From nothing to something that lasts.

Give the response owners

Confirm coordinator, safeguarding lead/deputy, senior sponsor, IT/data-protection partner, family liaison and review date. Write the decision rights down.

Your non-negotiables

Clear reporting routes; case records in the approved system only; threshold and referral decisions under local policy; proportionate, child-centred response; parent involvement assessed for safety; and no staff member looking for, downloading or circulating harmful imagery as part of “investigation.”

Your first leadership decision

Approve a named accountable coordinator, a safeguarding-lead partnership, a 30-day local evidence cycle and a recurring governance review. The question is not “who knows most about technology?” but “who can make sure the response is owned, evidenced and reviewed?”

What should be true

• A lead, deputy and senior decision-maker are named and known.
• Cover is real, not assumed: a monitored, confidential shared safeguarding mailbox and a rota mean a concern is never waiting on one person’s inbox during absence or turnover.
• Board/governor oversight tests evidence, not just policy existence.
• Local referral, emergency and language-access routes are documented and rehearsed.
• Safeguarding, pastoral, IT and data-protection leads meet on a predictable cadence.

What children should experience

• Age-appropriate teaching about consent, relationships, privacy, manipulation and help-seeking.
• Trusted adults and complaint/reporting routes that children can name.
• Responses that avoid victim-blaming and are proportionate to context.
• Student voice that changes provision and is closed back to students.

What must stay separate

• Planning and trend analysis use aggregated or redacted data.
• Formal case facts live only in the approved safeguarding record.
• Retention, access and transfer follow school policy and local requirements.
• Any AI/vendor review includes the data-protection owner.
• Cyber security is a safeguarding duty: a breach of student data is a child-protection event, not only an IT one.

What needs assurance

• Filtering/monitoring is reviewed at least once every academic year, led by a named senior leader with the safeguarding lead and IT, with a formal record of which devices and locations were tested, what was found and what was fixed—including how AI tools behave behind the filter.
• AI/app decisions consider manipulation, social/emotional development, privacy, reporting and accessibility.
• Technical signals are understandable to safeguarding colleagues.
• Home devices, apps and network limitations are recognised as blind spots, not ignored.

Hours, not days

Financial sextortion most often targets boys aged 14–17, usually via a fake peer profile that sends an image first, then demands money. Threats can escalate within hours, and AI now lets offenders threaten to fabricate images when none exist. Thorn’s analysis of NCMEC reports found more than 1 in 6 cases that described impacts mentioned self-harm or suicide.

School move: Teach the script before it is needed—“stop, don’t pay, don’t delete, tell”—and say explicitly that students will not be punished for having shared an image. See the response row on the Safeguarding lead tab.

Coercion toward harm, not just images

Police in the UK, US and Canada warn of loosely organised networks (often referred to as “The Com”, including the group known as 764) that groom children aged roughly 8–17 on gaming, chat and streaming platforms, then coerce self-harm, cruelty to animals or harm to others. The UK National Crime Agency reported a sixfold rise in reports in two years (2025).

School move: Make sure pastoral and safeguarding staff know the signs police list: fixation on a new online group or contact, sudden secrecy, self-harm, harm to pets, and talk of “proving” loyalty. This is a police-level concern—route it immediately; do not look for the content.

The chatbot gives the wrong number

When researchers at Wrocław Medical University tested 29 popular mental-health chatbot apps with suicide-risk prompts (2025), none met their criteria for an adequate response; the most common failure was giving incorrect emergency numbers. KCSIE 2026 now states plainly that mental-health concerns, including self-harm and eating disorders, can be safeguarding concerns.

School move: Put correct local emergency and support contacts wherever students look—planner, LMS, device lock screen, bathroom doors—in every language your community uses. Teach the “empathy gap”: a chatbot can sound caring but cannot act.

Where friendship and grooming overlap

Gaming platforms remain a primary route for contact risk: free-currency scams (“free Robux” and equivalents), offers of in-game help or gifts, and moves to voice chat or private servers. Grooming usually starts friendly before it becomes uncomfortable, and offenders are not always adults or strangers.

School move: Teach the “friendly first” pattern and the platform’s own block/report route. Ask families which games and servers children use—most adults do not know.

Teach staff to ask, not decode

Emoji and slang shift monthly, and meanings differ across cultures. Research on Chinese-language messaging, for example, finds the slightly smiling face 🙂 is often read as contempt or sarcasm rather than friendliness. Some terms that sound violent are used casually; some that look innocent carry drug, self-harm or hate meanings.

School move: Do not publish static “emoji dictionaries” to staff—they are out of date within a term and encourage surveillance. Instead, run a short student-led “what’s changed?” session each term, and train staff in one question: “What does that mean to you?”

Anthropomorphic AI safeguards

China’s Interim Measures for Anthropomorphic AI Interaction Services have been in force since 15 July 2026. Article 14 prohibits providers from offering minors virtual relatives, virtual lovers or other virtual intimate-relationship services, requires guardian consent for under-14s to use other anthropomorphic services, and expects a minors mode, dependence warnings and reminders that the user is talking to an AI.

School move: Do not introduce companion-like AI without age/guardian controls, emotional-reliance risk assessment, real-world usage prompts, pastoral escalation, data review and family communication. Also verify applicable AI-content labelling requirements before use.

Age-appropriate access and reporting

Singapore’s online-safety codes require designated services to minimise exposure to harmful content and provide usable reporting. The Code of Practice for Online Safety for App Distribution Services (in force since 31 March 2025) requires app stores to use age assurance to limit young people’s access to age-inappropriate apps.

School move: Ask whether your own app approval and family guidance make age ratings, reporting routes and harm-response expectations equally clear.

The under-16 debate is now policy

Australia’s social-media minimum age of 16 has applied to designated platforms since December 2025, and the UK opened a national consultation in March 2026 on options from 13 to 16, on restricting high-risk features, and on safeguards for AI chatbots. Expect parents in your community to arrive with strong views formed elsewhere.

School move: Do not wait for a law to set your own community norms. Publish a clear, age-tiered position on accounts, companion-style AI and phones, and explain the reasoning to families in their languages.

Vendor safeguards are arriving—unevenly

In August 2026 OpenAI launched a ChatGPT experience for 13–17s with age prediction, parental controls, reduced anthropomorphism and break reminders. Useful—but it covers one product, relies on age signals, and says nothing about the companion apps and domestic tools children use on personal phones.

School move: Treat a vendor’s teen mode as one control, not an assurance. Verify it is actually active on your students’ accounts and devices, and keep your human reporting route in front of it.

Specialist response—not school surveillance

Korea’s AI Framework Act has been in force since 22 January 2026. Seoul also launched the Safety ON Center for online sexual exploitation of children and youth in February 2026.

School move: Map specialist support, reporting and takedown routes locally. Do not treat city-level AI monitoring as a model for schools to monitor private student communications.

Local roles and child-centred support

Thailand’s 2025 Child Online Safety Guidelines help officials identify online risk, manage crises, navigate legal procedure and support affected children and young people.

School move: Confirm who holds each local role before an incident: safeguarding lead, emergency contact, authority/police referral, specialist support, counselling and interpreter access.

Decentralised, data-conscious implementation

In Switzerland, compulsory-education curriculum responsibility sits with the cantons. Use this as a reminder to adapt AI practice to local education and data-governance structures rather than assume a single national school procedure.

Frameworks to model

Recent evidence and response guidance

Global and regional voices (added v4.3)

Practice sources for schools