What the new RSHE guidance means for schools - and why deepfakes can't wait

A statutory deadline that's already here

On 15 July 2025, the Department for Education published the updated statutory guidance for Relationships, Sex and Health Education. Schools have until 1 September 2026 to implement the changes. That deadline is now weeks away, not months.

The updated guidance replaces the 2019 version and introduces the most significant changes to RSHE since it became statutory in 2020. Among the additions - one that directly concerns every secondary school in England: for the first time, the statutory guidance explicitly names deepfakes, AI-generated content, and AI chatbots as topics that must be taught. (For context on the broader curriculum gap, see our piece on what the national curriculum currently says about AI.)

This isn't optional enrichment. It isn't a recommendation. It is a statutory requirement, in force from the first day of the September 2026 term.

What the guidance actually requires schools to teach

The updated guidance introduces specific requirements at secondary level (KS3 and KS4) covering AI and deepfakes. Schools must now ensure pupils are taught:

The updated Keeping Children Safe in Education (KCSIE) guidance - the statutory safeguarding guidance that all schools must follow - also references AI deepfakes explicitly from September 2026. The two pieces of guidance land simultaneously, creating a dual compliance requirement that arrives on the same date.

Why this is genuinely urgent

The September deadline has been known since July 2025. But knowing a deadline is coming and being prepared for it are two different things. A significant number of secondary schools are entering the summer of 2026 without having fully addressed these requirements.

The challenge is not awareness - most school leaders know the guidance has changed. The challenge is delivery. Teaching pupils about AI-generated sexual imagery, the law around deepfakes, and how to recognise and respond to synthetic media requires confidence and knowledge that many teachers simply haven't had reason to develop. That's not a criticism of anyone. It's a structural gap.

The PSHE Association - the official subject association for this area - has been developing new teacher training courses specifically because the new requirements demand subject knowledge that most PSHE teachers weren't trained for. The DfE itself acknowledged it was "considering how best to support teachers to deliver the content" before the September deadline. Oak National Academy has released 80 free lessons to help schools address the online safety content.

Resources exist. But resources and confident, credible delivery in a classroom are not the same thing.

What the research tells us about the problem

The guidance didn't arrive in a vacuum. It arrived because the problem is already here, already in schools, and already causing harm.

Research published in 2026 found that sexualised deepfakes were already occurring in UK school contexts - between pupils in the same year groups. Teachers reported not knowing how to respond because they hadn't been trained for it. The research found that students had received no explicit education on the topic despite incidents actively taking place.

The National Crime Agency has warned that blackmailers are scraping school websites - taking named, identifiable photos of pupils - and using AI tools to create explicit images, then demanding payment. This isn't a theoretical future risk. It's a documented, named, current threat.

Childline is already receiving calls from young people who have been sent fake explicit images of themselves - built from their social media photos, with no prior contact from the person who made them. The pupil hadn't done anything wrong. They simply existed online.

What this means for primary schools

The statutory deepfakes requirements sit at KS3 and KS4. But the updated guidance makes clear that online safety - including critical thinking about what pupils see online - remains a core requirement at primary level too.

More practically: the Year 6 pupils leaving primary school this summer are walking directly into Year 7, where deepfakes education is now a statutory requirement. Schools that have given those children no foundation - no shared understanding of what AI is, how it can generate content, and why that matters - are sending them into secondary education without the context they need.

The guidance explicitly recognises the value of careful sequencing - "supporting and equipping pupils with the knowledge to navigate different experiences in a positive way before they occur." A Year 6 AI literacy session is exactly that: foundational preparation before the statutory content arrives in Year 7.

What the guidance says about external providers

Schools are permitted - and in many cases will need - to use external providers to deliver some of this content. The guidance is clear that "schools always remain responsible for the content and the way in which children are taught" and that schools should "check that external resources are accurate, age and stage appropriate and unbiased."

If a session will be delivered by an external party, the school must ensure they understand their safeguarding obligations. The designated safeguarding lead should be present or immediately available. Schools should confirm that external providers have the appropriate DBS clearance and understand the school's disclosure procedures.

This is a well-established model. Schools bring in external specialists to deliver content that requires knowledge and confidence teachers don't always have - drugs education, sexual health, mental health. Deepfakes and AI literacy is the newest addition to that list.

Five things secondary schools should do before September

1. Audit your current PSHE provision against the new guidance. The PSHE Association has a free audit tool. Identify where the AI and deepfakes content currently sits - or doesn't sit - in your programme of study.
2. Identify who will deliver it and whether they need support. Not every PSHE teacher will feel confident with this content. Be honest about where training or external support is needed.
3. Ensure your DSL is briefed. The KCSIE update lands simultaneously. Your designated safeguarding lead should understand the new requirements and be aware that RSHE sessions on this content carry an elevated risk of disclosures.
4. Consult parents. The guidance requires proactive parent engagement. Parents should know what is being taught and be able to access the materials. This is a statutory expectation, not optional.
5. Don't wait for the perfect solution. Schools that spend September still planning are already behind. An imperfect session delivered in September is better than a perfect session planned for January.

The updated RSHE guidance is not a bureaucratic box-tick. It reflects a genuine and growing harm that is already affecting young people in schools across the country. The September deadline exists because the DfE recognises that pupils can't wait for a policy process to catch up with the technology they're already navigating.

The question for school leaders is not whether this content needs to be taught. It does, and from September it must be. The question is whether your school has a credible plan to deliver it - and whether the young people in your care will leave that session better equipped to navigate a world where AI-generated content is already everywhere.