evidoria

← Back to browse

Good practice Imported

Estyn's National Thematic Review of Generative AI Data-Protection Practice in Welsh Schools

United Kingdom · Cardiff · See the United Kingdom profile

Evidence: Observational / pre–post Top 82% 33/100 · Ask Evidence Copilot about this practice

Wales's inspectorate Estyn visited 21 schools nationwide and found many unclear on GDPR duties around generative AI — prompting a Welsh Government pledge to co-design a national AI framework with the ICO.

21 schools
Schools visited (2024-2025)
22 local authorities
Local authorities covered (all of Wales) (2024-2025)
Estyn's National Thematic Review of Generative AI Data-Protection Practice in Welsh Schools

Details

Promoter
Estyn (Education and Training Inspectorate for Wales)
Period
2024–2025 (review); published Oct 2025
Keywords
school inspection, data protection, generative AI, GDPR compliance, national education policy

Context

Estyn (Wales's statutory education inspectorate) conducted a national thematic review, 'A New Era: How Artificial Intelligence (AI) is Supporting Teaching and Learning,' visiting 21 primary, secondary, special and all-age schools and surveying staff across all 22 Welsh local authorities during the 2024-2025 school year.

Results

Published 9 October 2025, the report found that while many schools were beginning to explore generative AI for planning, feedback and accessibility, 'too many schools... remain unclear of their statutory duties regarding the protection of personal data,' with only a minority having robust GDPR-compliant procedures for AI tools. On 16 October 2025 the Welsh Government committed to co-design a 'coherent national approach' with Estyn, the ICO and the Welsh Local Government Association; a generative-AI school policy template had separately been made available via Hwb/360 Safe Cymru from May 2025.

Conclusions

This is a diagnostic inspection and a non-binding government response, not enacted regulation: no sanctions were issued, adoption of the May 2025 policy template was uneven, and the promised national framework had not yet been delivered as of the report's publication.

Implementation
Indicative cost
Low (< €50k) — Cost of the inspection exercise itself not published; policy template distributed via existing Hwb/360 Safe Cymru infrastructure at no additional stated cost.
Time to results
Short (< 1 year) — Review conducted during the 2024-2025 school year; published 9 Oct 2025; government response 16 Oct 2025; national framework still pending.
Staffing & skills
Estyn (Education and Training Inspectorate for Wales), Welsh Government (policy response), Information Commissioner's Office (ICO) and Welsh Local Government Association (WLGA), co-design partners for the national framework

Conditions for success

  • National-scale inspection covering all 22 local authorities and multiple school types (primary, secondary, special, all-age)
  • Existing generative-AI school policy template (Hwb/360 Safe Cymru, from May 2025) as a starting point for schools

Common failure modes

  • Many schools remain unclear of their statutory GDPR duties around generative AI
  • Adoption of the May 2025 policy template was uneven
  • Promised national framework had not yet been delivered as of report publication; government response is non-binding with no sanctions

Where it fits

Governance type
national inspectorate plus government policy response (Wales)
Scale
national (all 22 Welsh local authorities)
Income level
high-income

Commonly funded by

National / regional programmes

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Attachments

Similar practices you may find useful