Filtering and monitoring: your duties under KCSIE 2026

On this page

At a glance

KCSIE 2026 is statutory guidance, in force from 1 September 2026. The filtering and monitoring paragraphs are 173 to 177.
Governors should make sure filtering and monitoring is appropriate and reviewed at least once every academic year.
The IWF and CTIRU blocklists must be applied, and nobody — administrators included — should be able to override them.
Monitoring should include weekly reports and immediate alerts for high-risk incidents.
DfE says “You should already be meeting this standard.”

Filtering and monitoring is the part of school connectivity where the rules are firmest. Keeping children safe in education (KCSIE) is statutory guidance: schools and colleges in England must have regard to it. KCSIE 2026 replaced the September 2025 version and has been in force since 1 September 2026. It uses “must” for legal requirements and “should” for advice to follow unless there’s a good reason not to.

What KCSIE 2026 says

Paragraph 173. Governing bodies and proprietors should make sure the school has appropriate filtering and monitoring systems, and that “a review of their effectiveness is carried out at least once every academic year”. The review should be carried out by the senior leader responsible for filtering and monitoring, supported by the designated safeguarding lead (DSL) and IT support. It should check that filtering works on every internet-connected device in every relevant location, and keep a record of those checks. Governors should weigh the number and age range of children, those at greater risk, how often they use the IT system, and the “proportionality of costs versus safeguarding risks”.

Paragraph 174. What counts as “appropriate” is for each school to decide, informed partly by its risk assessment under the Prevent duty.

Paragraph 175. The DfE filtering and monitoring standards say schools should:

identify and assign roles and responsibilities;
review provision at least once a year;
block harmful and inappropriate content without unreasonably affecting teaching and learning;
have effective monitoring strategies that meet their safeguarding needs.

Paragraphs 176 and 177. Schools can check themselves against the standards using DfE’s free Plan technology for your school service. Governors should review the standards and discuss with IT staff and service providers what more needs to be done. KCSIE points to the UK Safer Internet Centre’s “appropriate” filtering and monitoring guides, the SWGfL test tool, DfE’s buying advice and DfE’s product safety expectations for generative AI.

KCSIE also says all staff should get safeguarding training at induction that includes “an understanding of the expectations, applicable roles and responsibilities in relation to filtering and monitoring” (paragraphs 12 and 153), and that the child protection policy should cover online safety, including “appropriate filtering and monitoring on school devices and school networks” (paragraph 169). It groups online risks into the 4 Cs: content, contact, conduct and commerce.

What the DfE standard adds

For all four parts of the filtering and monitoring standard, DfE says: “You should already be meeting this standard.”

Roles

Governors or proprietors hold strategic responsibility and should assign a governor and a senior leader. The senior leadership team buys the systems and records decisions about what is blocked or allowed. The DSL leads on safeguarding and online safety. IT support maintains the systems and runs reports.

Review

Review at least once each academic year, and record it. Also review when a safeguarding risk emerges, when working practices change (for example remote access or bring-your-own-device), when new technology such as generative AI arrives, after major software updates, and when network or device settings change. DfE recommends the SWGfL testing tool.

Blocking

The IWF and CTIRU blocklists must be applied and must not be overridable by any user, administrators included.
The filtering provider should be an IWF member and signed up to CTIRU.
Use separate profiles for pupils and staff.
Cover school devices (including off site), personal devices (on a separate network) and guests.
Block VPNs and proxies.
Log the device, IP address, user where possible, time and the blocked content.
Enforce and lock safe search.

Monitoring

Monitoring is reactive. Plan for weekly incident reports and immediate alerts for high-risk incidents. Tell users that monitoring is in place, reflect it in your acceptable use policy and privacy notices, and complete a data protection impact assessment (DPIA). Technical monitoring doesn’t replace supervision.

Checking a provider

The UK Safer Internet Centre publishes “Appropriate Filtering” and “Appropriate Monitoring” guides. Providers can self-certify against its checklist, and their responses are published on its website.

For filtering in other nations, see Wales, Scotland and Northern Ireland. KCSIE applies to England only.

Sources

Checked 25 October 2026. We wrote this guide from these sources, in our own words:

Keeping children safe in education (collection page) (gov.uk)
Keeping children safe in education 2026 (PDF) (assets.publishing.service.gov.uk)
DfE: Filtering and monitoring core standard (gov.uk)
UK Safer Internet Centre: Appropriate filtering and monitoring (saferinternet.org.uk)
DfE: Plan technology for your school (plan-technology-for-your-school.education.gov.uk)

Broadband for Schools is an independent guide. We are not a broker, a reseller or a supplier, and we are not connected to the Department for Education, any local authority or any provider. Spotted something out of date? Tell us.