Skip to main content
CyberFirst Wales Shadow AI in education blog featured image

Artificial intelligence is already being used by teachers and learners to plan lessons, revise, translate, generate resources, explain difficult concepts and organise work. But not all of that use is necessarily visible to a school or college. When people use AI tools outside agreed systems, policies or oversight, it is increasingly described as shadow AI. The challenge for education is not simply how to stop it. It is how to bring AI use into the open, so that schools can protect learners while exploring new approaches to teaching, learning and assessment.

The AI is already in the room

  • A teacher asks an AI chatbot to turn a text into three versions for learners with different reading needs.

  • A student uses another tool at home to generate revision questions before an exam.

  • Someone uploads a document to an online AI service because they need a summary before a meeting.

  • A learner asks an AI assistant to explain a difficult topic in a different way.

None of these examples necessarily involves bad intentions. Some could represent genuinely useful applications of artificial intelligence.

But there is another question to ask.

Does the school or college know that the AI is being used?

If not, we have entered the territory increasingly described as shadow AI.

The term comes from the older idea of “shadow IT”, where people adopt software, devices or online services without the organisation formally approving or managing them. Shadow AI is similar. It describes the use of AI tools, applications or features outside an organisation’s understood or approved digital environment.

Sometimes this is deliberate. Often it is not.

That makes shadow AI as much a question of awareness and culture as one of technology.

What might shadow AI look like in education?

For teachers, it might involve using a personal account on an AI service to create worksheets, generate questions, draft communications, adapt materials or summarise documents.

For learners, it could mean using a chatbot for revision, translation, brainstorming, research, writing support, image creation or help with an assignment.

These are not hypothetical patterns of behaviour.

Estyn’s review of AI in Welsh schools found teachers already using AI for lesson planning, differentiation, resource creation and report writing. At secondary level, pupils were using AI independently to summarise revision material and generate personalised quiz questions. Estyn also found that much early adoption was being led by individual members of staff, while strategic approaches and structured professional learning remained less common.

The picture continues into further and higher education. Jisc’s research with UK college and university learners found AI being used for writing, research, revision, note-taking, presentations, organisation and personal support. Learners repeatedly asked institutions for clearer, more consistent guidance about what kinds of AI use were appropriate.

Shadow AI therefore should not automatically be understood as people attempting to circumvent the rules.

It can also be evidence of something more useful: people have found a technology that helps them do something, but organisational practice has not yet caught up.

Why banning it does not solve the underlying problem

There are legitimate reasons for schools and colleges to restrict particular AI applications. Some services may not be suitable for children. Others may handle data in ways that are inappropriate for educational use.

But simply telling people not to use AI does not answer the educational questions AI is creating.

Learners will still encounter these systems outside the classroom. Teachers will still discover tools that can reduce workload or help them adapt materials. AI will continue appearing inside software that schools already use.

The more useful question is therefore not:

How do we stop people using AI?

It is:

What kinds of AI use support good education, and how do we make those uses safe, visible and equitable?

This matters because several different issues are becoming intertwined.

The first issue is data

Every prompt entered into an AI system is also a data exchange.

A teacher might only intend to ask for help writing a report, but the information included in the prompt could identify a learner. A student might upload coursework without considering whether the service retains that content. An AI tool connected to files or other AI services may have access to information beyond the immediate task and act on that information without the teacher or learner knowing.

Current Hwb guidance is clear that schools need to consider data protection before adopting generative AI and should undertake a Data Protection Impact Assessment and consult their Data Protection Officer where appropriate. Hwb also warns that AI tools may save information supplied through prompts and recommends understanding what data services collect and how their models are trained.

Safeguarding matters too. Hwb notes that many generative AI services were not designed with children in mind and highlights privacy, harmful content and exploitation among the risks schools should consider.

This is where unseen AI use becomes particularly important. A school cannot assess the data protection or safeguarding implications of a service it does not know is being used.

The second issue is learning

AI can make learning extraordinarily responsive.

A learner struggling with a mathematical concept can ask for another explanation. A text can be rewritten at a different reading level. Revision questions can be generated around particular weaknesses. Language can be translated. Examples can be adapted to a learner’s interests.

Estyn has already identified teachers in Wales using AI-generated scaffolds and personalised materials, including examples where it has supported learners with complex additional learning needs. Importantly, Estyn also concludes that AI works best when its use sits within a clear understanding of pedagogy and child development.

That distinction will become increasingly important.

AI creates the possibility of moving from personalised resources towards something closer to hyper-personalised learning, where explanations, tasks, examples, feedback and pathways continually adapt to the individual learner.

There is considerable potential here, particularly around accessibility and additional learning needs.

But hyper-personalisation also raises important questions.

  • What happens when two learners studying the same subject are increasingly receiving different explanations, examples and sources?

  • Who decides whether the personalised pathway is educationally appropriate?

  • How does a teacher see what a learner has been told?

  • How do we preserve shared discussion, collaborative learning and exposure to ideas that an algorithm might not have selected?

  • And how do we ensure hyper personalisation does not quietly become dependency?

These are pedagogical and ethical questions around human to system trust rather than reasons to reject the technology. AI should help us think more carefully about what good learning looks like.

The third issue is assessment

AI also complicates the relationship between learning and evidence of learning.

There is an obvious concern about learners submitting AI-generated work as their own. But the deeper question is more interesting.

If AI becomes a normal part of professional and everyday life, there will be circumstances where using AI appropriately becomes a legitimate skill.

That means education may increasingly need to distinguish between assessing what a learner can do independently and assessing what a learner can achieve responsibly with AI assistance.

Qualifications Wales is already considering precisely these issues. Its updated position statement, published in August 2026, recognises both the potential benefits of AI and the need to protect fairness, standards and public confidence. It is developing a five-year digital assessment plan that will include responsible uses of AI, while continuing to monitor AI-related malpractice.

This suggests that the discussion cannot remain limited to detecting AI-written coursework.

We may also need to ask what knowledge learners must retain, what skills they must demonstrate unaided, when AI assistance should be declared, and when effective use of AI is itself part of the capability being assessed.

The arrival of AI does not remove the need for assessment. It makes us think more carefully about what we are actually trying to assess.

A practical starting point: make the invisible visible

We suggest that schools begin by mapping existing AI use and creating a simple internal register of the tools being used by staff and learners.

That does not need to become a complicated compliance exercise.

A staff discussion could simply ask:

What AI tools are people already using? What are they using them for? What problems are those tools helping them solve?

The answers are likely to be educationally useful. They might reveal demand for better accessibility tools, more effective differentiation, workload support, translation, revision resources or learner feedback. They may also reveal services that require a closer look at safeguarding, data protection or assessment.

The aim is not to catch people out. It is to understand what is happening.

AI SAFE: four questions before using an AI tool

CyberFirst Wales’ AI SAFE framework provides a simple way of turning that conversation into everyday practice.

Sense Check

What is the AI helping me to do, and how will I check its output? Does this use support learning, or is it replacing an important part of the thinking or teaching process?

Assess Data

What information am I giving the system? Does it contain learner information, personal data, sensitive material or unpublished work? Is this an approved environment for that information?

Follow the Flow

Where is the information going? Is the AI part of another platform? Does it connect to documents, accounts or external services or other AI systems? Do I understand which systems are involved?

Evaluate Actions

What happens as a result? Is the AI simply suggesting something for a teacher or learner to review, or is it making a judgement, providing feedback, sending information or taking another action? Where does meaningful human oversight remain and who is accountable?

These questions will not resolve every issue created by AI. They are not intended to.

They create something more valuable: a habit of stopping long enough to make an informed decision.

Start with conversation

Perhaps the most important response to shadow AI is therefore cultural rather than technical.

If teachers believe they will be criticised for admitting that they experimented with an AI tool, they are less likely to discuss it.

If learners believe that every use of AI will automatically be treated as cheating, they have little incentive to tell teachers how they are actually using it.

That leaves schools with less visibility, not more.

Jisc’s work with students and learners points in another direction. Learners are asking for clear rules, but they are also asking to participate in shaping them. They want to understand where AI helps, where the boundaries are and why those boundaries exist.

That feels particularly compatible with the Curriculum for Wales.

Developing ethical, informed citizens in an AI-enabled world cannot mean shielding learners from difficult technological choices. It means helping them develop the judgement required to make those choices well.

What Next?

Shadow AI is likely to be a temporary name for a much larger change.

Artificial intelligence is becoming part of search, writing, communication, accessibility, creativity and knowledge work. In time, asking whether someone “used AI” may become considerably less useful than asking how they used it, why they used it and what role their own judgement played.

Education therefore has an opportunity to move beyond a debate framed simply around adoption versus prohibition.

  • We can ask what AI means for pedagogy.

  • We can reconsider how learning should be evidenced.

  • We can explore personalised learning without surrendering professional judgement.

  • We can protect learner data without preventing useful innovation.

  • We can involve young people in decisions about technologies that will shape much of their future lives.

The first step is surprisingly simple. Bring the AI use that is already happening into the conversation.

Because we cannot teach safe, critical and confident use of technology that nobody is willing to talk about.

Want to know how AI is already being used in your school, and whether that use is safe, visible and supporting learning?

We’ve created free, practical staff resources to help turn the Shadow AI conversation into action. The pack includes the AI SAFE poster, quick-reference card for everyday decisions, and staff and learner activities to uncover current AI use, identify opportunities and spot areas where clearer guidance may be needed. Ideal for staff meetings, tutor time, INSET, professional learning and school AI policy discussions.

If you would like to discuss how this can be used in school, please get in touch.

News

CyberFirst Wales and Reaching Wider Partner to Unlock Technology Futures for Learners Across Wales

CyberFirst Wales and Reaching Wider have launched a new partnership to help more young people explore opportunities in technology, cybersecurity and digital careers. The initiative will connect learners…
Read more CyberFirst Wales and Reaching Wider Partner to Unlock Technology Futures for Learners Across Wales
CybereFirst News Empower girls into tech post event Featured Image

Empower: Girls into Tech showing real impact across Wales 

CyberFirst Wales celebrates the success of its pan-Wales Empower: Girls into Tech event series, which engaged nearly 800 Year 9 and Year 10 girls through hands-on technology workshops, industry-led activities and inspiring career…
Read more Empower: Girls into Tech showing real impact across Wales 

Co-producing a Strong Future for AI and Frontier Tech with techfirst Wales 

At CyberFirst Wales, we know that the strongest programmes are shaped by the people they serve. That means listening to learners, teachers, industry partners and the wider education community across Wales. Our…
Read more Co-producing a Strong Future for AI and Frontier Tech with techfirst Wales