Free resource
Safeguarding and AI
What this sector actually has to think about, what it doesn't, and the one rule that covers nearly all of it.
Updated 17 August 2026
This is not legal advice, it is not a safeguarding policy, and it does not replace yours. It’s what I’ve worked out running a children’s activity business and using AI in it every day, written down so you have somewhere to start.
Almost everything written about AI safety is aimed at people who don’t handle children’s data. Coaches, freelancers, marketing people. You do. That changes the conversation and nobody’s having it with you, so here it is.
Start here, because it’s the whole thing
The people stay out. The problem can come in.
Never type or upload a child’s name, a parent’s name, an address, a date of birth, a medical note, a photograph, or anything else that could identify a family.
Describe the situation, not the person.
That’s it. That’s the rule. Everything below is either explaining why, or dealing with the places people trip over it without realising.
Why this matters more for you than for most people
You hold information about children. Names, ages, who’s allowed to collect them, allergies, medical conditions, sometimes far more sensitive things than that. Parents handed you that information because they trust you with their child.
They did not hand it to you so it could be typed into a chat window.
That’s not a legal argument, though there is one. It’s the simpler thing underneath. The trust you have with your families is the actual asset in your business, and it is the one thing you can’t rebuild.
You don’t need to know GDPR chapter and verse to get this right. You need one habit.
The bit that catches people out
Most people manage the rule fine when they’re typing. Where it goes wrong is everything else.
Uploading a file doesn’t feel like typing. Dragging a register, a spreadsheet or a form into a chat feels like an admin action. It isn’t. Whatever is in that file has gone in, all of it, including the columns you’d forgotten were there.
Connecting something hands over everything in it. If you connect your email, you’ve connected every parent’s address and every conversation you’ve ever had with them. Same with a drive, same with a booking system.
Screenshots contain more than you think. The bit you meant to show, plus the sidebar, plus whatever tab was open behind it.
Voice notes are a brilliant way in and a brilliant way to slip up. Talking is faster than typing and it’s how I use it most. It’s also where you’ll say a name without noticing, because you’re talking the way you’d talk to a colleague.
The two second pause fixes all four. Before you drag, connect, screenshot or record: what’s actually in this?
What you can absolutely put in
The rule rules out far less than people assume. Nearly everything you actually want help with is the problem, not the people.
All of these are completely fine:
- “A parent has complained about a class change and I need to reply without making it worse.”
- “A four year old in one of my classes is struggling to settle. What’s worked for other people?”
- “I need to write a letter to all parents about a fee increase and I’m dreading it.”
- “One of my teachers keeps arriving late and I’ve already had the conversation once.”
- “Rewrite this term’s newsletter so it’s shorter and warmer.”
- “Summer bookings are down on last year. What should I be looking at?”
- “Draft me a safeguarding section for my parent handbook that I can then check properly.”
Not one of those needs a name. You’re describing the situation instead of handing over the file, and you get exactly the same quality of help.
What about the child protection stuff?
I want to be careful here, because this is the bit where being casual would be wrong.
A genuine safeguarding concern does not go into AI. Not anonymised, not described carefully, not “just to help me word it”. It goes into your safeguarding procedure, to your designated person, on your recording system, following the process you already have.
The reason isn’t only data. It’s that a real concern needs a record with a timestamp, a named person and an audit trail, and a chat window is none of those things. It’s also that the judgement in those moments is yours and it depends on knowing the child.
Where AI can help around the edges: writing your policy in plain English. Helping you think through how to explain a procedure to a new teacher. Turning your notes on training into something readable. General, structural, nothing about a specific child.
That line is worth writing down for yourself and telling your team.
What to tell your team
If your teachers are using AI, and some of them will be, they need to know the rule. Most people have never thought about it.
Three sentences is enough:
- Never put a child’s or a parent’s details into any AI tool, including names.
- Never upload a register, a form or a photograph.
- If you’re not sure, ask me first.
Put it in your induction. It takes a minute and it’s the difference between having a position and hoping.
What to say if a parent asks
Some will, eventually. It’s a fair question and being ready for it is better than being caught out.
Something like: “I use AI to help with admin and writing, the same way I’d use a spellchecker or a template. I never put any information about a child or a family into it. Their details stay in our booking system and nowhere else.”
True, calm, and it doesn’t overclaim. You’re not pretending you don’t use it, which is the worst answer available.
One thing in the news, and what it does and doesn’t mean for you
Keeping Children Safe in Education 2026 comes into force on 1 September 2026, and for the first time it names AI directly. It covers AI-generated and digitally altered images, and it ties AI use into schools’ filtering and monitoring duties.
It applies to schools and colleges in England. It does not apply to you. If you’re an independent activity provider, this is not your rulebook and anyone telling you otherwise is either confused or selling something.
Why it’s worth knowing anyway: it’s the clearest signal yet that AI and children’s safeguarding has moved from opinion into written policy. If you rent a school hall, run clubs on school premises, or work with schools at all, they’ll be dealing with this from September. And the direction of travel is obvious. Providers who already have a position will find the next few years much easier than providers who don’t.
The bit I actually want you to take away
I was frightened of this stuff a year ago. Properly frightened, not cautious.
What fixed it wasn’t reassurance, it was understanding the actual thing. And the honest position at the end of that is: this is safe to use in a children’s activity business, as long as the families themselves never go into it.
There is no mode, no setting and no plan where a child’s name belongs in AI. Get that one habit right and you can use it for everything else without a second thought.
If you want the settings side, that’s the data guide. Settings cover your chats. This page covers your practice, and the practice is the part that actually protects anyone.
August 2026 edition. Guidance and settings change, so I check these pages every quarter and update them when something moves.
More free guides at www.katemarkham.ai/resources.
Questions? I’m at hello@katemarkham.ai, always happy to help.
Want a hand putting this into practice?
Book a free 15-minute call and we'll set Claude up around your business, so it already knows how you work.