Guidance | Filtering and Monitoring in Schools

 

IMPLEMENTING EFFECTIVE FILTERING AND MONITORING IN SCHOOLS

Practical actions for school leaders, DSLs, IT teams and governors 2026–2027

Are your school’s systems genuinely keeping pupils safe online – or are you simply confident that the software is switched on? For 2026–27, schools need to demonstrate that filtering and monitoring are appropriate to their pupils, work across the technology they use, and lead to timely safeguarding action. The emphasis is on effectiveness, oversight and evidence.

THE KEY DISTINCTION  Filtering is preventative: it controls access to harmful or inappropriate content. Monitoring is reactive: it identifies and reports activity that may require intervention. Neither replaces effective teaching, supervision or a wider safeguarding culture.

The guidance schools should be using in 2026–27

The DfE’s Filtering and monitoring: core standard is the main operational framework for schools. It was updated on 16 September 2026. Read it alongside KCSIE 2026, which came into force on 1 September 2026. The UK Safer Internet Centre’s updated guidance provides further practical detail on appropriate filtering and monitoring.

DfE – Filtering and monitoring: core standard – https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/filtering-and-monitoring-core-standard  Updated 16 September 2026.

DfE – KCSIE 2026 – https://www.gov.uk/government/publications/keeping-children-safe-in-education--2  Statutory safeguarding guidance in force from 1 September 2026.

UK Safer Internet Centre – Appropriate filtering – https://saferinternet.org.uk/guide-and-resource/teachers-and-school-staff/appropriate-filtering-and-monitoring/appropriate-filtering  Technical guidance on filtering capability and limitations.

UK Safer Internet Centre – Appropriate monitoring – https://saferinternet.org.uk/guide-and-resource/teachers-and-school-staff/appropriate-filtering-and-monitoring/appropriate-monitoring  Practical guidance on monitoring approaches.

DfE – Generative AI: product safety standards – https://www.gov.uk/government/publications/generative-ai-product-safety-standards/generative-ai-product-safety-standards  Useful when assessing learner-facing AI products and supplier assurances.

Strand 1 – Identify and assign clear roles and responsibilities

Why it matters

Governing bodies and proprietors retain overall strategic responsibility and need assurance that appropriate systems are in place. Effective day-to-day arrangements depend on clear accountability and close working between senior leaders, the DSL and IT support – whether in-house or external.

Practical actions for schools

·        Name a senior leadership team (SLT) member and a governor/trustee with responsibility for ensuring the DfE standards are met. Record the appointments and include filtering and monitoring within the relevant role descriptions or terms of reference.

·        Create a simple responsibility map. Specify who sets policy and approves exceptions; who checks reports and leads safeguarding responses; who maintains the systems, tests coverage and supplies reports; and who provides strategic challenge and assurance.

·        Agree a clear working protocol between the DSL and IT provider. Set out how urgent alerts are escalated, how the DSL is contacted, what happens outside school hours, and how technical faults are resolved.

·        Ensure the DSL has access to relevant reports and understands what the system can and cannot detect. IT staff should receive appropriate safeguarding and online-safety training so they can recognise and promptly pass on concerns.

·        Make sure staff know how to report both safeguarding concerns and technical problems – including suspected access to unsuitable content, ineffective blocking, system failure or over-blocking.

·        Ensure pupils, staff, parents and carers are made aware of the school’s filtering and monitoring arrangements and the relevant acceptable use and privacy information.

Questions for leaders and governors

·        Can we name the SLT lead, responsible governor, DSL contact and technical lead?

·        Could an urgent high-risk alert be acted on promptly if the usual DSL or IT contact were unavailable?

·        Can the DSL explain what the system monitors, what it does not monitor and how alerts are followed up?

Strand 2 – Review provision at least annually – and whenever risk changes

Why it matters

The DfE expects a documented review at least once every academic year, involving SLT, the DSL, IT support and the responsible governor. The review should identify gaps, inform additional checks and provide governors with assurance. A calendar review alone is not enough: significant changes or incidents should trigger an earlier review.

Practical actions for schools

·        Schedule the 2026–27 review now. Involve the SLT lead, DSL, IT support/provider and responsible governor. Record findings, decisions, owners and deadlines, and retain the review so it can be inspected.

·        Map the school’s digital estate: school-managed laptops, tablets and desktops; devices taken home; guest access; staff and pupil BYOD; mobile devices; apps and embedded browsers; cloud services; remote access; and any backup internet connections.

·        Review the pupil risk profile, including age, SEND, EAL, vulnerability and known safeguarding concerns. Consider how pupils’ digital resilience and curriculum needs affect the appropriate balance between protection and access.

·        Check how technology is actually used in lessons and around school. Include new software, AI tools, online platforms, browser extensions and any changes to network, device or account configuration.

·        Review incidents, alerts, near misses, blocked-content reports, staff feedback and any occasions when content was accessed despite filtering. Look for patterns and repeat activity, not just individual events.

·        Check the current filtering categories and exceptions. Record why content is blocked or allowed, who can authorise changes, how temporary exceptions are approved and when they expire.

·        Repeat the review after a significant safeguarding incident, new technology or AI product, a change to BYOD/remote working, major software update, network reconfiguration or a change in pupil risk.

·        Agree a proportionate schedule of routine checks based on the risks identified. Record when checks took place, who completed them, what was tested and the outcome/actions.

Questions for leaders and governors

·        Is there a dated annual review for this academic year, with actions tracked to completion?

·        Does the review cover devices and services used off-site, apps and AI tools – not just web browsing on the school network?

·        What evidence shows that identified weaknesses have been fixed and retested?

Strand 3 – Ensure filtering blocks harmful content without unreasonably restricting learning

Why it matters

No filtering system is 100% effective. Schools must understand its coverage and limitations and take steps to reduce the risks. Filtering should block harmful and inappropriate material while supporting teaching, learning and the development of pupils’ ability to assess online risk.

Practical actions for schools

·        Ask the provider to demonstrate how filtering operates across school-managed devices on-site and off-site, BYOD arrangements, guest access, different sites and all internet feeds – including backup connections and portable Wi-Fi.

·        Check that the provider is a member of the Internet Watch Foundation (IWF) and signed up to the Counter-Terrorism Internet Referral Unit (CTIRU), and that the relevant blocklists are implemented and regularly updated.

·        Confirm that IWF and CTIRU blocklists cannot be disabled, overridden or altered by any user, including system administrators. Any temporary exception to filtering should be approved by the designated SLT lead, documented, time-limited and assessed by the DSL for safeguarding implications.

·        Check that student and staff profiles are appropriately differentiated. The DfE says schools should not use one blanket profile for all users; consider age, role, year group, subject and legitimate teaching requirements.

·        Ask specifically how the system handles images, audio, video, multiple languages, misspellings, abbreviations and attempts to bypass filtering using VPNs, proxies or other circumvention methods.

·        Test Safe Search settings. Ensure they are enabled by default, locked into the chosen browser and cannot easily be changed; check whether pupils can download alternative browsers or unauthorised plugins.

·        Do not assume browser filtering covers apps. Ask the provider which mobile apps, embedded browsers and cloud services are filtered, what monitoring is applied where filtering is not available, and what happens when a pupil uses a device away from the school network.

·        Check what protection is provided for encrypted traffic and dynamic content. Ask the provider to explain the technical limitations clearly, including where content within an otherwise permitted site or app cannot be inspected.

·        Use a recognised test tool, such as SWGfL’s Test Filtering service, to check that illegal child sexual abuse material, unlawful terrorist content and adult content are blocked. Record the test, date, device/network used and outcome.

·        Check the balance between safety and access. Review reports of over-blocking with teaching staff and make controlled changes where legitimate curriculum content is being blocked – without weakening protections for illegal content.

·        Before issuing a new device or service, test that the agreed filtering settings are active. After equipment or system changes, seek assurance that filtering continues to work.

·        Complete a Data Protection Impact Assessment (DPIA) for technical filtering/monitoring arrangements as appropriate, and review provider privacy notices. Be transparent with users about what data is collected, why and how it is used.

Generative AI: questions schools should now be asking

The DfE’s 2026 updates specifically draw attention to generative AI and the need to assess whether systems can deal with real-time, dynamic, personalised and AI-generated content. When introducing learner-facing AI tools, schools should:

·        Identify which AI tools pupils and staff can access, including tools embedded in other platforms, browsers and apps.

·        Ask suppliers how harmful prompts and outputs are filtered throughout an interaction, including images and other multimodal content, and how protections vary by age and user need.

·        Ask whether the product can alert an appropriate school contact to harmful activity or a possible safeguarding disclosure, and what activity logs are available.

·        Review the DfE Generative AI: product safety standards when assessing products. These standards are primarily aimed at developers and suppliers, but can help schools ask informed procurement and assurance questions.

·        Do not assume the school’s web filter can see or moderate everything happening inside an AI application. Record any limitations and decide what additional controls, supervision or restrictions are needed.

Questions for leaders and governors

·        Can the school demonstrate that filtering works across the devices, locations, accounts and apps pupils actually use?

·        Are illegal-content blocklists protected from being overridden, including by administrators?

·        Can the school explain its provider’s limitations around encrypted, dynamic and AI-generated content – and what it does to mitigate them?

Strand 4 – Have effective monitoring strategies and incident-response arrangements

Why it matters

Monitoring does not prevent access; it identifies activity that may require a response. It may include staff supervision, device-monitoring software and network or web-traffic logs. The approach should reflect the school’s context and risk profile, and must be supported by sufficient staff capacity, clear escalation arrangements and recorded follow-up.

Practical actions for schools

·        Write a monitoring plan that explains which methods are used, which devices and users are covered, what activity generates alerts, who receives reports and how concerns are prioritised.

·        As a minimum, arrange weekly monitoring reports highlighting incidents and immediate reports for high-risk incidents – including malicious, technical or safeguarding concerns. Confirm who checks each report and how missed or unacknowledged alerts are escalated.

·        Ensure monitoring works on-site and off-site for school-managed devices. Where pupils use mobile devices or apps, confirm that technical monitoring is applied because filtering may not capture app content.

·        Check that reports are understandable and sufficiently detailed to identify the user, device or account, the activity, and the time/date. Resolve gaps in user attribution, including guest accounts where possible.

·        Ensure staff supervise pupils in person when they are using devices in lessons. Technical monitoring is not a substitute for active classroom supervision or staff awareness of what pupils are doing.

·        Agree an incident-response process covering safeguarding, malicious use and technical faults. Specify who leads, how quickly action is expected, when the DSL must be informed, when IT support is involved and when external agencies may need to be contacted.

·        For each incident, record the alert or concern, date/time, relevant context, who reviewed it, decisions made, action taken, referrals or support offered, outcome and any further monitoring required. Link to the school’s safeguarding recording system where appropriate.

·        Review alert thresholds and report volumes. Check whether alerts are being missed, duplicated or generated without useful context, and whether staff have enough time and expertise to respond.

·        Ask the provider for role-specific training and refresher training. Ensure technical staff understand safeguarding escalation, and DSLs understand how to interpret monitoring information and its limitations.

·        Tell users that monitoring is in place. Include the arrangements in acceptable use policies, online safety and safeguarding policies, privacy notices and relevant staff/pupil information.

·        Review the DPIA and provider privacy information. Limit access to monitoring data to those who need it, define retention and deletion arrangements, and ensure the school can explain its lawful and transparent approach.

Questions for leaders and governors

·        Can the school evidence weekly incident reports and immediate escalation of high-risk alerts?

·        Who checks that alerts have been reviewed and acted on – and how is this evidenced?

·        Are monitoring records linked appropriately to safeguarding follow-up, with decisions and outcomes documented?

·        Do staff understand that monitoring supports, but does not replace, supervision and reporting?

A practical 2026–27 action plan

When	Priority action	Evidence to retain
Autumn term	Confirm named SLT and governor leads; map DSL/IT/provider responsibilities and escalation contacts.	Named roles, responsibility map, escalation protocol.
Autumn term	Complete and record the annual filtering and monitoring review with DSL, IT, SLT and governor input.	Dated review, risk profile, action plan and governor assurance.
Autumn term	Audit devices, apps, BYOD, remote access, guest access and AI tools; identify coverage gaps.	Digital estate/app inventory and provider coverage statement.
Autumn term	Test filtering, safe search, blocklists, user profiles and off-site/device coverage; record outcomes.	Test logs, evidence of fixes and retesting.
Throughout the year	Check weekly monitoring reports and ensure immediate high-risk alerts are escalated.	Weekly report review log, alert and incident records.
After any significant change or incident	Reassess risks and retest affected systems; update policies, staff guidance and controls.	Updated risk assessment, change log and actions.
At least annually	Report to governors on effectiveness, incidents, limitations, actions completed and outstanding risks.	Governor report/minutes and next review date.

Useful resources and further reading

DfE – Meeting digital and technology standards in schools and colleges – https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges  Includes filtering and monitoring, cyber security and wider digital standards.

DfE – Data protection in schools: policies and procedures – https://www.gov.uk/guidance/data-protection-in-schools/data-protection-policies-and-procedures  Includes privacy notices and DPIA guidance.

ICO – Data protection impact assessments – https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-impact-assessments/  Guidance and template information.

SWGfL – Test Filtering – https://testfiltering.com/  A tool schools can use to test aspects of filtering provision.

UK Safer Internet Centre – Appropriate filtering and monitoring – https://saferinternet.org.uk/guide-and-resource/teachers-and-school-staff/appropriate-filtering-and-monitoring  Guidance, provider checklists and supporting resources.

DfE – Plan technology for your school – https://www.gov.uk/guidance/plan-technology-for-your-school  Support for assessing and planning against the DfE technology standards.

A final reminder: The strongest evidence is not simply a contract with a filtering provider or a statement that monitoring software is installed. It is a documented process showing that the school understands its risks and technical limitations, tests its systems, reviews alerts, acts on concerns and checks that improvements have worked.

Note: This briefing is intended as a practical summary, not a substitute for reading the current statutory guidance and DfE core standard in full.