three topics now have their own place in the online safety part of the guidance. Each has a direct link to how a school sets up filtering.
Generative AI guidance
KCSIE points schools to the DfE guidance on generative AI in education for safety and legal considerations, whether tools are teacher-facing or pupil-facing.
Staff AI resources
It also points to DfE-backed online support materials for staff, highlighting the module on safeguarding, ethics, data protection and intellectual property risks.
AI product safety
The filtering and monitoring section keeps the link to the DfE product safety guidance for generative AI, which explains how filtering and monitoring apply to AI tools.
Phone-free by default
A new mobile phone section says schools should be mobile phone-free environments by default, with anything else only by exception, and refers to the statutory guidance on mobile phones in schools.
Plan technology service
Schools can self-assess against the filtering and monitoring standards using the DfE service and receive personalised recommendations.
Information security
The information security text was redrafted to place cyber security within wider safeguarding, with schools asked to consider the DfE cyber security standards.
Read our page on DfE generative AI guidance for schools for what the AI guidance and product safety standards mean for filter settings. Phone-free schools still need filtering on school devices and guest Wi-Fi, because phones are only one route online.
Where AI, gambling and bypass sites land in our categories
The 2026 wording on AI and commerce is easier to act on when you can see how real sites are labelled. A site that fits more than one group appears under several categories, so one switch can reach further than a typed list.
| Domain | Categories in our data | KCSIE risk area it touches |
|---|---|---|
| character.ai | AI / LLM Tools, Web-based Applications | Contact, through simulated conversation |
| midjourney.com | AI / LLM Tools | Conduct, where AI imagery is made and shared |
| bet365.com | Gambling, Sports & Recreation | Commerce |
| williamhill.com | Gambling | Commerce |
| protonvpn.com | VPN / Proxy / Anonymizers | A route round the filter that your review should test |
Other KCSIE 2026 changes worth knowing
The 2026 edition was a larger revision than 2024 or 2025. These changes are not about technology but will appear in any policy refresh.
| Area | What changed, in short | Why it matters for online safety |
|---|---|---|
| Condensed Annex A | Removed. All staff are expected to read Part one in full. | Staff training packs built on Annex A need replacing. |
| Family Help | Terminology updated to community-based early help and targeted early help through Family Help. | Referral routes for online harm follow the new terms. |
| Nudes and semi-nudes | Consistent wording on making or sharing nudes or semi-nudes, and all incidents require a safeguarding response. | AI-generated images are covered in the conduct risk definition. |
| Part five | Substantially rewritten around a continuum from harmful sexual behaviour to sexual violence. | Much of this behaviour happens on phones and apps. |
| DSL cover | Expectations for robust cover when the DSL is unavailable, for example a confidential shared mailbox. | Monitoring alerts must still reach someone when the DSL is away. |
| Data protection | Updated to reflect the Data (Use and Access) Act 2025. | Review the DPIA for filtering and monitoring logs. |
| Cybercrime | The further information on cybercrime was expanded, including Computer Misuse Act offences. | Hacking and bypass attempts can be safeguarding signals. |
| Parental support | The online safety section for parents links to screen time guidance. | Useful in parent communications about filtering. |
| Regulated activity | The supervision exemption was removed following the Crime and Policing Act 2026. | Volunteers helping with online learning may now be in regulated activity. |
KCSIE filtering and monitoring timeline, 2022 to 2026
One table to show governors how the expectations have grown. Dates are taken from the DfE publication history.
| Edition | Published | In force | Main filtering and monitoring change | Our page |
|---|---|---|---|---|
| 2022 | 20 May 2022 | 1 Sep 2022 | Paragraphs clarified: systems in place, effectiveness reviewed regularly, staff know how to escalate. Governor training includes online safety. | 2022 changes |
| 2023 | 6 Jun 2023 | 1 Sep 2023 | DSL lead role includes understanding filtering and monitoring. Staff training, child protection policy and the new DfE standards. | 2023 changes |
| 2024 | 24 May 2024 | 2 Sep 2024 | Little new filtering wording. Safeguarding definition includes harm online. Standards revised separately in October 2024. | 2024 changes |
| 2025 | 7 Jul 2025 | 1 Sep 2025 | Misinformation as content risk, generative AI product safety link, self-assessment service. | This page |
| 2026 | 7 Jul 2026 | 1 Sep 2026 | Yearly review led by the responsible senior leader with DSL and IT, checks on all connected devices and locations, records kept. AI in risk definitions. Phone-free by default. | This page |
Updating your school for KCSIE 2026
Tick these off as you go. The boxes are for your own use on this page and are not saved.
Making "all devices, all locations" checks easier
The 2026 review wording asks you to check filtering on every connected device in every relevant location. Consistent categories make those checks quick and the results comparable.
Same categories everywhere
When on-site and off-site filtering use the same category data, one test list works for every device and location.
Broad coverage
120 million domains in 58 web filtering categories, so fewer sites fall into "uncategorised" during testing.
AI tools tracked
11,800+ AI-tool domains in 18 categories, updated daily, to support the AI decisions in your review.
Category filtering is one layer. It does not monitor messages or behaviour and does not replace the IWF and police-assessed terrorism lists provided through accredited filtering providers. Concerns always go to the DSL through your safeguarding process. Explore the category database, our hosted DNS filter or the domain checker.
Running the 2026 review with and without a hosted filter
The rows follow what the named senior leader has to do before signing the yearly record.
| Review task | Collected by hand | Hosted CIPA filter |
|---|---|---|
| Checking all connected devices | Each device tested and noted separately | One DNS setting per site, so every device behind it follows the same rules |
| Take-home laptops | Depends on how each one is set up | A private encrypted link keeps the rules on devices off the network |
| Different settings per building | Several rule sets to compare | One console with separate settings per school or branch |
| Keeping the record | Screenshots and notes | Activity reports, a policy record and a log export |
| Staff who need a blocked page | A request, then someone must undo it | PIN bypass for 15, 30 or 60 minutes, logged, then it switches back |
| Bypass attempts | A list of proxy sites to keep up | VPN / Proxy / Anonymizers handled as a category, and kept blocked even with a PIN |
KCSIE 2026 changes: frequently asked questions
Is KCSIE 2026 published?
Yes. The DfE consulted on a draft from 12 February to 22 April 2026, published the final 2026 edition and its consultation response on 7 July 2026, and the 2026 edition came into force on 1 September 2026. It replaced KCSIE 2025.
What does KCSIE 2026 say about reviewing filtering and monitoring?
Governing bodies and proprietors should make sure a review of effectiveness is carried out at least once every academic year. The review is carried out by the senior leader responsible for filtering and monitoring, supported by the DSL and IT support, includes checks that filtering works on all internet-connected devices in all relevant locations, and is recorded.
What did KCSIE 2025 change?
KCSIE 2025, in force from 1 September 2025, added misinformation, disinformation and conspiracy theories to content risk, linked to the DfE generative AI product safety guidance under filtering and monitoring, and pointed schools to the Plan technology for your school service for self-assessment. Most other changes were technical.
Does KCSIE 2026 mention generative AI?
Yes. It points schools to the DfE guidance on generative AI in education and to support materials for staff, keeps the link to the generative AI product safety guidance, and updates the online risk definitions so that contact risk includes AI applications that simulate interaction and conduct risk includes explicit images generated using AI.
What does KCSIE 2026 say about mobile phones?
A new section says all schools should be mobile phone-free environments by default, with anything else by exception only, and refers to the statutory guidance on mobile phones in schools. Headteachers decide how to achieve this in their setting.
Do I need to rewrite my whole policy for KCSIE 2026?
Not usually. Most schools need targeted updates: the annual review wording and record keeping, online risk definitions, generative AI, mobile phones, DSL cover arrangements, Family Help terminology and anything that relied on the removed condensed Annex A.
Related guides
- KCSIE 2024 Changes: What Changed for Online Safety
- DfE Generative AI Guidance for Schools: What It Means for Filtering
- KCSIE Filtering and Monitoring: What Schools Must Do in 2026
- Filtering and Monitoring Annual Review Checklist for Schools
- Filtering for Multi-Academy Trusts: Central Policy, Local Checks
What you pay depends on how many schools and devices are in scope, and a quote comes back within one business day. A pilot on one site lets your senior leader see the blocks and reports before the next yearly review.
Talk to us about your school or trust
Preparing your first KCSIE 2026 review, or standardising filtering across a trust? We can show how consistent category data makes device and location checks simple to run and record.