Early Years AI Policy Template for Nurseries and Childminders

An early years AI policy should set out which AI uses are permitted, which children's data is never entered into AI tools, the rules every member of staff follows, how parents are told, who is responsible, and a review date. Adapt a template by listing the tools you actually use, then test each clause against real tasks.

Policies fail in two ways. Some are so generic that nobody can tell what they mean for Tuesday morning, and some are so strict that staff quietly ignore them. The version below is meant to be short, concrete and tied to the jobs people really do: writing newsletters, drafting emails, tidying observations, planning activities. Where a clause touches children's information, it says exactly what is out of bounds.

Follow me on Instagram@sagnikteaches

This is a starting template, not legal advice or a compliance certificate. Before you adopt it, check it against the statutory framework you work to (such as the EYFS, whose relevant paragraphs are listed below), your registration body's expectations and your data regulator's guidance (such as the ICO's). If you are a childminder, the childminder privacy notice tutorial covers the notice parents see, and this policy is the internal rulebook that sits behind it.

Connect on LinkedInSagnik Bhattacharya

Before you write: find out what is happening already

A policy written without knowing current practice will miss what matters. Spend 20 minutes asking staff, without blame, what tools they have used for work in the last month. Ask about assistants such as ChatGPT, Claude, Gemini or Copilot, about AI features inside software the setting already uses (a learning journal, a messaging app, a photo editor, a phone's keyboard), and about anything personal staff use on their own devices for work. A short anonymous form works if people are wary.

Subscribe on YouTube@sagnikteaches

You will usually find three groups. Some staff use nothing. Some use an assistant for emails and newsletters, which is low risk. A few are pasting observations or notes into a chatbot to save time, which is the activity to stop. The point of the survey is not to catch anyone; it is to write rules for what is really happening. For a nursery, where AI fits in a nursery's learning-journal software helps you see which tools already include AI features.

What the EYFS and ICO references require of an AI policy

The current EYFS frameworks (one for group and school-based providers, one for childminders, both in force from 1 September 2026) do not mention AI by name. Three requirements in them still decide what an AI policy has to cover.

• Devices that capture and share images. Safeguarding policies must include how mobile phones, cameras and other electronic devices with imaging and sharing capabilities are used in the setting (paragraph 3.6 of the group framework, 3.7 of the childminder one). A phone with an AI photo editor, or a journal app with AI captions, is one of those devices, so the photo rules below belong beside that part of your safeguarding policy.
• Secure, need-to-know records. Confidential information and records about staff and children must be held securely and be available only to those with a right or professional need to see them, and providers must be aware of their responsibilities under data protection legislation (3.96 group, 3.95 childminders). Pasting an observation into an unapproved chatbot is hard to square with either.
• Staff who understand privacy. Everyone must understand the need to protect children's privacy and the legal requirements for handling a child's information confidentially (3.97 group, 3.96 childminders). Clause 3 and the staff briefing are how you show that.

Two smaller points help. The frameworks say there is no requirement to keep written records of practitioners' day-to-day observations, so if staff are pasting notes into a chatbot to keep up with paperwork, the better fix may be fewer notes rather than faster ones. And a childminder registered only on the early years register does not need written policies, but must be able to explain them to parents and inspectors (childminder framework 3.6). A one-page AI policy is still the easiest way to do that.

For data protection, the frameworks point providers to the Information Commissioner's Office (ICO) guidance on the GDPR. That guidance, rather than this tutorial, is where to check lawful basis, privacy notice wording and when a breach has to be reported. The frameworks also ask providers to have regard to separate guidance on children's screen use. That covers children using screens, which is a different subject from staff using AI, so keep the two apart in your paperwork.

The policy, section by section

Keep it to two pages. The sample clauses below are illustrative; change the wording to match your setting and the tools you approve.

1. Purpose and scope

1.1 This policy sets out how [setting name] uses artificial
intelligence (AI) tools, such as chatbots and writing assistants,
and the rules that apply to all staff, students, volunteers and
managers.
1.2 It applies to any AI tool used for work, including on
personal devices, and works alongside our data protection,
online safety, safeguarding and photography policies. Where
they conflict, the safeguarding policy comes first.
1.3 AI supports our staff. It does not replace professional
judgement, and it is never used to make decisions about a child.

The last line is the principle behind everything else. A setting should never use AI to decide anything about a child, such as assessing development, deciding a concern is not worth raising or choosing a response to behaviour.

2. Permitted uses

Be specific, because "reasonable use" means different things to different people. Give staff a list they can point to.

Everything on this list is done without any child's name, photograph or observation. Staff read and edit the output; nothing generated goes to parents or the public without a human check.

3. Children's data red lines

This clause is the heart of the policy. Write it as a list of things that never go into an AI tool unless the manager has approved that specific tool for that use in writing.

3.1 Staff must never enter the following into any AI tool that
has not been approved by the manager in writing:
(a) a child's name, initials with other identifying details,
    date of birth, address, photograph or voice recording;
(b) observations, assessments, next steps or learning journal
    entries about an identifiable child;
(c) health, medical, allergy, special educational needs or
    disability information;
(d) safeguarding, behaviour incident or family circumstance
    information;
(e) parent or carer contact details, or information that
    identifies a family;
(f) staff personal data, including HR, performance or
    absence records.
3.2 Removing a name is not enough if the rest of the text could
identify the child, for example a rare condition, a small group
or a specific incident.
3.3 Children's images and video must never be uploaded to AI
image, video or editing tools.

Clause 3.2 matters in a small setting. "A three-year-old in the pre-school room who is deaf in one ear" identifies a child as surely as a name does. For more on why children's data needs this care, see whether it is safe to use AI with children's data in a nursery.

4. Staff rules

4.1 Use only tools on the approved list (Appendix A).
4.2 Use work accounts, not personal accounts, where possible.
4.3 Check every AI output for accuracy, tone and bias before use.
You are responsible for what you send, whoever or whatever
drafted it.
4.4 Never present AI output as your professional observation or
assessment of a child.
4.5 Do not use AI to write references, appraisals, disciplinary
documents or safeguarding records.
4.6 Tell the manager at once if you enter protected information
by mistake. You will not be blamed for reporting it.
4.7 New tools must be approved before use. Ask the manager,
who will check the tool's data terms and record the decision.

Clause 4.6 deserves emphasis. People who fear blame hide mistakes, and a hidden data slip is worse than a reported one. Make it plain that reporting is the expected response and the response will be proportionate.

5. Parent and carer notice

Parents should know how AI is used and how their child's information is not. Plain wording works best, both in your privacy notice and at enrolment.

5.1 We use AI tools to help with administrative tasks such as
drafting letters and planning ideas. We do not enter children's
names, photographs, observations or other personal information
into AI tools. Staff check everything AI helps to write before it
is used.
5.2 If we ever propose to use an AI tool with children's
information, we will tell you first, explain what it does, and
ask for your permission where required.
5.3 Parents can ask us at any time how AI is used in the
setting.

6. Responsibility and review

6.1 [Name and role] is responsible for this policy and the
approved tools list.
6.2 This policy will be reviewed every 12 months or sooner if we
adopt a new tool, guidance changes, or an incident occurs.
Next review: [date]. Approved by: [name], [date].

Appendix A: approved tools list

Keep a simple table: tool name, what it is approved for, what it is never used for, account type, date checked, and who approved it. If a tool is not on the list, it is not approved.

Adapting it for a nursery or a childminder

The same template serves both, but the weight differs.

• Nursery: several staff, rooms and devices, so the staff rules, training and approved list matter most. Name a manager and a deputy, and add an annual briefing. A one-hour briefing plan is in the nursery AI briefing tutorial.
• Childminder: usually one person, one phone, often one family at a time. Replace the staff section with a short personal commitment, and give the most space to the red lines and the parent notice. You are the manager, the deputy and the person who might slip, so build one habit: before pasting anything, ask "could this identify a child?".
• Setting with students or volunteers: add a line that they follow the same rules and are briefed before they start.

Testing each clause on real tasks

A policy is only useful if staff can apply it quickly. Try these five tasks against it, and write down what the policy says for each. If a task has no clear answer, the clause needs work.

The "hold" row is realistic. Not every case will be clear, and the policy should say who to ask. Keep a log of questions staff raise. They show where the wording needs to change at review.

A before and after: the same task, done safely

A room leader wants help turning rough notes about the week into a parent newsletter. The unsafe version pastes in the notes, which include "Mia bit another child on Tuesday" and "Sam's allergy plan updated". The safe version separates the content in two steps. First, write the general content, with no names or incidents: "We explored colour mixing, went on a leaf hunt and began a new story." Second, ask the model for a friendly newsletter from that and nothing else. Individual information about a child goes to that child's parents through your usual, secure channel.

Write a friendly one-page newsletter for parents of children aged
2 to 3 at a small nursery. This week: colour mixing with paint,
a leaf hunt in the garden, a new story about a hungry bear.
Next week: a visit from a local librarian on Wednesday.
Warm, short sentences, no names of children, no photographs
mentioned, sign off with "[room name] team".

A reasonable output is three short paragraphs and a sign-off. The room leader checks facts, such as the day of the visit, and removes any invented detail such as "children loved the wet leaves" if that did not happen. AI often adds colour that sounds plausible and was not observed.

Writing the rules for photos, video and voice

Early years settings handle more images of children than almost any other small business, and AI tools are increasingly built into editing and messaging apps. Your photography policy probably already covers consent and storage. The AI policy adds three points. First, children's images are not uploaded to any AI service for captioning, enhancing, cut-outs, background removal or "magic" editing, because the file leaves your control the moment it is uploaded. Second, features built into a phone or app that process images on the device are treated as a tool and approved or declined like any other. Third, voice recordings, including voice notes about a child, are treated as personal data and kept out of AI transcription tools unless the manager has approved one in writing.

The temptation is practical. A room leader with 30 photos and ten minutes wants captions written. Give her a safe route: write the captions yourself in a list from memory, and use an approved tool only to polish wording that contains no names. If your learning-journal software includes AI-assisted captions, the manager reviews the supplier's data terms and decides before any staff member switches the feature on.

Questions to put to any AI feature before approving it

Approving a tool is a short, repeatable process, not a research project. Whoever approves tools should be able to answer these seven questions, and write the answers on the approved list.

1. What data does the tool receive, and does that include children's information?
2. Does the supplier use what we enter to train its models? Can that be switched off, and who controls the setting?
3. Where is the data stored, and for how long? Can we delete it?
4. Is there a business or education account with clearer data terms than the free consumer version?
5. Who at the supplier can see our content?
6. Can we turn the AI feature off for the whole setting, so that individual staff cannot enable it?
7. Does the supplier give a plain statement we can keep on file, such as a data processing agreement or a security summary?

If you cannot answer a question, the tool stays off the list until you can. Do not guess from a marketing page. A tool that cannot say what happens to your data is not one to use near children's information. Record the date you checked, because terms change, and set a recheck at the policy review.

An example, walked through for a small nursery

Take an imaginary nursery with 40 children, eleven staff and one manager. The manager runs the survey and finds that three staff use a general chatbot for emails, one has used it to tidy observation notes with first names, and an AI writing feature in the nursery's journal software has been switched on without anyone reviewing it.

• She approves a work account with a general assistant for the permitted uses in section 2, and writes the approved list.
• She turns that feature off until she has read the supplier's data terms, and sets a recheck for the next review.
• She speaks privately to the member of staff who pasted notes, thanks her for being honest, and explains the red lines. She also asks what she wanted help with, which turns out to be writing observations faster. The setting responds by looking at templates and shorter observation formats, not by banning help.
• She adds the parent notice to the enrolment pack and the website, and books a one-hour staff briefing.

The whole job takes about six hours of the manager's time across three weeks. The setting now has a policy that matches what happens in the building, one tool it has checked, one feature switched off and one process improvement. Those figures are illustrative; your own time will depend on the size of the setting.

Bias, accuracy and the human voice

Two more risks deserve a sentence in the policy even when no child data is involved. AI output can be wrong in a confident tone: an invented fact about a festival, a made-up statistic about child development, a plausible-sounding but incorrect description of a rule. Staff should check anything factual against a reliable source before it reaches parents. AI also reflects the assumptions of its training data, which can show up as stereotyped examples of families, cultures or abilities in stories and activities. Staff should read for that and edit it out.

There is also the question of voice. Parents choose a setting partly for its warmth, and a newsletter that sounds like every other setting can feel hollow. Encourage staff to use AI for a first draft and to add the specific, true detail only they know: the name of the garden snail everyone is fond of, the song the babies calm to. Those details come from people, not tools, and should never come from anything that would require a child's information in a prompt.

Handling a breach or a near miss

Write a short procedure into the policy so no one has to improvise. If someone enters protected information into an unapproved tool: tell the manager the same day, note what was entered, which tool and when, check whether the tool offers deletion or whether it retains data, and decide with the data protection lead whether the incident needs recording or reporting under your data rules. Your data regulator's guidance (the ICO's, if you work to the EYFS) sets out when a breach must be reported, so check it for the current position rather than relying on this page. Afterwards, ask what made it easy to happen and change something, whether it is the wording, the training or the approved tools list.

Treat a near miss the same way, because it shows where the policy is weak. A member of staff who says "I almost pasted a child's notes into it" has done the setting a favour.

Putting it into practice

1. Week 1: run the 20-minute survey, draft the policy with the template and write the approved tools list.
2. Week 2: brief staff for 30 to 60 minutes with the six tasks above, collect questions, adjust the wording, and have the manager or owner sign it.
3. Week 3: add a notice to your privacy information and to enrolment paperwork. Brief any students or volunteers.
4. Ongoing: keep a question log, review the approved list whenever a tool changes, and set the review date.

If you want to use an AI tool to draft the first version, give it your tool list and ask it to produce a two-page policy using the sections above. Then read it against your practice, delete anything that is not true of your setting, and have it checked by someone who knows your registration body's requirements. For a wider view of which nursery processes AI can help with, choosing nursery software with AI sets out the data questions to ask suppliers.

Keeping the policy alive

The review date is the line most likely to be ignored, so tie it to something that already happens: your annual policy review, your registration inspection preparation, or the start of the academic year. At each review, ask five questions. Which AI tools were used this year? Were any added without approval? Were there incidents or near misses? Has guidance from your registration body or data regulator changed? Do parents' questions suggest the notice needs rewording? Record the answers, update the date and tell staff what changed in one sentence. A policy that is read twice a year, short enough to remember and tied to real tasks, will be used. One that sits in a folder will not.

Questions about an early years AI policy

Do we need a separate AI policy?

Not always. A short section in your existing data protection, online safety or staff conduct policy may be enough for a small setting. A standalone page helps when staff already use AI tools, because it gives them one clear place to check what is allowed.

Can staff put children's names into ChatGPT?

The safe default is no. Names, photos, observations that identify a child, health, behaviour or safeguarding information should stay out of general AI tools. If you want AI help with observations, use only anonymised wording or a tool your setting has approved and checked.

Do parents need to be told?

If AI touches anything involving their child's information, tell them plainly, in your privacy notice and where relevant at enrolment. Even where AI is only used for admin that never involves children's data, a short line builds trust and prevents surprises.

How often should the policy be reviewed?

At least yearly, and sooner if you adopt a new tool, if your registration body or data regulator issues new guidance, or after any incident. Put the review date on the policy and a reminder in your diary, with a named person responsible.

Further reads

• Can AI Write a Nursery Self-Evaluation Form From Your Evidence? — Check AI drafts against real evidence before they reach an inspector.
• AI Chatbots for Nursery Enquiries and Visit Bookings — A parent-facing chatbot that stays within safe limits.
• How to Increase Nursery Occupancy: Open Days, Reviews and AI — Marketing uses of AI that involve no child data.
• Childminder Contract: AI First Draft, Solicitor Final Check — Another AI draft that needs a professional check.
• Childminder Paperwork Checklist: Which Records to Keep, and Where AI Helps — Which childminder records to keep, and where AI helps.
• Canva for Education vs Pro: Which Plan Fits a Tutor or Nursery? — Design tools with AI features and what they do with uploads.
• Daycare Incident Reports With AI: Factual, Name-Free Narratives — A facts-only structure for daycare incident reports, an initials rule that keeps names out of AI tools, parent wording and a director sign-off.
• Daycare Inspection Checklist: Prepare Your Records With AI — Build a daycare inspection checklist from your licensing rules, check staff and child records against it with AI, and keep a corrective-action log.
• Nursery Data Protection Policy: Draft and Update It With AI — Use AI to draft and refresh a nursery data protection policy from a data map, then check it against ICO guidance and get staff sign-off.
• Nursery Fees Policy: Deposits, Late Payment and Holidays With AI — A clause list for a nursery fees policy, a plain-English parent version drafted with AI, and a reminder ladder, checked by a solicitor.
• Nursery Late Collection Policy: Wording, Fees and Parent Messages With AI — A late collection policy a nursery can actually enforce: grace period, fee wording, repeat-lateness steps, emergencies and the messages to send parents.
• Nursery Ofsted Inspection Checklist: An Evidence Folder With AI — What a nursery should have ready for an Ofsted visit, how to build an evidence map and document index with AI, and how to practise staff questions.
• Preschool Parent Handbook: Draft It With AI and Check State Rules — Use AI to outline the handbook and rewrite policies in plain English, then check every section against your licensing authority's own published rules.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: Department for Education, EYFS statutory framework for group and school-based providers and EYFS statutory framework for childminders (both in force from 1 September 2026), including their pointer to the ICO's guidance on the GDPR. Check your registration body's and data regulator's current guidance before adopting any policy.