KCSIE Filtering and Monitoring: What Schools and Colleges Need to Do
Keeping Children Safe in Education sets the safeguarding expectations for every school and college in England. This guide explains what it says about filtering and monitoring, who is responsible, and how to show you are meeting it.
The short version
A filter whose settings and reports your board can read
KCSIE leaves the choice of technology to you, but expects the governing body to be sure the system works. Our hosted CIPA filter is a DNS filter we run, so the categories blocked for each school are visible in one console.
- Adult and VPN/Proxy/Anonymizers are on in the preset, with other categories chosen by you
- Always-allow and always-block lists let a school fix over-blocking without waiting
- Reports and a policy record answer the governors' questions about what was blocked
How KCSIE filtering and monitoring has changed
Filtering and monitoring has moved from a short mention to a clear set of expectations over recent editions. Knowing the history helps you explain to governors why the review process looks the way it does.
Filtering and monitoring become a named responsibility
- The DSL's lead role for safeguarding is described as including online safety and understanding the filtering and monitoring in place.
- Staff training is expected to cover filtering and monitoring roles and expectations.
- Schools are pointed to the newly published DfE filtering and monitoring standards.
Mostly consolidation
- Few changes to filtering and monitoring. Schools used the year to embed the 2023 expectations and the new standards.
Misinformation and generative AI enter the picture
- Misinformation, disinformation and conspiracy theories are listed among content risks.
- A link to the DfE expectations for generative AI products shows that filtering and monitoring apply to AI tools too.
- Schools are signposted to the DfE self-assessment service for checking technology against the standards.
A yearly review with a senior owner
- Reviewing effectiveness at least once every academic year is now spelled out rather than left as "regularly".
- A senior leader is responsible for filtering and monitoring and leads the review, supported by the DSL and IT.
- AI-generated material, including deepfake imagery, is treated as a safeguarding concern that policies should cover.
Editions are refreshed most summers. Check the current guidance on the official page before you rewrite your policy, and note the edition in your review record.
Where filtering and monitoring sits inside KCSIE
Filtering and monitoring is part of the online safety section, which itself sits inside the whole-school approach to safeguarding. Each layer depends on the one above it.
What KCSIE says about filtering and monitoring, in our words
KCSIE does not specify technology. It sets out outcomes and leaves schools to choose how to achieve them. These are the expectations most schools need to evidence.
Limit exposure to risk
Governing bodies should do what they reasonably can to reduce children's exposure to online risk from school IT systems.
Keep it proportionate
Protection should not tip into blocking so much that teaching suffers. Over-blocking is treated as a problem to manage, not a safe default.
Base it on risk
Decisions should reflect the school's own risk profile: the age of pupils, any additional vulnerabilities, and how and where devices are used.
Review every year
Effectiveness should be checked at least once each academic year, with a clear record of who took part, what was found and what changed.
Use the DfE standards
Schools are expected to meet the DfE filtering and monitoring standards, which describe roles, review, filtering and monitoring in detail.
Think beyond the network
Children can reach the internet on mobile data and personal devices. Policies should say how the school handles risk it cannot filter.
DSL responsibilities for filtering and monitoring
The DSL does not need to configure the filter. They need to understand what it does, read what it reports, and act on what it shows.
Understand the systems in place
Know which filtering and monitoring products the school uses, which devices and users they cover, and where the gaps are.
- Which categories are blocked for each group
- Whether monitoring covers devices off site
- How guests and personal devices are handled
Receive and act on reports and alerts
Agree with IT what arrives on the DSL's desk, how often, and what counts as urgent. Serious alerts should reach the DSL on the same day.
- Regular summary reports, often weekly
- Immediate alerts for high-risk events
- A record of each response and outcome
Work with IT support
Filtering and monitoring works when safeguarding and IT talk often. The DSL brings the knowledge of pupils; IT brings the knowledge of systems.
- Agree a route for block and unblock requests
- Make sure IT staff know how to pass on concerns
- Share learning after incidents
Support the annual review
The senior leader leads the review, but the DSL brings the safeguarding view: incidents, trends, and whether the settings match the school's risks.
- Summarise the year's online safety concerns
- Flag categories that should change
- Check that actions from last year were done
Assure governors
Governors rely on the DSL to tell them whether systems are working. A short written update each term keeps the governing body informed.
- What was blocked and why it mattered
- Any over-blocking that affected teaching
- Open actions and owners
Lead staff training on online safety
Make sure induction and refresher training explain what the filter and monitoring do, what staff should watch for, and how to report.
- How to report a site that should be blocked
- How to report a site wrongly blocked
- What to do when a pupil discloses online harm
The governors' role in KCSIE filtering and monitoring
Governors are not expected to be technical. They are expected to ask good questions, make sure someone owns each task, and see evidence that the answers are true.
What governors should put in place
Questions governors can ask
Content, contact, conduct and commerce
KCSIE groups online risk into four areas. Filtering is strongest on content; monitoring and education carry more weight for the other three.
Content
Being exposed to illegal, harmful or inappropriate material, which now explicitly includes misinformation and conspiracy theories.
Contact
Harmful interaction with other people online, such as grooming, peer pressure or adults posing as children.
Conduct
A child's own behaviour that increases risk, such as sharing images or bullying others.
Commerce
Risks such as online gambling, scams, phishing and pressure to spend money.
Generative AI and misinformation under KCSIE
Two recent additions have practical consequences for filter settings and monitoring reports.
Generative AI tools
Filtering and monitoring expectations apply to AI tools in the same way as to any other website or app. Schools need to decide which tools are approved for learning and which are not.
- List the AI tools staff and pupils may use
- Block or monitor image generators and companion chat tools
- Include AI-generated imagery in the child protection policy
Our AI tools blocklist for schools covers more than 11,800 AI-tool domains in 18 categories, updated daily.
Misinformation and disinformation
Naming misinformation as a content risk does not mean blocking news. It means pupils should be taught to judge sources, and leaders should know when a filter can help.
- Keep reputable news open for research
- Block sites known for scams and fake stores
- Use teaching to build critical thinking
See also deepfake and NSFW AI filtering for the image side of the problem.
How AI tools, news sites and gambling are labelled
KCSIE asks for proportion: keep reputable news open, deal with AI and commerce risk. These lookups show the labels a school would be switching on or off.
| Site | Categories we hold | What the KCSIE text points to |
|---|---|---|
| bbc.co.uk | News/Media | Reputable news kept open for research |
| theguardian.com | News/Media | Same: sources pupils learn to judge |
| chatgpt.com | AI / LLM Tools | Approved or not, a decision for the school |
| character.ai | AI / LLM Tools, Web-based Applications | Companion chat that leaders may want to limit |
| paddypower.com | Gambling | The commerce risk area |
What KCSIE does and does not require
Many schools over-interpret the guidance and end up with settings that frustrate staff. Others under-interpret it and rely on a filter alone.
KCSIE does expect
- Filtering and monitoring that fit your pupils and your risks.
- Named people with clear ownership.
- A review every academic year, with records.
- Training so staff know their part.
- Teaching pupils about online safety.
KCSIE does not expect
- One particular product or provider.
- Blocking every social or video site.
- The same settings for a five-year-old and a sixth former.
- Staff reading every pupil's screen.
- Technology to replace supervision.
Six gaps that often turn up when schools check against KCSIE
None of these needs new money to fix. Most come from systems that were set up once and never looked at again.
One profile for everyone
The same rules for Reception and Year 13 mean either younger pupils are under-protected or older pupils cannot research properly.
Devices unprotected at home
Take-home laptops filtered only on the school network lose protection the moment they leave the building.
Reports nobody reads
Weekly reports land in an IT inbox and never reach the DSL, so patterns that matter go unnoticed.
Guest Wi-Fi left open
Visitor and personal device networks often run with weaker rules, even though pupils may use them too.
Uncategorised sites allowed
New or obscure sites with no category pass straight through. Broad category coverage keeps this group small.
No written record
Tests were done, but nobody wrote down when, by whom or what happened, so there is nothing to show.
For pupils with their own Chromebooks, see Chromebook 1:1 device filtering. To check how sites are labelled, use the domain checker.
A KCSIE filtering and monitoring checklist across the school year
Spreading the work across three terms keeps it manageable and gives you evidence at each point. Adapt the timing to your own calendar.
- Read the new KCSIE edition and note changes
- Confirm the named senior lead and governor
- Update the child protection and online safety policies
- Deliver staff training, including filtering and monitoring roles
- Check new pupil devices are enrolled in filtering
- Show a monitoring notice at login
- Test that illegal and adult content is blocked on each device type
- Test a VPN or proxy workaround
- Review over-blocking reports from teachers
- Check off-site filtering on take-home devices
- Look at alert response times with the DSL
- Give governors a short progress update
- Hold the annual filtering and monitoring review
- Record attendees, tests, findings and actions
- Agree category changes for next year
- Check the data protection impact assessment
- Report findings to the governing body
- Plan for any new devices or systems in September
For a full meeting agenda and record template, use our filtering and monitoring annual review checklist. The detail behind each test is in the DfE filtering and monitoring standards guide.
What an inspector or auditor may ask, and what to show
Safeguarding is always part of inspection. Having these answers ready, with documents to back them up, shows that filtering and monitoring is managed rather than assumed.
| Likely question | Who answers | Evidence to have ready |
|---|---|---|
| Who is responsible for filtering and monitoring? | Headteacher or senior lead | Roles document naming the senior lead, governor, DSL and IT support. |
| How do you know the filter works? | Senior lead and IT | Dated test log showing what was tested, on which devices, and the result. |
| How do concerns reach the DSL? | DSL | Monitoring process, sample anonymised reports and response records. |
| How do staff know their role? | DSL | Training materials and attendance records covering filtering and monitoring. |
| When did you last review provision? | Senior lead or governor | The latest annual review record with actions and owners. |
| How do you avoid over-blocking? | Senior lead | Unblock request log and the categories changed as a result. |
Evidence that comes from the console, not from memory
The hosted filter produces activity reports, keeps a policy record and exports its log, so the answer to what was blocked and when does not depend on one person's notes. It decides by domain and does not read pages or messages.
How category data supports KCSIE filtering and monitoring
KCSIE asks for settings that suit your pupils and do not over-block. That is only possible when the filter knows what each website is about.
What each route gives a school meeting the KCSIE expectations
These rows come from the duties set out above for governors, the DSL and IT.
| KCSIE expectation | Filter run in house | Hosted CIPA filter |
|---|---|---|
| Systems in place for every school | Servers or devices to keep patched | A DNS filter we run for you, nothing installed on computers |
| Age-based settings | Separate policies to build and track | Separate settings per school or branch in one console |
| Devices that go home | Often needs an agent on each one | A private encrypted link applies the same rules off the network |
| Fixing a wrong block | A ticket, then a rule change | Always-allow and always-block lists per site, applied in seconds |
| Records for the annual review | Collected manually | Activity reports, policy record and log export |
KCSIE filtering and monitoring questions
Which edition of KCSIE is current?
Keeping Children Safe in Education 2026 was published in July 2026 and took effect on 1 September 2026. It replaces the 2025 edition. Check the official page each summer, because a new edition usually arrives before the autumn term.
Who is responsible for filtering and monitoring under KCSIE?
The governing body or proprietor holds overall responsibility. A member of the senior leadership team leads on filtering and monitoring and the annual review. The designated safeguarding lead takes lead responsibility for online safety, and IT support keeps the systems working.
Does KCSIE name a filtering product or list of approved providers?
No. KCSIE does not approve products. It points schools to the DfE filtering and monitoring standards and to the UK Safer Internet Centre definitions of appropriate filtering and monitoring, which providers can respond to.
Does KCSIE apply to colleges and independent schools?
Yes. It applies to maintained schools, academies, free schools, independent schools, non-maintained special schools and further education colleges in England. Some parts apply differently to different settings, so check the sections that describe your type of setting.
Is a filter enough to meet KCSIE?
No. KCSIE expects filtering and monitoring together, plus staff training, an online safety approach in the curriculum, clear policies and a regular review. A filter is one part of a wider safeguarding approach.
Back to the UK school filtering and monitoring hub, or read how Prevent duty web filtering fits alongside KCSIE.
Related guides
- Filtering and Monitoring Standards for Schools: DfE Guide
- KCSIE 2026 Changes: Filtering, Monitoring, AI and Phones
- Filtering and Monitoring Annual Review Checklist for Schools
- Ofsted Online Safety Inspection: What Inspectors Look At
- The Prevent Duty and Web Filtering in Schools
- School Filtering Guidance in Wales and Scotland
The price depends on the number of schools and devices, and we send a quote within one business day. Running a pilot on one site first means your DSL and senior lead can look at the blocks and reports before anyone commits.
Talk to us about your school or trust
If you manage filtering for a school, a multi-academy trust or a product used by UK schools, we can show how category data supports the settings KCSIE expects.
Talk to us Read the DfE standards guide