K-12's Two-Front AI Compliance Problem

Two rulebooks, one district

Florida’s Flagler Schools is now rewriting its policies to comply with the state’s new AI rules, which include a requirement that any AI tool used in pre-K through grade 5 undergo additional review before approval, and a ban on using AI instructional tools to meet a student’s social or emotional needs Observer Local News. This is a state-specific, AI-specific compliance layer, and it is arriving unevenly across the country. Districts operating in multiple states, or vendors selling into multiple states, now face a patchwork of rules that did not exist eighteen months ago.

Underneath that patchwork sits an older, thinner one. FERPA, the federal student privacy law from 1974, does not cover student information once it has been de-identified, an exemption that many state privacy laws and standard ed tech contracts also carry forward LPM. Jefferson County Public Schools, which reportedly uses hundreds of ed tech products, is now the subject of reporting examining exactly how much protection that structure actually provides once AI tools are layered on top of it LPM.

Vendor claims are not a governance program

Meanwhile, individual deployments are moving forward on the strength of a single compliance claim. In Mullica Hill, New Jersey, the district’s rollout of SchoolAI is framed around FERPA compliance and district ownership of student data, with officials stressing the tool is “at no point… designed to replace the teacher and student interaction” South Jersey Media. That framing is reasonable and probably accurate. But it also illustrates the core exposure facing every compliance officer in K-12 right now: FERPA compliance, as a single vendor attestation, tells you almost nothing about how that vendor handles de-identified data, model training, or third-party sharing once your state’s own AI rules start asking different, more specific questions.

What this means for the decision

For district technology and compliance leaders, the practical decision is no longer “is this vendor FERPA compliant.” That question is necessary but not sufficient. The real work is building a governance layer that sits above individual vendor claims and maps against two moving targets at once: emerging state AI statutes like Florida’s, which impose tool-specific review gates by grade band and use case, and the structural gaps in federal privacy law that state rules were written to patch. A district running hundreds of ed tech products, as JCPS reportedly does, cannot verify this tool by tool through vendor marketing language. It needs a repeatable assessment framework, comparable in spirit to ISO 42001’s approach to AI management systems, applied specifically to the de-identification exemption and to age-banded use restrictions.

The districts moving fastest right now, Flagler among them, are the ones treating policy alignment as infrastructure work, not paperwork. That is the right instinct. The harder task is making sure the infrastructure covers the gap FERPA was never built to close.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The core argument—that FERPA compliance alone is insufficient given emerging state-level AI rules—is coherent and well-supported by the cited examples, though the ISO 42001 comparison is introduced wi
Source & Claim Verification	Qwen · hosted fallback (qwen-2.5-72b-instruct)	cleared. All factual claims are supported by citations, but the article could benefit from more diverse sources to strengthen the claims.
Regulatory & Framework Fidelity	Mistral	held. seat error: Client error ‘429 Too Many Requests’ for url ‘https://openrouter.ai/api/v1/chat/completions’
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429
Technical Accuracy	Llama	cleared. The article accurately captures the complexities of AI compliance in K-12 education, highlighting the need for a governance layer beyond individual vendor FERPA compliance claims.
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies and critiques vendor hype, particularly regarding FERPA compliance, and clearly presents a counterargument to relying solely on such claims.
Novelty & Non-Duplication	Grok	cleared. The two-front synthesis (new state AI grade/use gates + FERPA de-identification gaps) meaningfully reframes this week’s Flagler, JCPS, and Mullica Hill wires rather than duplicating any single story,
Validation	DeepSeek	cleared. The central claim about a ‘two-front’ problem—conflict between new state AI rules and FERPA’s de-identification gap—is empirically validated by cited state-level policy actions and legal analysis of p

Sources cited: 16. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.

Record corrected 29 September 2026. This seat was originally listed as running on our own local hardware. It never did: every review before this date fell back to a hosted model, and the row above now names the model that actually ran.