Built for the two sides of the education ecosystem: EdTech Providers proving compliance to close school sales without £20k legal fees, and School Commissioners & MATs legally required under KCSIE and Article 28 to audit vendor safeguarding before signing contracts. Evaluated simultaneously across all 10 statutory frameworks.
Amnesty International, Eurochild and 140+ child rights experts signed a joint statement ahead of the EU State of the Union — demanding mandatory pre-certification of digital services before they reach children.
The European Commission has unveiled the EU KIDS Act: a proposed law requiring digital services — including EdTech, AI chatbots and games — to prove they are safe before children can access them. Compliance plans must be assessed by independent auditors. Expedited enforcement with final decisions within 90 days.
“Reversing the burden of proof and requiring services to demonstrate they are safe before market release would finally bring tech in line with what EU consumers rely on and expect — especially when children’s welfare is at stake.” — 5Rights Foundation, 17 September 2026
Read EU KIDS Act announcement →"Children need and deserve safe, age-appropriate digital services. The EU has the power to set a bar and require tech companies to prove they meet it before accessing children."
Start your first assessment · Results in under 90 seconds
Across a two-year programme, the ICO found widespread compliance failures — not from bad intent, but from a lack of tools and capability to identify gaps. ChildSafe AI closes that gap.
“Because children often have no choice but to use these digital tools in school, there is an essential need for high standards of trust and data protection.”
ChildSafe AI eliminates the procurement bottleneck. We give EdTech providers the audit-ready evidence schools demand, and give school leaders the 60-second clarity needed to protect pupil data under statutory KCSIE and UK GDPR duties.
School tenders and Multi-Academy Trust evaluations take months because trusts demand Article 35 DPIAs, Children’s Code proofs, and KCSIE alignment that startups cannot afford to draft via city law firms.
Under KCSIE 2025/2026 and Article 28 UK GDPR, schools are the statutory Data Controller. If an EdTech vendor harvests pupil data or trains AI models, the headteacher and trust bear the liability and parental fallout.
“If AI is to benefit not undermine learning, a precautionary approach to its use in schools is critical... Develop robust procurement codes for schools, supporting their critical use of tech only if and when it can be proven to advance specific learning objectives and overall wellbeing. Children should not be guinea pigs for experimentation!”
ChildSafe AI tests your digital service simultaneously across all 10 UK, EU, and international child protection regimes. Select any framework below to inspect statutory mandates, enforcement penalties, and audit triggers.
Every analysis, every human decision, every sign-off — sealed with SHA-256 cryptography and stored immutably in Google Cloud Firestore, London UK. Tamper-proof. Regulator-ready.
No direct competitor combines all 10 frameworks, SEND analysis, EU AI Act Annex III mapping, EU KIDS Act pre-certification, and expert DPO sign-off in a single tool. Designed around research from LSE Digital Futures for Children (2026), ICO regulatory guidance and 5Rights Foundation principles.
Since 2 August 2026, all AI systems used in education are classified as High-Risk under EU AI Act Annex III. Organisations using EdTech AI without documented compliance evidence now face enforcement exposure from the EU AI Office and the ICO simultaneously.
Assess your compliance →Non-compliant EdTech AI faces enforcement by both the EU AI Office (EU AI Act) and the ICO (Children's Code). ChildSafe AI analyses both frameworks together so nothing falls through the gap.
ChildSafe AI maps your document against each mandatory EU AI Act Annex III requirement — producing the evidence your legal and technical teams need to demonstrate compliance, before an enforcement notice lands.
Continuous risk identification across all 10 frameworks — residual risks flagged with severity scoring and remediation steps.
AI-drafted DPIA provides the structured technical documentation baseline required before deployment or registration.
Identifies where human oversight mechanisms are absent or insufficient — with specific implementation guidance for each gap found.
Every report includes a children's rights assessment — covering the right to education, non-discrimination, privacy and SEND-specific protections.
Generates a prioritised remediation roadmap with implementation timelines — forming the basis of your post-market monitoring plan.
The only tool that analyses both frameworks simultaneously — so nothing falls through the gap between two regulators.
SEND and disability data is special category data under UK GDPR Article 9 — requiring an additional lawful condition beyond standard consent. Yet most EdTech privacy policies rely on legitimate interests alone, creating a direct and enforceable compliance breach.
ChildSafe AI is the first compliance tool with a dedicated SEND framework — checking Article 9 lawful conditions, EHC plan data handling, AI accuracy for SEND pupils, Equality Act accessibility obligations, and mandatory DPIA requirements.
Verbatim statements from the ICO, Ofcom, DfE and EU Commission. Every EdTech product, platform and school supplier is in scope.
Settings must be ‘high privacy’ by default (unless you can demonstrate a compelling reason for a different default setting, taking account of the best interests of the child).
These changes are a reset for children online. They will mean safer social media feeds with less harmful and dangerous content, protections from being contacted by strangers and effective age checks on adult content. If companies fail to act they will face enforcement.
Because children may not be able to choose or opt out of many digital tools their schools adopt, it is essential that parents, caregivers and pupils can trust that this technology meets the highest standards of data protection.
AI systems intended to be used to determine access or admission or to assign natural persons to educational and vocational training institutions at all levels [are classified as high-risk AI systems].
The best interests of the child should be a primary consideration when you design and develop online services likely to be accessed by a child.
Children merit special protection with regard to their personal data because they may be less aware of the risks and consequences associated with the processing of personal data and of their rights in relation to such processing.
Businesses are facing record fines, months of manual work, and a constantly shifting regulatory landscape — with no comprehensive, affordable solution. Until now.
TikTok's £12.7M ICO fine for processing under-13 children's data without lawful basis was upheld by the Upper Tribunal in August 2026 ([2026] UKUT 277 (AAC)) — confirming the ICO's enforcement powers over children's data are robust and that content-platform arguments cannot shield organisations from accountability.
Traditional DPO consulting costs £15k–£80k+ and takes significant internal time. Startups and schools require scalable, professional solutions.
UK GDPR, ICO Children's Code, DUAA 2025, Online Safety Act, KCSIE 2024, EU AI Act, DSA, EU KIDS Act 2026, UNCRC Digital and SEND Framework — all updated regularly. Keeping up requires automated, professional-grade tooling.
The ICO audited 28 EdTech providers used widely across UK primary and secondary schools. The findings confirmed systemic compliance failures across the entire sector — in products already deployed to millions of children.
“Because children may not be able to choose or opt out of many digital tools their schools adopt, it is essential that parents, caregivers and pupils can trust that this technology meets the highest standards of data protection.”
Source: ICO EdTech Examined, June 2026
At UNESCO’s Digital Learning Week, education ministers from over 25 countries called on tech companies to demonstrate AI systems’ safety and educational benefit before they are permitted to impact children. The demand is no longer coming from one regulator — it is coming from governments worldwide.
“Tech companies must demonstrate that their AI systems are safe and of educational benefit before they impact children — not after.”
Our AI-generated compliance certificate — verified by a qualified data protection professional via HITL sign-off — gives EdTech providers the tamper-evident, auditable evidence trail that regulators and governments worldwide are now demanding before AI tools enter classrooms.
From Brussels to Canberra, from Washington to Paris — governments are no longer asking tech companies to be responsible. They are requiring them to prove safety before children can access their products. The question is no longer whether this regulation is coming. It has arrived.
“AI must not be placed in the hands of children without first being tested, evaluated, and authorised.”
Safety-by-design becomes a legal obligation for all social media, gaming and AI accessible to under-18s. Introduces graduated age-tiered access from 13 and reverses the burden of proof — companies must prove services are safe before children can access them.
Following the world-first 2025 social media age ban, Australia mandates risk assessments and safety-by-design as legal obligations for all digital services. Requires providers to shield all under-18s from behavioural design features and mandates opt-out from personalised feeds.
The landmark child safety trial sets a precedent: enforcement is no longer theoretical. International pressure is mounting for Meta’s child safety changes to extend to the UK and EU. Courts and legislators are aligning — malpractice now carries nine-figure consequences.
A signed, timestamped, expert-reviewed compliance certificate — with a full DPIA, CRIA and remediation roadmap — is exactly what the EU KIDS Act, Australian Duty of Care Bill and ICO require EdTech providers to produce. Before a child accesses your product.
▶ See How It WorksTraditional DPO consulting for a single multi-framework audit costs £15,000–£80,000 and takes weeks. ChildSafe AI delivers the same depth in under 60 seconds.
Traditional consulting cost range based on UK DPO market data 2024–2026. First ChildSafe AI analysis free — no credit card required.
The difference between a compliance crisis and a compliance certificate is the right tool.
Upload a policy document or paste a live website URL — and receive a detailed compliance assessment against key UK & EU child safety regulations, with a structured DPIA and prioritised remediation roadmap.
Paste any live website URL for an instant scan — or upload your privacy policy, app description, or product document (PDF, DOCX, plain text).
Our AI scores your document against all 10 frameworks: UK GDPR, ICO Children's Code, DUAA 2025, Online Safety Act, KCSIE 2024, EU AI Act, DSA, EU KIDS Act 2026, UNCRC Digital & SEND — returning a detailed RAG report.
Your qualified reviewer inspects the AI output, applies their professional sign-off through the built-in HITL gate, and a tamper-evident compliance certificate is issued — audit-ready proof of due diligence.
Simply paste any website URL. ChildSafe AI fetches the live page, extracts compliance signals, and produces a full audit covering all 12 UK GDPR articles and all 15 ICO Children’s Code standards — in under 60 seconds.
No plugins, no browser extensions, no developer access required. Works on any public-facing EdTech platform, school website, gaming site, or app landing page.
ChildSafe AI combines expert AI analysis with human expertise — providing a comprehensive, audit-ready compliance workflow.
In-depth document analysis covering 12 UK GDPR articles and all 15 ICO Children's Code standards — pinpointing specific gaps at article and provision level.
Red-Amber-Green scoring across every framework clause, each UK GDPR article, and all 15 Children's Code standards — so you know exactly where you stand and what to fix first.
Every certificate requires a qualified reviewer to inspect, approve, and sign the AI output through the built-in HITL gate — generating a tamper-evident, legally-defensible audit record. Use your own DPO or engage our managed sign-off service.
Prepare a drafted Data Protection Impact Assessment tailored to your product — requiring DPO review before submission.
Prioritised action plan with owner assignments and deadlines — view as cards or switch to the interactive Gantt Timeline for visual 0–90 day planning.
Upload and save your privacy policies, product specs and terms of service to your secure library — ready to re-run as regulations change, without re-uploading each time.
Paste any website URL to instantly assess compliance — extracting privacy policies, cookie banners, age gates, tracking scripts and dark patterns without any document upload required.
AI-generated CRIA against UNCRC General Comment No. 25 (2021) — 8 articles assessed with RAG scores, GC No. 25 paragraph citations and mitigation actions. Outputs on your compliance certificate.
Group multiple analysed documents — DSA, privacy notice, product spec — into one Project and generate a consolidated DPIA, CRIA & Roadmap that surfaces cross-document risks no single analysis can find. Cited by the ICO's Edtech Examined audit as the highest-risk gap area.
Every analysis is timestamped and stored in a cryptographically-verified audit log — aligned with ICO AI Governance Framework 2024 & Article 22 UK GDPR. Full compliance history with per-framework RAG scores (UK GDPR %, Children's Code %) and analysis duration, stored exclusively in London, UK (Google Cloud europe-west2). Document content is never retained.
Analyse your DSA, privacy notice, product spec and website together — and surface the cross-document contradictions that single-document analysis always misses.
"70% of providers' most serious compliance failures only emerged when analysts examined the full document ecosystem — not individual documents. In some cases, AI training on children's data was only discovered during the audit."
Upload your DSA, privacy notice, product spec — run a compliance analysis on each individually to get per-document scores.
Name your project (e.g. "EduVault Compliance Review") and add all the documents you've analysed into it with one click.
One consolidated DPIA, CRIA, and 90-day Roadmap — synthesising every document simultaneously. Export to PDF.
Try free · No sign-in required for first analysis · Projects available on all plans
General Comment No. 25 (2021) is the UN Committee on the Rights of the Child’s authoritative guidance on children’s rights in the digital environment. It is increasingly cited by the ICO, Ofcom and the European Commission in enforcement and policy decisions.
ChildSafe AI is the first compliance tool to operationalise GC No. 25 — automatically screening your product against all 8 relevant UNCRC articles, citing the exact GC No. 25 paragraphs that apply, and producing a RAG-rated Child Rights Impact Assessment in under 20 seconds.
Built-in alerts cover 10 frameworks across ICO, Ofcom, DfE and the EU Commission. When KCSIE updates, when new Ofcom codes drop, when the ICO issues enforcement guidance — ChildSafe AI flags it the moment it’s published.
No separate subscriptions. No manual monitoring. No finding out after an audit that you missed a guidance change.
The UK's EdTech market alone is worth £4.5 billion — and every app, platform, and school that touches children's data must comply. That's millions of organisations with no fast, affordable solution.
Virtually every sector that serves children is affected — from gaming to healthcare, media to education. The addressable market is enormous and underserved.
ChildSafe AI incorporates all 6 compliance failure categories identified in the ICO's June 2026 EdTech Examined audit report — giving you pre-audit assurance against the ICO's own stated expectations for the sector. Read the ICO report →
Beyond classroom deployments, ChildSafe AI empowers legal and supervisory stakeholders across the education sector.
Scale your compliance capacity without scaling headcount. Use automated statutory analysis to review entire software supplier portfolios in hours, not weeks.
Execute pre-investment compliance due diligence on EdTech portfolio companies. Identify EU AI Act, KCSIE, and Children’s Code liabilities before capital deployment.
Standardise software procurement across all schools in your borough or MAT. Protect pupils with verified, independent compliance certificates.
Average analysis time
10 compliance frameworks covered
Accuracy rate vs manual audit
of EdTech providers could not demonstrate data protection by design — ICO EdTech Audit, June 2026
ChildSafe AI is available to EdTech companies, schools, law firms and DPOs. Run your first analysis now — no account required.
Run an instant compliance analysis against all 10 frameworks. No login, no data stored.
Run AnalysisNeed a qualified DPO to review and sign off your analysis? Our expert reviewers are available.
Request ReviewMulti-user access, white-label reports, dedicated DPO relationship and UK data region. Contact us to discuss.
Contact UsIllustrative feedback from beta testers
ChildSafe AI cut our compliance review time from six weeks to under an hour. The expert certificate gives our school customers the confidence they need to deploy our platform.
We recommend ChildSafe AI to every EdTech vendor we work with. The RAG scoring gives procurement teams an instant view of risk — and the roadmap tells vendors exactly what to fix.
As a two-person team, we couldn't afford a DPO. ChildSafe AI gave us a professional compliance certificate for our investor pitch — and we closed our seed round two weeks later.
Join hundreds of EdTech companies, schools, and gaming platforms using ChildSafe AI to stay compliant — and stay safe.