JULY 2025 JUST DELIVERED LEGAL PRECEDENT: When the bell rings, the duty does not end.

The line between what schools know and what they do just got a legal reckoning - by Andrea Turner Ctrl+Shft Legal Advisor

In July 2025, the NSW Court of Appeal handed down a decision that should have halted every school board meeting, inbox scroll, and policy review in the country. In State of New South Wales v T2 [2025] NSWCA, the court confirmed something that educators, lawyers, and families have been circling for years: the duty of care held by schools does not end at the school gate, nor does it dissolve after 3:15 pm.

The case didn’t hinge on dramatic new facts. It wasn’t a shocking outlier. It was about something far more uncomfortable: what happens when a school hears a warning—even faintly—and fails to act.

The ruling couldn’t be clearer. If a school becomes aware of a threat to a student, whether through a formal report, a groupchat screenshot, or an escalating pattern of behaviour, it is on legal notice. Not moral notice. Legal. The defence of “we didn’t know enough” no longer holds. The excuse of “it didn’t happen on campus” has lost its weight.

To understand how we got here, you have to go back to the moment that brought this all into the light.

In 2024, a 14-year-old autistic boy was physically assaulted just outside the boundaries of his school. This wasn’t a bolt from the blue. The school had prior knowledge of social friction and patterns of concern. But the risk was not meaningfully addressed. In T2 (by his tutor T1) v State of New South Wales [2024] NSWSC 1347, the court awarded damages to the boy’s family, not for what happened in a single moment, but for everything that led to it. The failure wasn’t isolated. It was systemic.

Now, with the 2025 appeal decision, the message has moved from pointed to permanent. The precedent is set. The law has shifted. And for schools, that shift must be more than acknowledged; it must be operationalised.

But the law doesn’t pause for complexity. And neither does human digital risk compliance.

Bullying and harassment no longer confine themselves to the school day. They metastasise through Nudify apps, vanish into disappearing messages, and gather momentum in weekend group chats. They happen in toilets, carparks, Discord servers, and livestreams. They’re shared in Snap stories at 2 am and re-emerge as taunts the next morning.

While schools carry institutional responsibility, families are being asked to do something equally difficult: raise children inside a digital ecosystem they did not build, cannot fully access, and often barely understand. Some parents don’t know what their children are doing online. Others are working multiple jobs and hoping someone will alert them if something goes wrong. Some know something is off but don’t know how to begin, or who to ask, or how much is “too much” to intervene. This isn’t about judgment. It’s about recognising that the online world has become a central arena of harm, and it is unreasonable to expect families to navigate it alone.

Schools must review their frameworks not just for what happens on school grounds, but for how they track, assess, and intervene in ongoing patterns of harm wherever they occur. It’s not enough to have a policy. There must be practice. There must be clear escalation pathways. There must be ownership, not just intention.

And across the board, we must stop confusing policy awareness with protective action. Knowing is not the same as doing. And silence is not the same as safety.

Ctrl+Shft are the Global Leaders in Human Digital Risk Compliance. Book a meeting with us today - hello@ctrlshft.global