AI governance for schools turns an AI policy into working practice. It produces decisions a district can make, evidence it can retain, and controls it can show a regulator, a board or a parent.
AI now reaches classrooms, student services, administration, as well as operations. However, a written policy alone does not show a district how staff and students actually use AI.
Teachers adopt AI writing tools, while students use AI tutors. Meanwhile, EdTech vendors add AI features that quietly change how their systems handle student data.
This guide sets out a seven-stage operating model for AI governance in schools. The model runs from identification and risk assessment through approval and monitoring, and finally to review and retirement.
It also covers the FERPA, COPPA, and PPRA questions districts most often get wrong.
of students reported using AI for school, while only 45% of principals reported any school or district AI policy or guidance. Adoption is running ahead of governance.
RAND Corporation, AI Use in Schools Is Quickly Increasing but Guidance Lags Behind, 30 September 2025. Nationally representative K-12 panels with CRPE and the MIT Teaching Systems Lab. View sourceof English language arts, mathematics and science teachers reported using AI for school. That is more than 15 percentage points above surveys from the previous one to two years.
RAND Corporation, AI Use in Schools Is Quickly Increasing but Guidance Lags Behind, 30 September 2025. View sourceof students said teachers never explicitly taught them how to use AI for schoolwork, which is why academic-integrity rules fail without matching staff guidance.
RAND Corporation, AI Use in Schools Is Quickly Increasing but Guidance Lags Behind, 30 September 2025. View sourceKey Takeaways
An AI policy defines expectations. Governance operationalizes them.
List AI tools as well as the AI features switched on inside software you already own.
Weigh data sensitivity, student impact, automation, accessibility, equity as well as vendor exposure.
Apply stronger controls to higher-impact uses. Reviewing every tool identically is what makes review collapse.
Academic integrity, accessibility, as well as transparency to students and parents, all belong in the review.
Assign owners for approval, human review, escalation as well as reassessment.
Re-run review when the model, vendor, data, purpose, retention or student impact changes.
Retain approvals, controls, reviews, incidents as well as retirement decisions.
Not only whether a tool is safe, but whether it is appropriate and useful for its educational purpose.
What Is AI Governance for Schools?
AI governance for schools is an ongoing process. It covers identifying, assessing, approving, deploying, monitoring, reviewing and finally retiring AI systems across classrooms, student services, administration and operations.
The NIST AI Risk Management Framework provides four voluntary functions, Govern, Map, Measure, and Manage, for managing AI risk across the lifecycle. However, NIST does not present these as an ordered checklist.
Rather, the seven-stage model below is a district operating model that applies those activities in a practical sequence.
How AI Policy Differs From AI Governance
| AI policy | AI governance |
|---|---|
| Defines acceptable use | Operationalizes the rules |
| Sets expectations | Assigns decision rights |
| Lists prohibited uses | Assesses and manages risk |
| Guides staff and students | Monitors implementation |
| Primarily a policy document | An ongoing operating process |
In short, a policy tells the district what should happen. Governance, by contrast, establishes who decides, which controls apply, what evidence the district keeps, and what happens when circumstances change.
The same split applies in any sector, as the enterprise AI governance framework sets out.
Why School Districts Need AI Governance
In practice, seven pressures push a school district from policy into governance. As a result, each one creates a decision somebody has to own.
1. Protect Student Data
AI tools may process education records, grades, assessments, behavioural information, student conversations, as well as disability-related information.
Before approval, establish the answers to eight questions.
- What does the system collect?
- Who can access it?
- Which subprocessors receive it?
- Does it train models on the data?
- How long does the vendor keep it?
- How does the district verify deletion?
- Which contractual restrictions apply?
- What happens to the data when the service ends?
The same questions drive any enterprise data security and privacy review.
Under the FERPA school official exception, a third party receiving personally identifiable information from education records must meet specific conditions. Three matter most.
- It performs an institutional function.
- It stays under the district's direct control over the use and maintenance of records.
- It uses the information only for authorized purposes.
Applicability is fact-specific. The rule text sits at 34 CFR Part 99.
2. Control Shadow AI
Shadow AI occurs when staff or students use AI outside the approval process. Consequently, districts improve visibility by combining procurement records, approved-tool catalogues, identity and access data, device or network signals, staff reporting, help-desk requests, and vendor integrations.
Still, no single signal discovers every unauthorized use.
3. Govern Student-Impacting AI
AI may support grading, assessment, intervention recommendations, tutoring, as well as disciplinary workflows.
Therefore, as potential student impact rises, strengthen the review. Also define who validates outputs and who can override them. Set when human review is mandatory, when an issue must escalate, and what evidence the district keeps.
For higher-impact systems, evaluate risk and educational purpose together. After all, a system can be technically secure and still be unsuitable for a particular student-facing use.
4. Protect Academic Integrity
Generative AI raises questions beyond privacy.
Districts need clear rules covering:
- Permitted and prohibited student AI use.
- Disclosure of AI assistance.
- AI in assignments and assessments.
- Teacher expectations and assessment redesign.
- The limits of AI-detection systems.
- Review when staff suspect AI-generated work.
- Appeals when a student disputes an AI-related decision.
An AI-detection result should not become the sole basis for a consequential student decision without human review and a defined district procedure.
5. Govern Accessibility and Equity
Consider whether a system works for students with different accessibility needs, languages, learning contexts, and levels of support.
Evaluate assistive-technology compatibility, required accommodations as well as multilingual access. Check for differences in outcomes across student groups, test representatively, and confirm a human alternative exists when the system fails.
Above all, build this into the risk assessment rather than addressing it after deployment.
6. Govern EdTech Vendors
Specifically, vendor review should cover data collection, model training, retention, subprocessors, security, access, breach notification, deletion, contract termination, material AI-feature changes, and student-facing functionality. Subsequently, turn important commitments into contractual controls.
Similarly, the approach mirrors a standard AI vendor risk assessment, with student data raising the stakes.
7. Build Teacher and Staff AI Literacy
Ultimately, governance depends on users understanding the rules well enough to follow them.
Provide role-specific guidance that answers:
- Which tools the district approves, and for what.
- What student information staff may enter.
- How to verify AI output.
- How to handle AI-assisted grading.
- How to report a concern.
- When a new tool or feature needs approval.
- What disclosure expectations apply.
In other words, the goal is not to publish a policy. It is to make the policy usable in the decisions teachers and staff make every day.
The 7-Stage AI Governance Lifecycle for School Districts
In total, seven stages carry an AI system from first sighting to retirement. Each stage answers one district question and then produces one required output.
- IdentifyWhat AI is being used?Required output: AI inventory
- AssessWhat could go wrong, and what educational impact could occur?Required output: Risk assessment
- ApproveShould this use proceed, and under what conditions?Required output: Approval decision
- DeployAre the approved controls configured?Required output: Go-live record
- MonitorIs the system operating as approved?Required output: Monitoring evidence
- ReviewHas the risk, purpose, or impact changed?Required output: Reassessment
- RetireShould the system be removed?Required output: Closure and deletion record
This lifecycle is a district operating model. It complements rather than replaces broader frameworks such as the NIST AI RMF.
1. Identify
To begin with, inventory licensed software, AI features inside existing tools, staff-reported applications, procurement records, as well as relevant identity or device signals.
Then record the tool, vendor, purpose, users, data involved, student-facing status, educational purpose, risk level, owner, approval status, and review date.
For student-facing systems, also capture the grade levels affected and whether the system influences instruction, assessment, or support.
2. Assess
In practice, a district risk assessment weighs eight dimensions.
Does it process education records or other sensitive information?
Can its output affect a student's experience, opportunity, or a decision about them?
Does it influence teaching, assessment, learning, or student support?
Can it act without meaningful human review?
Could it create barriers for students with accessibility needs?
Could performance or outcomes vary materially across student groups?
Does an external provider store, process, or share the data?
Can students, parents, teachers, and administrators understand its role?
Together, those dimensions then sort systems into three tiers, in the same way an AI readiness assessment grades a wider programme.
| Tier | What it covers |
|---|---|
| Low | Staff-facing, limited data, low student impact, and meaningful human review. |
| Moderate | Student-facing or processing student data, without consequential decision-making. |
| High | Sensitive data, consequential decisions, significant student impact, extensive integrations, substantial automation, or limited human oversight. |
Treat these as district governance tiers for planning, rather than as universal legal classifications or NIST risk categories.
3. Approve
Similarly, record the tool, use case, risk tier, data, educational purpose, approval authority, permitted and prohibited uses, controls, human reviewer, owner, and review date.
For higher-impact systems, also document expected educational benefit, accessibility and equity considerations, academic-integrity implications, transparency requirements, escalation conditions, and reassessment triggers.
Approval should not answer "Can we use this?" Instead, it should answer four questions. Under what conditions, by whom, for what purpose, and with what safeguards?
4. Deploy
Then configure identity and access controls, data protections, logging, monitoring as well as incident response around the tool. That is where AI integration and implementation work usually sits.
This includes role-based access, data minimization, retention controls, approved integrations, security settings, as well as defined human-review procedures. For student-facing systems, confirm accessibility settings, disclosures, classroom rules, and escalation procedures are in place before students use it.
5. Monitor
Meanwhile, track usage, unauthorized applications, data access, policy violations, harmful outputs, incidents, vendor changes, new AI features, and material changes in student impact. Equally, monitoring should ask whether the system still achieves its educational purpose.
The same discipline applies in any environment, as this guide to AI usage monitoring describes. For example, published AI case studies show the pattern running end to end.
- Is the tool still used for the approved purpose?
- Do users bypass the controls?
- Has the vendor changed the model or its data practices?
- Are harmful or inaccurate outputs increasing?
- Do teachers override recommendations frequently?
- Are students encountering accessibility problems?
- Have unequal outcomes appeared across student groups?
- Is the tool delivering the educational benefit expected at approval?
6. Review
Trigger reassessment on any material change.
- A new model or subprocessor.
- Changes to a data category or retention practice.
- Any new model-training use.
- New student-facing capability.
- Consequential-decision use.
- Material contract change.
- Significant privacy or security incident.
- Materially different educational purpose.
- Shifts in accessibility or equity risk.
In short, reopen the assessment when something changes rather than waiting for an annual cycle.
7. Retire
Finally, revoke access, remove integrations, address data return or deletion, verify retirement completed, and document the outcome. Account for system dependencies, retention obligations, security and legal requirements, as well as evidence that must be preserved.
NIST identifies safe decommissioning as part of AI risk governance.
Risk Triage and the Approval Decision Path
A decision process should ask five questions. Does the system process student data, interact directly with students, create student impact, support consequential decisions, or involve an external vendor?
As a result, the answers determine the controls, the depth of review, and who holds approval authority.
Conduct a proportionate review. Confirm the purpose, the owner, as well as the human-review expectation.
Assess student impact, educational purpose, accessibility, transparency, as well as human oversight.
Complete a privacy and vendor review covering collection, access, subprocessors, training, retention, as well as deletion.
Require documented human oversight and qualified privacy or legal review where appropriate.
Review contractual, security, data-processing, retention, deletion, as well as change-management controls.
This is a governance aid for district planning, rather than a universal legal classification.
Example AI Approval Record
Notably, capturing the same minimum fields for every use case is what makes approvals comparable, auditable, and fast to repeat.
| Field | Example entry |
|---|---|
| Tool and vendor | AI writing assistant, vendor name |
| Use case | Teacher feedback on student drafts |
| Users | English teachers, grades 9 to 12 |
| Student-facing | No |
| Data involved | Student writing, identifiable data minimized |
| Risk tier | Moderate, recommended district tier |
| Educational purpose | Reduce teacher feedback time while preserving teacher review |
| Permitted use | Draft feedback only, teacher reviews output |
| Prohibited use | Automated grading or disciplinary decisions |
| Human reviewer | Assigned teacher |
| Owner | Curriculum or academic lead |
| Vendor controls | Retention, training, subprocessors, and deletion reviewed |
| Review trigger | Material model, data, vendor, or purpose change |
| Approval authority | District-designated approver |
This is an illustrative governance artifact, rather than a legal form or a universal approval standard.
Who Owns AI Governance in a School District
First of all, AI governance works when a district names responsibilities rather than assuming them. The allocation below reflects how most districts can divide the work without creating a new department.
Accountable for AI policy, high-impact AI, accessibility, as well as student and parent transparency.
Coordinates the AI inventory, the risk assessment process, as well as the review calendar.
Coordinate vendor reviews, contracts, and data-processing terms.
Own technical controls, access, logging, and monitoring.
Oversees classroom use and handles school-level issues.
Owns academic integrity and educational outcomes.
Coordinates incident response and documentation.
Governance Escalation Model
Nevertheless, ownership alone does not resolve issues. When an AI-related concern surfaces, the assigned owner assesses its risk and decides whether district-level review is required.
Issues that exceed defined thresholds move to the appropriate decision-maker, and the owner documents the resulting action and supporting evidence.
For example, school administration may handle a classroom-level issue. A privacy incident, a high-impact student decision, or a material vendor change therefore requires district-level review.
Governance Evidence Pack and District KPIs
For higher-risk AI tools, districts should hold an evidence pack containing:
- The inventory record and risk assessment.
- Student-data and educational-impact assessments.
- The accessibility and equity review.
- Vendor and contractual assessments.
- The approval decision and human-oversight procedures.
- Monitoring records and incident history.
- Reassessment or retirement documentation.
District Governance KPIs
| Area | What leadership tracks |
|---|---|
| Governance coverage | AI tools inventoried and approved, high-risk tools reviewed with current evidence, vendor reassessments completed, and tools with named owners and current review dates. |
| Governance effectiveness | Open governance issues, incidents by severity, student-facing tools with documented educational purposes, and tools requiring accessibility remediation. |
Example Board or Executive Dashboard
Instead, report at the decision level rather than presenting raw technical logs. A quarterly dashboard can show:
- Total AI tools inventoried and approved
- Number of high-risk or student-impacting systems
- Overdue reviews and open remediation items
- Significant privacy, security, or AI incidents
- Material vendor or model changes requiring reassessment
- Accessibility or equity issues requiring action
- Evidence of teacher and staff AI training completion
- Educational outcome or benefit measures for major student-facing deployments
This format shows leadership which decisions, resources, or policy changes they must make. The same reporting logic underpins a broader enterprise data governance framework.
Education-Specific AI Governance: Five Review Areas
Still, a district should not evaluate AI only through a conventional IT risk lens. In addition, education raises questions about learning, student development, fairness, accessibility, and classroom practice that AI governance for schools has to answer.
1. Academic Integrity
First, determine whether the AI changes how students complete, submit, or demonstrate academic work. Governance should define acceptable AI assistance, disclosure expectations, assessment rules, teacher review, as well as escalation procedures.
Treat AI-detection tools cautiously. A detection result should never be the sole basis for a consequential student decision without human review and a district procedure.
2. Accessibility
Second, assess whether students with disabilities can access and use the system appropriately. In particular, review assistive-technology compatibility, screen-reader support, keyboard navigation, captions or alternative formats, accommodation requirements, accessibility testing, and whether a human alternative exists.
3. Equity and Bias
Third, consider whether the system produces materially different experiences or outcomes across student groups. Review areas include language, disability, age or grade, demographic groups, access to technology, as well as different learning contexts.
In particular, where the system affects student opportunities or decisions, document how the district evaluated equity risks.
4. Student and Parent Transparency
Similarly, students and parents may need clear information about how schools use AI. That matters most when a system interacts with students, processes their information, or shapes consequential decisions.
Specifically, districts can establish AI disclosure practices, parent communication procedures, student-facing explanations, feedback channels, complaint or escalation procedures, and records of material policy changes.
PPRA sets specific requirements on certain student surveys, parental access, and the collection or use of personal information for marketing.
Applicability depends on the activity, so evaluate the particular deployment rather than treating transparency as a blanket legal requirement. The rule text sits at 34 CFR Part 98.
5. Educational Outcomes
Lastly, governance should ask whether the system is achieving the educational purpose behind its approval. If a district introduces an AI tutor to support student writing, it needs evidence on whether writing actually improved.
For instance, measures can include learning outcomes, teacher workload, student engagement, accuracy, accessibility, intervention effectiveness, teacher override rates, and student and educator feedback.
Moreover, the NIST AI RMF includes considering whether an AI system achieves its intended purposes and objectives when deciding whether deployment should proceed.
School AI Governance Maturity Model
Furthermore, maturity tells a school district what to build next. In general, most districts starting this work sit at level one or two.
| Level | Governance state | Typical characteristics |
|---|---|---|
| Level 1 | Ad hoc | AI use is largely decentralized, with limited visibility and inconsistent approval. |
| Level 2 | Inventoried | The district knows what AI exists. A basic inventory and policy are established. |
| Level 3 | Risk-based | Tools receive differentiated review, with risk tiers, vendor review, and approval authority. |
| Level 4 | Monitored | Governance operates continuously, with monitoring, KPIs, evidence, and reassessment. |
| Level 5 | Continuously governed | Governance is embedded in operations, with lifecycle triggers, educational outcome measures, and continuous improvement. |
This is a recommended maturity model for district planning, rather than an official NIST or regulatory classification.
School AI Governance Scenarios
Finally, governance becomes concrete in specific situations. Six recurring ones, with the decision each requires:
Review whether the work contains personally identifiable information and whether the platform is approved. Check what data is transmitted, how long it is retained, whether the vendor trains on it, and what human review is required.
Assess conversation data, vendor practices, age-appropriate settings, retention, accessibility, escalation procedures, and whether the system states its educational purpose clearly.
Require qualified staff to validate recommendations before action where the use could materially affect a student. Retain evidence of the review and provide an escalation path when staff disagree.
Trigger reassessment if the feature changes data processing, model behaviour, student interaction, educational purpose, or student impact.
Then pause or restrict the affected workflow under the incident procedure. Document the output and context, name who owns the response, and determine whether students were affected.
For higher-impact systems, evaluate whether the incident changes approval conditions, risk assessment, vendor requirements, or monitoring.
Document the affected student experience, determine whether an accommodation or alternative workflow exists, involve accessibility and academic staff, and track remediation. If risk has materially changed, reopen the approval assessment rather than logging a support ticket.
How to Implement AI Governance: A 30-Day Roadmap
Meanwhile, a district can establish working governance in four weeks without pausing AI adoption.
- Establish visibility (week 1)Name the governance owner, form a cross-functional team, inventory AI tools, identify student-facing systems, and flag potentially high-impact uses.
- Establish risk (week 2)Apply the district risk model, identify sensitive-data processing and consequential decisions, evaluate academic-integrity and accessibility considerations, and prioritize immediate reviews.
- Govern vendors and controls (week 3)Review high-risk vendors, contracts, access, retention, deletion, model-training practices, human review, accessibility, and change triggers.
- Operationalize (week 4)Finalize approval workflows, publish the approved-tool catalogue, establish monitoring, create the evidence pack, define escalation procedures, and report initial KPIs to leadership.
The objective is not to slow every AI deployment. It is to reserve deeper review for systems that create greater student, privacy, vendor, educational, or decision-making risk. A responsible AI implementation framework also follows the same proportionality principle.
FERPA, COPPA, and PPRA: U.S. Privacy and Compliance Considerations
District AI governance may involve FERPA, COPPA, PPRA, as well as state student privacy requirements. Nonetheless, applicability depends on the tool, the data, the use case, the vendor relationship, and the jurisdiction.
Provides rights concerning education records and also regulates disclosures of personally identifiable information subject to specified exceptions. The school official exception carries specific conditions that must be satisfied when a third party performs an institutional function involving education records.
Can also apply to covered online services that collect personal information from children under 13. FTC guidance explains that schools may, in qualifying educational contexts, act as a parent's agent for consent, subject to the rule's conditions and limits.
The rule text sits at 16 CFR Part 312.
Addresses certain student surveys, parental access to information, and the collection, disclosure, or use of certain personal information for marketing purposes. Applicability depends on the particular activity.
Emphasizes understanding what EdTech providers collect, as well as how they use and disclose it. Also whether information can be reviewed and deleted, and what security and retention practices apply.
Above all, keep three layers distinct: legal requirements, then district policy, then recommended governance controls. Importantly, not every governance recommendation is a universal legal requirement.
Consequently, high-impact or legally sensitive AI deployments should receive qualified privacy or legal review before approval.
A district is also a public agency. The wider government AI governance framework covers the procurement and transparency duties that sit alongside these student privacy rules.
In addition, the Student Privacy Policy Office publishes the current federal guidance for schools and districts.
This section is general information on the regulatory landscape, rather than legal advice. Therefore, a district should obtain qualified legal review for its own circumstances.
How We Built This Framework
This framework was not assembled from a single source. Instead, it combines three inputs:
- The four NIST AI Risk Management Framework functions: Govern, Map, Measure and Manage. We reorganized them into the sequence a district works through when a tool arrives.
- The federal student privacy rules that constrain those decisions. We read them against the current regulatory text in 34 CFR Part 99, 34 CFR Part 98 and 16 CFR Part 312, not secondary summaries.
- The adoption and policy data published by the RAND Corporation in September 2025. It establishes the gap between classroom AI use and district guidance that this model is designed to close.
Additionally, the approval record, risk tiers, RACI allocation, maturity levels, and KPI set are governance artifacts intended for district planning.
They are recommended structures drawn from how governance programs operate in practice, not official classifications issued by NIST or any regulator. Each label says so where it appears.
How SDLC Corp Helps Schools Operationalize AI Governance
In short, creating an AI policy is only the starting point. Districts also need inventory, risk classification, ownership, student-data controls, vendor assessment, monitoring, and evidence to manage AI across its lifecycle.
SDLC Corp supports AI inventory, risk classification as well as access controls. Our AI governance consulting services also cover monitoring, audit logging, vendor risk assessment and governance workflows.
Foresite, our AI governance and monitoring platform, connects governance requirements to operational visibility and controls. That is what keeps review, monitoring and reassessment documentation current.
Consequently, with defined decision rights, risk thresholds, human review, monitoring triggers, and documented evidence, districts can make governance decisions consistently as AI use evolves.
Build AI Governance Your District Can Defend
Get an AI inventory, risk tiers, approval workflows, as well as a governance evidence pack built for student data and classroom reality.
Conclusion
AI governance establishes how a district discovers AI use and then assesses student and vendor risk. It also sets how the district approves tools, protects student information, assigns decision rights, monitors systems and retires tools.
In short, a well-defined approach gives schools a consistent way to manage AI across its lifecycle. It also adapts as technology, data use, vendors, classroom practice and student impact change.
The strongest district programs do more than ask whether an AI system is technically safe.
They ask whether it is appropriate for its educational purpose and accessible to the students who use it. They also ask whether it is fair across contexts, transparent to students and parents, and subject to real human accountability.
Frequently Asked Questions
No. A risk-based approach applies stronger controls where it matters: sensitive data, consequential decisions, student-facing interactions, substantial automation or significant educational impact. Low-risk staff tools get proportionate review.
A cross-functional team usually includes district and academic leadership, IT and security, privacy or legal specialists, as well as procurement. Then add school administrators, teachers and accessibility specialists, plus anyone else relevant to the district's AI use cases.
Districts can combine procurement records, approved-tool catalogues, identity and access information, device or network signals, as well as staff reporting. These mechanisms improve visibility, but they do not guarantee complete detection.
Reassessment should occur when its model, data, vendor, purpose, student impact, educational role, retention practices, accessibility profile, or other material risk conditions change.
It can.
FERPA regulates disclosures of personally identifiable information from education records. Therefore, an AI vendor receiving that information may need to meet the school official exception conditions. One such condition is direct district control over the records.
Applicability is fact-specific, so a district should obtain qualified review for its own deployments.
An AI policy defines acceptable use and also sets expectations. AI governance operationalizes those rules by assigning decision rights, assessing risk, applying controls, monitoring systems, and retaining the evidence of each decision.
Keep it small and cross-functional. In general, a typical group pairs a curriculum or academic lead with IT or security. Then add a data privacy owner, an accessibility or special education representative, as well as a principal or teacher voice.
Finally, one named person should own the final approval.
Match the clock to the tier. For example, a low-risk staff productivity tool can clear in days on a short form.
A tool that touches student records or shapes grading decisions needs weeks, because it requires a data review, a vendor check and a human-review plan.
Start with amnesty and an inventory rather than enforcement. Ask staff to register what they use, then triage that list by risk. In fact, shadow usage usually signals a real instructional need that no approved tool is meeting.
Treat a new AI feature as a change that triggers reassessment, rather than as part of the original approval.
Also ask the vendor for written notice of AI feature releases. Check whether the feature is on by default and whether it can be turned off.
Keep the approval record, the risk tier and its rationale, as well as the data elements involved.
Also retain the vendor terms in force and the human review plan. Finally, record any incidents and their resolution, plus the reassessment or retirement decision with its date and owner.
