AI Governance and Compliance in Schools

Short answer

AI governance and compliance in education: how they fit together

AI governance and compliance work together. Compliance is what a school must do: follow student privacy laws such as FERPA and COPPA, state guidance, district policy, and the terms of vendor and data privacy agreements. Governance is how the school makes that happen every week, through named owners, a tool approval process, clear records, staff training, and regular review.

Use this page as part of a connected review: understand the purpose, consider the people affected, check the relevant safeguards, and follow the related routes for practical next steps.

Many schools treat compliance as a box to tick when a new tool arrives. In practice, the obligations last as long as the tool is in use, and they apply to every class that uses it. Governance is what turns a one-time check into steady habits. This guide explains the main sources of obligation in general terms and how to build them into ordinary school routines.

Where a school's AI obligations come from.

A school's AI obligations rarely come from one place. Federal student privacy laws set a baseline. FERPA protects the privacy of student education records, and COPPA covers online services that collect personal information from children under 13 and generally requires verifiable parental consent. Many states add their own student privacy laws or guidance on AI in schools, and these can be more specific than the federal rules. Knowing which apply to you is the first step.

Closer to home, district policy and board decisions set local expectations, such as which tools need approval or how student work may be shared. Then there are the agreements the school signs. Vendor terms and data privacy agreements say what a company may do with student information, how long it is kept, and how it is deleted. Each of these is a real obligation, and each needs someone who knows it exists. When a contract is signed by one office and the tool is used by another, that knowledge can easily get lost.

None of this needs to be memorized by every teacher. What matters is that the school has a simple map: which rules apply, to which tools, and who checks them. This guide is not legal advice, so confirm specific questions with your privacy reviewer, your counsel, or your state education agency, and keep a note of the answers you receive.

How governance turns obligations into everyday habits.

Compliance describes the destination, and governance is the route. A privacy law might say student records must be protected, but it does not say who in your school checks a new tool before a teacher signs up. Governance answers that question. It names the person, describes the steps, and makes sure the answer is the same whether the request comes in September or in May. It also gives staff confidence, because they know the steps before they need them.

Imagine a middle school where a science teacher wants to try an AI tool that gives students feedback on lab reports. In a school with good habits, she sends a short request to the privacy reviewer. The reviewer checks whether the tool collects student information, whether the vendor will sign the district's data privacy agreement, and whether it fits the school's AI policy. The teacher hears back within a week, with a clear yes, no, or not yet.

Those same habits matter after approval. Staff need a short rule about what they may enter into each tool. Leaders need a way to notice if a tool starts being used for something new. Concerns from families or students need a named place to go. Each habit is small on its own. Together, they are what compliance looks like on an ordinary school day.

The records worth keeping, and why they help.

Good records are the clearest sign that a school takes its obligations seriously. They do not need special software. A shared folder and a simple register are enough for most schools. The register lists each approved AI tool, its purpose, which groups may use it, the agreement that covers it, the date it was reviewed, and the person who approved it. Add a column for the next review date, so nothing slips quietly out of date.

Alongside the register, keep the signed agreements, short notes from each tool review, and a log of concerns and how they were resolved. When a tool is retired, note the date and whether the vendor confirmed that student information was deleted. These details are easy to record at the time and very hard to rebuild months later, when a parent asks a question or a new leader joins the school.

Records also make review faster. Instead of starting from scratch each year, the team can look at what was approved, what changed, and which concerns came up. Over time, the records tell the story of how the school made its choices. That story builds trust with families, staff, and the district, because it shows decisions were made with care. It also means that when the district or a family asks how a decision was reached, the answer is already written down.

Who to involve, and common mistakes to avoid.

Compliance work goes best when it is shared. A school leader owns the overall approach. A privacy or technology lead reviews tools and agreements. Teachers explain how tools are really used in class, which often reveals questions a contract never mentions. The district office or a legal adviser can answer harder questions. Family and student voices help the school explain its choices in words people understand. When each person knows their part, no single role has to carry everything.

One common mistake is treating approval as the end of the work. Tools change their features and terms, and a tool approved for teachers may later be used with students. Another is relying on a vendor's general statement instead of a signed agreement. A third is writing rules that only experts can follow. Each is avoided by the same habits: named owners, written records, and a regular look at what is happening in practice. A fourth is keeping everything in one person's head, which leaves the school stuck when that person is away.

What good looks like over time is quiet and steady. New tools move through the same review, records stay up to date, staff know who to ask, and the yearly review finds small adjustments rather than surprises. Some schools choose school-managed AI tools to help with this. Ethos, for example, is aligned with FERPA, COPPA, GDPR and SOC 2 and offers school-controlled data, role permissions, usage visibility, and audit trails, which can support the records a governance team keeps. The school's own review and agreements still come first.

Know your sources. List the laws, state guidance, district policies, and agreements that apply to each AI tool you use.

Name a privacy reviewer. Choose one person who checks new tools and agreements before anyone enters student information.

Keep a tool register. Record every approved tool, what it is used for, who can use it, and which agreement covers it.

Check it in practice. Confirm regularly that tools are used the way the agreement and policy describe, not only on paper.

Records to keep:

A list of approved AI tools and their uses.

Signed vendor and data privacy agreements.

Notes from each tool review and decision.

A log of concerns raised and how they were resolved.

Questions to ask a vendor:

What student information does the tool collect?

Who can see it, and how long is it kept?

Can the school ask for information to be deleted?

Will the vendor sign our data privacy agreement?

Map. List every obligation that applies to your AI tools and where it comes from.

Assign. Give each obligation a named owner and a simple way to check it.

Record. Keep agreements, reviews, and decisions together in one shared place.

Revisit. Check your records each term and whenever a tool, law, or piece of guidance changes.

Use this guide to map your school's AI obligations, decide who owns each one, and set up the records that show you are meeting them.

Common questions

Quick answers to what schools and families ask most about this topic.