Education's AI Policies Describe the Classroom. They Don't Define the System Boundary.

A policy document is not a management system scope

Florida’s Board of Education approved statewide AI rules for K-12 schools and colleges, setting expectations for acceptable use, academic integrity, and student protections yoursun.com. Trinity College Dublin issued its own AI policy, and a review by The University Times found it leans heavily toward academic priorities like skill development and labour market competitiveness, with limited engagement on how that AI use intersects with the institution’s sustainability strategy universitytimes.ie.

Both documents read as acceptable-use statements: rules for what students and staff may do with AI tools in a classroom setting. That is a narrower thing than a management system scope. A scope statement, in the ISO 42001 sense, has to name the infrastructure, data flows, and third-party dependencies that fall inside the system being governed. Neither the Florida rulebook nor Trinity’s policy, as reported, addresses compute location, vendor hosting, or deletion terms. That is not a criticism of either document on its own terms. It is a flag that the document answering “what can students do” is being asked to stand in for a document that should answer “what sits inside our boundary,” and those are different questions.

The infrastructure decisions are happening elsewhere

The people actually making boundary decisions are on a different track entirely. The University of Toronto is hiring an AI Infrastructure and Solutions Architect to run a multi-cloud estate spanning sovereign on-premises capacity alongside AWS, Azure, and Google Cloud, supporting both research and “mission-critical administrative use cases” careers.insidehighered.com. Ace Computers builds on-premises and air-gapped AI infrastructure specifically so federal agency customers can document control implementation and clear their own authorization process acecomputers.com. Applied to a management-system logic like ISO 42001 or NIST’s AI RMF, that is where governance accountability actually lives: with the team naming the hosting environment and the data boundary, not with whoever drafts the student-facing rulebook. Neither the Toronto posting nor Ace’s federal pitch references a classroom policy, and neither classroom policy references them.

Where the liability actually sits

For US K-12 and higher ed, the sharpest version of this gap shows up around FERPA. A review of AI presentation software found a vendor advertising FERPA, COPPA, and GDPR support with EU-hosted data, yet the reviewer still flagged that a signed data processing agreement was required before any identifiable student work could be uploaded techstory.in. That detail is the tell: the compliance work happens in the DPA, not in a classroom conduct policy. Delta Math, selling into the K-12 math market, has built its commercial pitch around the fact that privacy posture drives purchasing decisions tycoonstory.com, which suggests buyers already evaluate vendors on exactly this ground, separate from any district-level AI policy document.

What this means for governance leads

An acceptable-use policy and an infrastructure or procurement standard are two different deliverables, and institutions should stop treating the first as a substitute for the second. The practical step is to pull the infrastructure architect’s mandate, the vendor DPA process, and the acceptable-use policy into one reviewed scope statement before the next renewal cycle, so each document can point to the others. Right now, the Toronto job posting and the Florida rulebook describe the same institution and cite neither.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The core argument—that acceptable-use policies and infrastructure scope statements are distinct deliverables being conflated—is coherent and defensible, but the claim that ‘the Toronto job posting and
Source & Claim Verification	Qwen · hosted fallback (qwen-2.5-72b-instruct)	cleared. All factual claims are supported by citations, but the article could benefit from more explicit cross-referencing between the cited sources and the specific claims they support.
Regulatory & Framework Fidelity	Mistral · fallback (mistral-medium-3.1)	held. The briefing does not address ISO 42001, EU AI Act, NIST AI RMF, 21 CFR Part 11, or EU GMP Annex 11/22 compliance requirements for AI system boundaries, governance, or validation.
Technical Accuracy	Llama	cleared. The text correctly distinguishes between administrative policy and technical system boundaries, accurately applying ISO 42001 and NIST AI RMF frameworks to the distinction between acceptable-use and i
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies and contrasts two distinct types of AI policy documents, highlighting the critical difference between acceptable-use statements and comprehensive system boundary de
Novelty & Non-Duplication	Grok	cleared. The AUP-versus-ISO-42001-scope distinction and the cross-walk to infrastructure hiring/DPAs is a genuine synthesis not already saturated on the wire, though the underlying education-AI-policy stories
Validation	DeepSeek	cleared. The central claim that classroom AI policies are distinct from, and not a substitute for, infrastructure and procurement governance is validated by clear evidence that these decisions are made by sepa

Sources cited: 15. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.