The AI-tools-in-school policy framework every Indian ICT lead needs: a four-tier acceptable-use template for CBSE, ICSE and state-board schools (2026)

In October 2026 the ICT lead at a mid-sized CBSE school in Hyderabad walks into the Principal's office with the same question for the seventh time this month. A Class 10 pupil has submitted a social-sciences project that the subject teacher thinks is partially AI-generated. The teacher wants to know what the school's policy is. The ICT lead has to tell him that the school does not have a written policy, that the ad-hoc decisions have been different each time, and that the staffroom conversation this morning included four different confident opinions about what is "obviously" acceptable. The Principal nods, says "we need something written", and books a meeting for next week. The ICT lead walks back to the lab wondering what, exactly, to put in the Google Doc that is now her job to produce.

This piece is the Google Doc. It is the four-tier AI-tools acceptable-use policy framework an Indian ICT lead can adapt for a CBSE, ICSE or state-board school in October 2026, with the four tiers explained, the age scaling, the exam-window hardening, the staffroom conversation script, the Principal conversation, the DPDP data-residency question, and the honest limitations. Written for ICT leads but equally useful for Principals, Student Welfare Coordinators, curriculum coordinators and parents who want to understand what a reasonable school policy actually looks like in late 2026.

Why the AI-tools question has become urgent for Indian schools

Three forces have converged through 2024, 2025 and 2026 to make the AI-tools-in-school question an urgent one for Indian school leadership:

• Pupil adoption is universal. By October 2026, essentially every Class 9 and above pupil at an Indian metropolitan school has used a generative AI tool at least once; a substantial fraction use one weekly or more. Younger pupils (Classes 6 to 8) are catching up fast; the tools have been integrated into mainstream search engines, phone keyboards and ed-tech apps in ways that make incidental use near-impossible to avoid.
• Teacher confidence varies widely. Some teachers have become fluent, use AI tools in their own lesson planning, and have developed classroom routines that treat AI as a tool rather than a threat. Others are still at the "I'm not sure how to tell if a pupil used it" stage. The gap within the same staffroom is wide; the ad-hoc decisions it produces are inconsistent.
• Board and regulator guidance is evolving. CBSE, ICSE and state boards have issued circulars acknowledging AI tool use in classrooms; the guidance has become more specific through 2025 and 2026 but still leaves many operational questions to individual school judgement. Your legal counsel and the current board circular for your school are the authoritative sources on what is specifically required or prohibited.

A written four-tier policy addresses the "we need something consistent" need, provides the frame for the staffroom conversation, and gives the Principal something to point to when a parent or inspector asks what the school's position is.

The four tiers, explained

Tier 1: Allowed (use freely, no attribution needed)

Tools and uses that function as accessibility or productivity utilities, not as content sources. The pupil is not getting an idea or a draft; they are using a tool to communicate what they already know.

Specific examples:

• Spell and grammar check. Including AI-powered spell/grammar built into word processors.
• Short-phrase translation. A pupil checking the Hindi equivalent of a short English phrase for a Social Studies answer; a pupil checking the English equivalent of a Marathi idiom.
• Voice-to-text accessibility. For pupils who need it; also widely used for note-taking.
• Simple reference lookups. Finding the capital of a country, converting units, checking a date. Where the AI tool is functioning as a search engine with a chat interface, not as a content generator.

The test for Tier 1: the AI tool is not writing the pupil's answer; it is helping the pupil communicate or find a specific fact.

Tier 2: Allowed with attribution (disclose AI assistance)

Uses that genuinely help the pupil think and produce their work, but where the AI's contribution needs to be visible to the teacher assessing the work. The analogy to show-your-working in Maths is exact: the method matters, so the method must be visible.

Specific examples:

• Essay brainstorming. A pupil asks an AI for five possible themes to explore in a history essay; chooses one; writes the essay themselves. The AI shaped the direction; the pupil wrote the content.
• First-draft help. A pupil asks an AI for a first-draft paragraph on a topic they then substantially rewrite in their own voice. The AI reduced the blank-page friction; the pupil produced the final work.
• Code-snippet generation (CS classes). A pupil asks an AI for a specific function implementation; verifies it works; integrates it into their larger program. The AI accelerated a specific sub-task; the pupil architected the whole.

The attribution standard: at the end of the submitted work, the pupil adds a short "AI-assistance disclosure" (one or two sentences) stating which tool was used, for what, and how. The teacher assesses the pupil's actual contribution with this disclosure in view. Pupils who learn to disclose honestly in Class 9 have the right habit for college, where attribution standards tighten.

Tier 3: Sandbox only (supervised, specific contexts)

Uses that are genuinely valuable educationally but that require teacher supervision and specific curricular framing to work. Not everyday pupil-independent use; specific-lesson use.

Specific examples:

• Debate preparation. Pupils in a formal debate class use an AI tool to generate counter-arguments they then anticipate and prepare rebuttals to. The teacher runs the exercise; the tool is used within the lesson.
• Specific Computer Science class exercises. Advanced CS classes may use AI tools as a teaching surface (comparing AI-generated code with pupil-written code; critiquing AI-generated solutions; studying prompt engineering). Again, teacher-run, specific-lesson.
• One or two school-approved tools. Rather than allowing any AI tool, the school picks one or two (with the DPDP question answered for those specific tools) and the sandbox use happens only on those.

The sandbox pattern makes two things possible: pupils learn to use AI tools skillfully in supervised contexts (which is important), and the school limits the data flows to tools whose data-handling has been reviewed (which is a DPDP question we come back to).

Tier 4: Blocked (no AI tool use, enforcement in place)

Contexts where AI tool use is explicitly not permitted and where the school's technical environment should enforce the restriction, not rely on pupil self-regulation.

Specific examples:

• All graded assessments. Any work submitted for marks: unit tests, mocks, boards, project submissions, term papers, class tests. The pupil's own work only.
• Specific curricular assessments. Where the subject-teacher is specifically assessing a skill the AI tool would replace (handwritten essay writing, mental maths, in-class problem solving).
• Exam-window lab-PC environment. From the day before any proctored test, the ICT lab PCs are hardened: AI-tool access blocked at the browser and OS layer, screen recording blocked, USB disabled, specific websites and apps allow-listed only. The board-exam phone protocol piece covers the family-side rhythm; this is the school-side version.

The enforcement for Tier 4 cannot rely on honour code alone. The ICT lead's job is to make the environment enforce the rule so the pupil does not have to resist the temptation.

The age scaling: how the framework applies at different classes

The four-tier framework is the same across the school; what changes is how much of it applies at each age. The scaling we recommend:

Classes 1 to 5: teacher-led only

No pupil-independent AI tool use. Where AI tools are used in these classes, the teacher is running the exercise, the content is projected to the class, and the pupils are observing or responding verbally. The pupil does not have individual access to the AI tool. The reason is developmental: at this age the risk of AI-tool use becoming a substitute for the specific cognitive skills the pupil is building outweighs the educational benefit.

Classes 6 to 8: Tiers 1 and 2 with supervision

Pupils can use Tier 1 uses (spell check, translation, voice-to-text) with minimal supervision. Tier 2 uses (brainstorming, first-draft help) are permitted with teacher supervision; the attribution requirement is in place and pupils are specifically taught how to disclose. Tier 3 (sandbox) and Tier 4 (blocked) apply as described. The specific focus of these years is teaching pupils the attribution habit.

Classes 9 to 12: the full four-tier framework

All four tiers apply as described. By Class 10 pupils should be fluent in Tier 1 and Tier 2 use with proper attribution; by Class 12 they should be ready for the college-level attribution and academic-integrity standards that follow. The PTM agenda piece covers how the digital-safety conversation lands with parents at this age.

The staffroom conversation: how to introduce the policy

Writing the policy is 20% of the work. Getting the staff to adopt it consistently is 80%. The staffroom introduction we have seen work:

1. A short, specific briefing (15 minutes), not an open seminar. The ICT lead or the curriculum coordinator presents the four tiers with 2 or 3 concrete examples per tier drawn from the specific subjects the school teaches. Everyone in the room gets a one-page printable (the hero image above adapted to your school's branding).
2. Three case studies for discussion. Three realistic scenarios the staffroom debates and tier-labels together. Example: "A Class 9 pupil submits an English essay with an obviously AI-written first paragraph and a pupil-voiced rest. Tier?" The discussion surfaces where staff disagree; those are the places that need clarification.
3. Named point-of-contact for ongoing questions. One person (usually the ICT lead or an assistant head) is the designated "ask about AI" contact for the first term. Not an open channel; a specific person. Staff who are uncertain in week three have somewhere to go that is not a staffroom debate.
4. Quarterly refresh. The policy is reviewed quarterly for the first year because the tools and the use patterns are both moving fast. A tool that was Tier 3 in October may be Tier 1 by January, and vice versa.

The Principal conversation: what the ICT lead takes to the office

The policy framework works best when the Principal has signed off on the specific school adaptation. The ICT lead's 20-minute meeting with the Principal should cover:

• The four-tier framework (shown on the one-pager).
• The school-specific adaptations (which tools are Tier 3 approved, what the attribution standard looks like in this school's house-style guide).
• The exam-window hardening calendar (specific dates when Tier 4 enforcement happens).
• The DPDP question status (which tools have been reviewed for data residency, which have not).
• The staffroom briefing schedule.
• The parent-communication plan (a one-page note to parents at the end of the term explaining the policy).

Most Principals in October 2026 welcome this conversation because it answers the question they have been getting from the governing body, the inspection authorities and the parent community. The ICT lead who arrives with a draft typically gets sign-off; the one who arrives with the question gets booked for another meeting.

The exam-window hardening runbook

The specific operational practice that turns Tier 4 from policy into enforcement. For every proctored test from unit tests to board mocks:

1. D-2 (two days before): ICT lead confirms the lab PC image is current. All AI-tool browser extensions removed. All non-essential browser tabs disabled.
2. D-1 (day before): Dry run of the lab environment on five randomly-selected PCs. Specific checks: can a pupil reach a known AI tool via a search engine? Via a direct URL? Via a bookmark? If any route works, the environment is not hardened yet.
3. D (exam day): Lab opens one hour before the test. ICT lead or an assistant is in the lab from opening until pupil arrival. USB ports disabled in BIOS. Screen recording blocked. Keyboard shortcuts for new browser tab reviewed. The Monday handshake piece covers the broader operational rhythm; the exam-day protocol is a specific slice of it.
4. D+1 (day after): Lab environment reset. Normal lab image restored. Logs of the exam-day activity archived (for inspection reference) with DPDP-compliant retention.

The DPDP Act 2023 question nobody has yet answered

When a pupil types a prompt into an AI tool, that prompt is personal data (sometimes extraordinarily sensitive personal data: essay content about their own experiences, questions about their own difficulties, drafts about their family). Under the Digital Personal Data Protection Act 2023, the processing of that data by the AI tool provider is a Data Fiduciary question.

For school-approved tools (Tier 3 sandbox), the honest questions the school should have answered by its legal counsel before approving are:

• Does the tool process pupil data in India, or does it transit to a foreign jurisdiction?
• What are the tool's data-retention windows for prompts and responses?
• Does the tool use pupil-submitted content for model training by default? Can that be opted out of?
• What is the tool's response if the school exercises an access or erasure request on behalf of a pupil (see the parent rights playbook)?
• What is the tool's age-gate position? Are pupils under 18 eligible under the tool's own terms?

Our view, honestly: in October 2026 the DPDP implications of generative AI tools are an area of active legal interpretation. Your school's legal counsel is the right person to confirm the specific position for the specific tools you approve. The default school posture (do not approve any tool whose data-residency question has not been answered) is defensible until the legal landscape clarifies.

Four tiers. Three age bands. Two conversations (staffroom and Principal). One DPDP question the school should have asked its counsel. One printable page for the lab wall.

Common questions ICT leads ask about the policy

How do we detect AI-generated content in pupil submissions?

Honestly, with limited reliability. AI-detection tools exist and are used by some schools; their accuracy is contested and their false-positive rates can be meaningful. Our view: the Tier 2 attribution requirement is a far more effective tool than detection. Pupils who have been taught to disclose honestly do so; pupils who have not are no more likely to be caught by an unreliable detector than by a reading teacher who knows the pupil's voice. The staffroom conversation that teaches disclosure beats the technology that attempts to catch non-disclosure.

What if a pupil's parent is strongly opposed to any AI tool use?

Parents can opt their child out of Tier 3 sandbox exercises (because those are specific lessons, parent consent is reasonable). Tier 1 (accessibility and productivity utilities) is not really opt-outable in practice because the tools are built into word processors and search; the school can commit that the pupil's independent AI exposure in school hours remains at Tier 1 only. Open conversation with the parent, hearing their specific concern, usually finds a workable position. The parent who is categorically opposed to any AI tool exposure in a 2026 Indian school environment faces a landscape they cannot fully control; the honest conversation names that.

What about the Principal's phone, the teachers' laptops, administrative use?

Teacher use of AI tools for lesson planning, marking rubrics and administrative drafting is a separate question from pupil use. Our view: encourage it, with the same attribution standards (teachers' AI-assisted output should be visible in the house-style). Administrative use (drafting letters to parents, writing reports) should go through the same DPDP review as pupil-facing tools, because the data processed can include pupil information.

What specific tools should we approve as Tier 3 sandbox?

Deliberately not naming specific tools in this piece because the landscape is moving fast and the DPDP posture of each tool is a legal-counsel question. Your school's legal counsel can advise on the current state of the specific tools you are considering. The tool-selection criteria that work: Indian data residency available; clear age-gate position; opt-out from model training; published retention windows; documented DPDP responsiveness.

How does this interact with the specific CBSE / ICSE guidance?

CBSE issued its first circular on AI tool use in schools in 2024 and has issued updates through 2025 and 2026; ICSE has issued similar guidance with its own emphasis. The four-tier framework in this piece is designed to be compatible with both boards' current guidance; your specific school should map the framework onto the current circulars from your specific board. Where any board-specific requirement is stricter than the framework, the board requirement applies.

What about the UGC / AICTE / NAAC side for college-attached schools?

Senior-school and college-attached institutions have additional considerations because UGC, AICTE and NAAC have issued their own guidance on AI tool use in higher education. The schools and colleges solutions page covers the colleges-specific operational posture; the ICT lead at a college-attached school adapts the four-tier framework to the senior school and consults the college administration for the higher-education side.

How often does the policy need to be reviewed?

Quarterly in 2026 and 2027 while the tools and the regulatory landscape are moving fast; annually by 2028 once the environment stabilises. The specific review should ask: have any tools changed tier (something that was Tier 3 is now Tier 1 or vice versa); have any board circulars been updated; has the DPDP legal landscape shifted; are the staff case-study discussions converging or diverging. The review is a 90-minute meeting with the ICT lead, the Principal, the Student Welfare Coordinator and a representative of the subject-head group.

How does SafeAnywhere help enforce this?

Three specific ways. The SafeAnywhere Browser's AI-aware filtering lets the ICT lead configure which AI tools are reachable on which categories of device under which policy profiles; the Guard app on tablets and ICT lab PCs enforces the same policy at the OS layer so pupils cannot bypass by opening a different application; the dashboard surfaces which tools are being accessed from which pupil accounts, which supports the Tier 4 exam-window hardening and the quarterly policy review. The policy is the governance; SafeAnywhere is the enforcement mechanism. We do not read the content of pupil prompts or AI responses; the signals are access-level only.

What about the pupil who says "but I use it at home anyway"?

Honest and common. The school's position is: at school, the policy applies; at home, the family's rules apply. The parent-app weekly review piece covers the home-side rhythm. Where the two environments are aligned (because the parent WhatsApp group has shared the piece and the family has adopted a congruent approach), the pupil's experience is coherent; where they differ, the pupil adapts to the context they are in. The school's job is to be clear about the school context; the parent's job is to be clear about the home context.

The honest bottom line

By October 2026 every Indian school needs a written AI-tools acceptable-use policy. The four-tier framework (Allowed / Allowed with attribution / Sandbox only / Blocked), scaled by class (Classes 1 to 5 teacher-led only, 6 to 8 Tiers 1 and 2 with supervision, 9 to 12 the full framework), with exam-window hardening and the DPDP data-residency question answered by legal counsel, is a defensible, operationally usable position that works across CBSE, ICSE and state boards. The policy is the governance; SafeAnywhere's Browser, Guard app and dashboard are the enforcement mechanism. The staffroom conversation that teaches the policy is 80% of the work; the Google Doc is 20%. Print the four-tier framework from the hero image; take it to the Principal's office this week.

Four tiers. One printable page. One conversation that gets the whole staffroom reading from the same policy.