The school photograph is now a safeguarding asset, not harmless website furniture

01 / The risk changed

The photograph has not changed, but what can be done with it has.

School photographs have usually been governed through familiar questions: was consent obtained, is the image appropriate and is publication consistent with the stated purpose? Generative tools add another question. Once a clear image is publicly accessible, it may be copied and transformed without the school's knowledge or the child's participation.

The NCA and IWF report that analysts identified 3,440 AI-generated child sexual abuse videos during 2025, compared with 13 in 2024. They also describe a case in which criminals allegedly took pupil imagery from a school website, created more than 100 sexual images and attempted to blackmail the school. That account shows a credible route of harm; it does not establish how common the route is across schools.3

02 / Protection layers

Device protection may close one route while leaving the wider image environment open.

On 8 September the government committed to introducing primary legislation requiring major technology platforms to build device-level protections for children, while also exploring requirements for apps used by children. The statement says the timetable should move quickly, but it does not supply enacted duties, a final scope or evidence of implementation across devices.2

Even a strong on-device control cannot retrieve every image already published, prevent an adult from copying public material or determine how a school supports a child after manipulation. A defensible approach therefore layers technology with curriculum, safeguarding, data protection, communications and response planning.14

03 / Consent lifecycle

Consent should remain reviewable after the photograph is taken.

A permission collected at admission can become detached from the image, the publication channel and the child's developing view. Schools need to know which consent or other lawful basis supports each use, how families can change a preference and whether the operational process can find and remove all relevant copies.

The NCA and IWF advice encourages renewed conversations about image consent, including whether preferences have changed or visibility should be limited. For schools, that points towards a periodic image inventory covering active pages, news archives, prospectuses, social accounts and third-party platforms rather than an annual form filed away from the content it governs.3

04 / Incident response

A manipulated image needs a safeguarding response even when the underlying event is synthetic.

KCSIE treats AI-altered and wholly generated imagery inside the safeguarding framework. Leaders should therefore avoid language that minimises a report because the image is fake. The material may be synthetic; humiliation, coercion, distribution, sexual harassment and the effect on the child are not.14

The response route should identify the designated safeguarding lead, preserve only the evidence necessary for lawful reporting, avoid uncontrolled forwarding, secure prompt platform action and coordinate communication with the child and family. Technical, communications and legal decisions must support the child-centred response rather than overtake it.4

05 / Board evidence

Boards need assurance about the image estate, not a promise that consent forms exist.

A useful assurance view records where pupil images are published, the purpose and owner, the date or event that ends the use, the withdrawal route and the process for archived or duplicated content. It should also show whether safeguarding, privacy, communications and incident plans use the same definitions and escalation points.

This does not require schools to describe vulnerabilities publicly or remove every image. It requires proportionate control. High-resolution, named or highly searchable material may deserve a different decision from a time-limited group image whose purpose remains current.

Leadership questions

Questions that turn the development into a governing conversation.

School Connection intelligence lens

What the national Observatory can add, and where it must stop.

The Schools Intelligence Observatory can review public policies for explicit treatment of AI-altered imagery, withdrawal of consent, retention, archived content and named incident routes. It can report national coverage and change over time, then invite schools to verify or correct the classification.13

The Observatory must not scrape, store, reproduce or classify pupil photographs. A missing phrase on a public website is evidence only that the policy was not found in the reviewed material; it is not proof that a school lacks a safe practice.

What we are monitoring next

Publication is the beginning of the watch.

• The introduction, scope and commencement provisions of the proposed online-safety legislation.
• Further DfE, NCA, IWF and regulator guidance for education settings and image custodians.
• Changes in schools' public image, consent and safeguarding policies during 2026/27.

The continuing record

Read the connected evidence and analysis

• Digital safety after September’s updates: who sees the alert, and who acts? ↗