KCSiE 2026: Annex A Moved, And The 3-Day DBS Rule You Missed

This is the education commute. Both voices on this show are synthesized. The judgment isn't. So it is exactly 20 to 11 in the morning. You are your mid explanation. The whiteboard behind you is just completely covered in your own handwriting. You were totally in the zone. And then a kid two rows back puts their hand up. And I mean, just from the shift in their posture, you know immediately this has absolutely nothing to do with the lesson plan. Oh, not a chance. They are holding a phone tucked low.

right under the desk and the screen is tilted towards you, almost like it is this this heavy secret that only you are allowed to see. So you walk over, you look down and on that screen is a picture and is a picture of someone sitting right there in your class. But the picture isn't real. Well, not in the physical sense anyway. Someone has run a photograph through a generative A .I. app. Right. So you are looking at a hyper realistic image of an event that never actually happened, featuring a person who never once posed for it.

and it has been doing the rounds of the group chat all morning before break time. Yeah and you have maybe what four seconds to decide what happens next like do you stop the lesson entirely do you know how to handle this calmly in front of 30 other sets of eyes in that room and crucially do you even know the exact vocabulary to use for what you were looking at because If your brain reaches for the word sexting, your training is already dangerously out of date. It really is.

That four second window is the terrifying reality for staff right now. If the framework you are relying on was written before a teenager could just type a prompt into their phone and generate a fake image in nine seconds, you are operating entirely blind. Which is exactly why we are pulling apart the massive 200 page rewrite of the statutory guidance rule book today. We're looking at keeping children safe in education, often referred to simply as KCC. Yeah, the absolute bedrock of safeguarding in schools. Exactly. So our mission today is to cut through the noise, examine the actual text of the source material, and separate what has genuinely changed from the wild rumors currently bouncing around the staff room all ahead of that fast approaching September 1st compliance date.

And it is an essential exercise, because when you are that subject teacher standing there with four seconds to react to a digital crisis, you do not have the luxury of flipping to a page reference. No, definitely not. You need to know the mechanics of the framework you are legally bound to, and you need to know it cold. But let me stop you right there, because before we even get to the digital crisis, I see this exact timeline confusion happen every single summer. The 2026 edition of the guidance is already published.

It is sitting right there online staring at everybody. Yeah, it is. So if a school reads that summary today and starts implementing those 2026 rules tomorrow morning, are you telling me they are actually breaking protocol? Yes, technically they are. I mean, this overlap causes a massive amount of friction. People see a document published and naturally assume it is active. Right, because why wouldn't you? Exactly. But the document that is actually in force this week, like today, is still the 2025 edition of KCC. The 2026 edition does not legally take over until the 1st of September.

So we have schools across the country either implementing the wrong document early or they're working from a quick summary of what was until very recently, just an un -finalized draft. Precisely. And working from summaries is incredibly dangerous when the literal numbering of the rule book has changed, which actually brings us to the biggest staff room myth currently circulating. Oh, the Annex A disaster. Yes. I have heard so many people confidently declare, well, Annex A has been scrapped, so you have to read part one in full now.

It sounds so plausible. You know, it sounds exactly like the kind of confident claim a middle leader makes once at a morning brief. and then nobody ever bothers to fact check it. Well, it sounds plausible because half of it is entirely true. Right. The old Annex A, which served as a sort of condensed cheat sheet for part one, that genuinely is gone. The new statutory guidance is explicit that staff are now expected to read part one in its entirety. But where the claim falls apart is the idea that Annex A itself has been scrapped, right?

Because if you open the 2026 document, There was an Annex A sitting right there in the index. Exactly. Wait, let me make sure I am understanding the sheer bureaucracy of this. Are you saying they essentially just re -lettered the chapters and inadvertently created a massive compliance risk? Because that sounds like an administrative nightmare waiting to happen. That is exactly what happened, yeah. Every Annex simply moved up a letter to fill the gap left by the old cheat sheet. So what used to be Annex B, the section covering cyber crime and domestic violence, that has just been renamed.

That is the new Annex A. Oh, wow, I can picture the fallout from this so clearly. You have the staff from Know It All who glances at the index, sees Annex A still exists, and smugly tells the newer teachers that nothing has changed and they can just read the summary like they always did. Yep, that happens. And then on the flip side, someone who heard the rumor that the cheat sheet is gone marches in and announces that part one is the absolutely only piece of reading left in the entire 200 page document.

Both of those people are completely wrong, but in entirely opposite directions. And neither of those errors is a minor typo you can just shrug off. Believing either of those myths results in staff completely missing mandatory reading on cybercrime or domestic violence. Yeah, that's huge. It is a fundamental failure to understand the statutory guidance. But enforcing these rules requires looking beyond just what people are reading and looking at the physical environment they're operating in. Because the new mandates place some incredibly heavy expectations on the premises themselves.

They really do. Let's go back to the kid with the phone under the desk. The guidance has instituted a major shift regarding mobile phones. Yes. For the first time, the guidance itself dictates that schools should be phone -free environments by default. And it frames this using nine very specific words, which are, anything else should be by exception only. Nine words doing an enormous amount of heavy lifting there. Because it doesn't just hand you a convenient buildered list of what counts as an exception, does it? Though, not at all.

It dumps that entire burden straight onto the desk of the head teacher. It forces leadership to be definitive. The head teacher has to define, document, and defend those exceptions for their own specific context. And we will definitely need to circle back to how radically those exceptions change depending on the type of school you are in. But staying with the digital infrastructure for a moment, the mandates go far beyond just the devices the students carry in their pockets. We have to look at the network those devices are trying to connect to, the filtering and monitoring reviews.

Right, the network side of things. Now, reviewing internet filtering is not a new concept, but what is actually new here? The teeth. The new guidance brings incredibly sharp teeth to this process. A verbal confirmation at a governor's meeting is no longer anywhere near enough. So no more just nodding along and saying it's fine. Exactly. The guidance now demands a highly specific, inescapable paper trail. The review must be done at least once a year. It must be conducted by a named senior leader working alongside the designated safeguarding lead, so the DSL, and IT support.

And they are expected to check every single internet -connected device in every single location on the premises. So the old system was basically an MOT test, where the mechanic just looks at the car from across the street and says, looks fine to me. Yeah, Ike said the silters are working. Pretty much, yeah. But this new mandate is an exhaustive under the hood diagnostic and a senior leader has to physically sign their name to it. That is terrifying for a leader who isn't tech savvy. They are taking personal accountability for the school's firewall against the darkest parts of the internet.

Which is exactly the point of the change. It shifts the burden from passive assumption to active documented accountability. If an inspector walks in, you have to be able to hand them an actual written record with the name senior leader and a date on it. Without that piece of paper, you simply aren't compliant. And that documented accountability dictates exactly how we log incidents, which brings me right back to our opening scenario, the fake image on the screen. The vocabulary. I cannot tell you how deep the muscle memory runs in schools for words like sexting.

Why are we officially retiring that word from the guidance? Because the word sexting carries a massive, outdated assumption. What do you mean? Well, it assumes that the child actively took a photograph of themselves. willingly posed for it, and then made a conscious choice to hit send. That language does not reflect the modern digital reality. It has been replaced throughout the document with the phrase nudes or semi -nudes. But does changing the label actually change the safeguarding response? Because I feel like some people might hear that and think it's just a semantic update to be politically correct.

It is not semantics at all. It is about mechanism. The new wording, nudes, or semi -nudes is specifically designed to encompass images that are digitally altered or completely generated. Ah, I see. Deepfakes are explicitly covered now, regardless of whether the person depicted ever posed for anything. This is completely surreal to think about as a practitioner. I am just trying to parse the philosophical way to this. I am legally required to log a picture that never actually happened. like a completely synthetic reality generated on a server somewhere.

In the exact same way, I would log a physical event that actually occurred. Yes, you are. How do you even investigate an event that never happened? Well, you investigate the harm, not the pixels. The guidance recognizes that the safeguarding response must be identical because the harm to the child whose face is on that image is entirely real. That makes a lot of sense, actually. Whether the image was a consensual sharing gone wrong, a real non -consensual image, or a completely generated fake, the humiliation, the bullying, and the safeguarding risk are identical.

The words have changed, but what has fundamentally shifted is the reality of what you are writing down on the safeguarding log. And it forces us to acknowledge where these pictures are coming from the first place. I noticed the new addition features an entirely new section dedicated specifically to generative AI. It does, yes. It is no longer acceptable for staff to just throw their hands up, say they don't understand computers, and deal with the fallout of these images. There's an explicit expectation that staff must actually understand the tools that the kids are using.

You cannot safeguard against a threat you refuse to understand. The technology is moving at such a blistering pace that the statutory guidance is having to mandate technological literacy just to keep the adults in the building relevant. But while we are frantically policing these new digital boundaries, the statutory guidance also completely rewrites the rules for the physical spaces inside the building. Yes, it does. I want to be extremely precise here because this is a highly complex legally fraught area for schools. We need to look at the new mandates on single sex spaces.

The language used here is highly restrictive. The guidance states that schools must not allow children into toilets or changing rooms that are designated for the opposite biological sex. Must not. Yes. And it explicitly notes that this applies even in situations where a school is responding to a request to support a child's social transition. OK, that must not is a hard legal floor. It is not a suggestion. But I read the text, and there is a massive operational pivot right next to it. Exactly. The strict mandate sits right next to a situational discretion.

Where the language softens from must to should is what happens in response to a request. Right. If a child does not want to use the facility designated for their biological sex, the guidance states that school should consider an alternative facility. But this is highly conditional. It must not compromise the single sex provision for everyone else. And crucially, and this is a point for leaders navigating this schools are explicitly told they're not meant to initiate this process themselves yes very important distinction the guidance only applies if a child or their parent actively raises the issue first the school cannot preemptively offer an alternative out of an abundance of caution It is an incredibly delicate balance between an absolute legal duty and situational discretion.

Knowing exactly where that legal boundary ends and your own professional judgment begins is everything when managing these requests. Okay, I'm sorry. I had to break character here for a second. I am putting on my exhausted quarter voice hat. Go for it. Because we can sit in a quiet room and parse the legal mechanism of must versus should all day long. But here is the reality from where I'm sitting. I have 30 teenagers who haven't had their morning snack. I'm holding a stack of unmarked mock exams, and I cannot be expected to parse complex legal discretion while standing on duty outside the changing rooms.

No, of course not. Nobody is going to read a 200 -page document by the 1st of September. Even if leadership points staff to Annex C, you are pointing them to six pages of dense, legalistic text that they are not going to read cold on a Monday morning training day. The administrative burden is genuinely staggering. I totally agree. It is. If leadership genuinely wants this followed, if they want these exact protocols for physical spaces and digital images adhered to, it has to fit on a one poach laminated sheet.

If this happens, say this, do this, send them here. This isn't the staff reading problem. This is a leadership communication problem. And that tension is exactly why the guidance is a framework, not a script. The translation of that statutory framework into actionable daily practice rests entirely on the school's leadership. You cannot just forward a PDF, wash your hands of it, and consider the staff trained. So true. But enforcing those physical spaces brings us to a massive shift in who is actually allowed to enforce rules in the building.

Let's move from the physical rooms to the actual human beings operating inside them, because there is a major personnel change regarding volunteers. This is a significant closing of a previous loophole. Historically, a volunteer could sit outside of what is called regulated activity, meaning they required a lighter touch background check as long as they were closely supervised by a permanent member of staff. And that's changed. That exemption has been completely removed. Wait, why was there a loophole to begin with, and what is the exact mechanism closing it?

Well, the old assumption was that proximity to a teacher equaled safety. But aligned with the Crime and Policing Act, the realization is that a teacher standing across a sports hall does not prevent grooming. It doesn't stop inappropriate whispered conversations. Right, of course. So now any volunteer who is teaching, training, instructing, or supervising children on more than three days a month or overnight is officially engaged in regulated activity. So if we think about the parent who volunteers to help out at the after school football club three Saturdays in a row, that Saturday football dad now requires the exact same level of DBS check as the head of maths.

Precisely. It applies regardless of how closely a teacher is standing next to them. They require a full background check every single time. That is thousands of phone calls schools need to make right now before September to get that paperwork moving. What else is changing for the people in the building? Two smaller, but very real operational adjustments. First, concerning the DSL. The guidance now explicitly expects a robust, proper fallback arrangement for when the DSL is away from their desk. You can no longer rely on staff just asking around and hoping to find someone.

There needs to be a designated system, like a confidential shared mailbox. Which makes perfect sense. I mean, if you're holding a serious disclosure or you only have four seconds to deal with a generated image, you don't have time to wander the corridors in a panic looking for a deputy DSL. You need to know exactly where that information goes instantly. Exactly. And the second change names young carers specifically as a distinct group with their own unique safeguarding needs. Because the burden of managing a parent's care needs at home.

Doesn't always present like a traditional safeguarding concern, does it? It might just look like exhaustion or a string of missed homework rather than the red flags we typically train staff to spot. It requires a completely different lens of observation from the staff. You are looking for absence of engagement rather than active distress. Speaking of different lenses, I want to take the concept of these specific humans in the building and apply it back to those nine crucial words regarding mobile phones. Anything else should be by exception only.

Right. Back to the phones. Because the Education Endowment Foundation might have reams of evidence on how phones impact learning and distraction. But KCC is looking at this purely through a safeguarding and operational lens. And what constitutes an exception means something wildly different depending on which room you're standing in. Context is absolutely everything here. If you look at a primary school setting. A phone free by default policy barely changes the rhythm of the day. The vast majority of primary schools already do not see a phone before pickup time.

Yeah, that's true. So the conversation about exceptions in primary is largely focused on staff devices and visitors to the site rather than the pupils themselves. But then you walk through the doors of a secondary school and it is the exact opposite reality. It is a constant battle. In secondary, that phrase by exception only is going to be tested by the students every single break time. A head teacher cannot just say the words. They have to rigorously specifically write down what counts as an exception and enforce it universally or the policy collapses on day one.

And then we zoom out to specialist settings and the whole paradigm shifts entirely again. Absolutely. In a specialist provision, the exception might actually be the rule. You might have a pupil whose primary communication device, or their vital sensory regulation app, lives entirely on that smartphone. So for that student, having the phone isn't a loophole they are exploiting. Having the phone is the entire point of the policy working correctly for their specific needs. Precisely. You have three different rooms, the exact same nine words from the statutory guidance, and three completely different operational conversations about what compliance actually looks like in practice.

Well, let's bring it all back. Let's return to that classroom at 20 to 11. You are standing there, and the phone is still being held low under the desk. You still only have four seconds to react. It is still a deeply, deeply uncomfortable moment with 30 kids watching you. But the difference is, you are no longer guessing. Right. You aren't standing there internally panicking about what to call it. You know the exact term is nudes or semi -nudes. You know, with absolute certainty that your safeguarding response is identical whether that image is a real physical photo or a generated deepfake.

Exactly. And you know exactly where to report it because you know your DSL has a confidential covered mailbox set up for when they aren't at their desk. You're operating from a place of structural confidence rather than panic. You also know exactly which rule book you're working to today. the 2025 version, not the 2026 draft someone forwarded in July. The uncomfortable reality of the situation is still there, but the uncertainty is gone. Which brings us to the immediate actions required before September. Yes, here is your call to action.

Tomorrow at break time, ask whoever's standing next to the kettle which version of KCC they think they're working to today. Just see how many confidently say 2026 that's a great test and beyond that if someone walked into your office today and asked to see your filtering and monitoring review make sure you can physically hand them a piece of paper with a name senior leader and a date on it if you can't well That is your job for this week. Because the guidance outlines the framework, but the daily execution is entirely on you.

You need to read the actual text because we can only ever be the trailer. The statutory guidance is the feature film. So as you head into the building, I want to leave you with one final provocative thought to mull over. If the statutory guidance now dictates that a generated image. You know, an event that never actually happened in the physical world requires the exact same safeguarding response as a real event that did. You have to ask yourself, are we just preparing our staff to safeguard children's actions or are we now asking them to police a reality that doesn't even exist yet?

Safe trip in. See you at the gates.