Sun Oct 11
The Ban Is Not the Control
District AI bans and state rules grab headlines, but the real FERPA exposure sits in unvetted vendor contracts behind the classroom policy.
The ban is not the control
Frederick County Public Schools voted 6-1 to restrict generative AI for students from pre-K through 12th grade, just weeks after rolling out Google’s Gemini across the district gadgetreview.com. Officials were careful to note the policy preserves exceptions for AI-literacy instruction and disability accommodations fox5dc.com. Around the same time, Florida adopted rules requiring state colleges to define limits on AI use for graded assignments, subject to instructor approval, along with protections against AI designed to simulate companionship theapopkachief.com.
Both moves read as governance progress. Neither touches the exposure that actually sits underneath them: what happens to student data once a tool clears the approval step.
Where the liability actually sits
It sits in procurement. A review of free AI tools marketed to Title I schools found no documented FERPA position, no stated minimum age, and no disclosed hosting location for the tool, with a custom data privacy agreement appearing only at the vendor’s paid enterprise tier blog.aieducator.tools. That gap matters more now that enforcement has teeth. The Department of Justice filed its first FERPA lawsuit against a school district this year ltcillinois.org. Oklahoma’s Version 3.0 state guidance tries to close the gap by explicitly tying AI use to FERPA, COPPA, cybersecurity, academic integrity, and equitable access, backed by a model district policy and implementation support edcircuit.com. Most states have not gotten there.
The grading question districts keep answering informally
Where districts have gotten specific, the pattern is consistent: authority stays with the human of record. Boise School District’s policy leaves teachers responsible for deciding whether AI is permitted, limited, or must be disclosed for a given assignment boiseschools.org. On the vendor side, MathSense AI’s own legal terms describe its outputs as “a supplement, not a substitute,” with the teacher of record remaining “the final authority on all grades” mathsense.ai. That is the right allocation of liability. It only holds if it is written into the district’s contract with the vendor, not left as a clause on a terms-of-service page nobody in procurement reviewed.
The decision
A ban and a state framework are both necessary, but together they create a false sense of resolution. The narrower question is whether, for every AI tool reaching a classroom, the district has a signed data processing agreement, a documented hosting location, a stated age threshold, and a written allocation of grading authority. Right now, the free tools most likely to show up in Title I classrooms are the least likely to have any of that on file blog.aieducator.tools.
District and state college leaders revising AI policy this cycle should treat procurement review, not the headline ban, as the binding control. A rule that says no AI on graded work without instructor approval is only as strong as the vendor contract behind it. Build the procurement checklist first. The classroom rule can follow.
Board record
This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.
| Seat | Reviewer | Finding |
|---|---|---|
| Chair · Editorial Judgment | Claude | cleared. The argument is coherent and well-structured—the central claim that procurement controls matter more than headline bans is supported by specific evidence about data privacy gaps in free tools, FERPA e |
| Source & Claim Verification | Qwen · hosted fallback (qwen-2.5-72b-instruct) | cleared. All factual claims are supported by citations, but some sources could be more robust or directly relevant to the claims they support. |
| Regulatory & Framework Fidelity | Mistral · fallback (mistral-medium-3.1) | held. The briefing does not address any of the specified frameworks (ISO 42001, EU AI Act, NIST AI RMF, HIPAA, Cures Act, ONC, CLIA, CMS, NERC CIP, DO-178C) and is entirely off-mandate for the Regulatory & |
| Technical Accuracy | Llama | cleared. The text correctly identifies the technical and legal intersection of data processing agreements, hosting locations, and regulatory compliance (FERPA/COPPA) as the primary engineering control for AI d |
| Bias, Balance & Hype Control | Gemini | cleared. The briefing effectively identifies and counters potential vendor hype by focusing on the practical, often overlooked, aspects of procurement and liability rather than superficial policy announcements |
| Novelty & Non-Duplication | Grok | cleared. The procurement-as-binding-control thesis and Title I free-tool gap framing give a non-duplicative angle on otherwise wire-standard ban/policy stories, though the underlying FERPA/grading-liability po |
| Validation | DeepSeek | cleared. The briefing’s central claim that procurement is the primary liability and control point is robustly validated by documented gaps in free AI tools’ compliance and specific state policy efforts. |
Sources cited: 20. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.