What Should Schools Demand Before Turning On AI?

1 A commitment is a purchase term

On September 18, 2026, the Associated Press reported that Microsoft committed to sweeping AI privacy rules for students, framing the news as a shift of the privacy burden from families and districts onto companies. The AP article text available to N43 is partial, so the scope of those commitments is described here as reported rather than independently confirmed. The practical question for a school system is narrower: which parts can be written into a contract and enforced.

2 Map commitments onto FERPA duties

A vendor promise is not the same instrument as a district obligation. The U.S. Department of Education explains FERPA to parents and students in the vocabulary of education records and consent, and procurement language has to connect the two. Anything a district cannot point to in a signed agreement stays a marketing claim rather than a control.

3 Data use and model training

Start with what the tool actually touches, and get each answer in writing.

• Which student data the tool ingests: rosters, writing samples, grades, images, transcripts, metadata.
• Whether student content trains or improves vendor models, and whether that use can be switched off.
• Whether vendor staff or contractors may read student content, and under what conditions.

4 Access, audit, and exit

Controls that cannot be checked are not controls. These terms decide whether the district can verify the others.

• Subprocessor list, access logs, and the notification window after an incident.
• Audit rights, or the right to receive independent assessment reports.
• Deletion on termination, and what deletion means for models already trained.

5 Who is accountable when it breaks

Name the person, not the department. A workable agreement identifies an accountable officer at the vendor, states how commitments may change and with how much notice, sets a remedy when a commitment fails, and says which law governs. It also states whether privacy terms survive renewal at the same price, because renewal is where quiet erosion usually happens.

6 What the commitment leaves open

The AP headline asks whether other technology companies will follow. As reported, that remains an open question: nothing in the available text obliges another vendor to adopt the same terms, and a company commitment is not an enacted requirement a regulator can enforce. Districts should treat each announcement as one vendor offer to negotiate, not as a standard the market has already adopted.

7 The bottom line

Get privacy commitments into the agreement, not into the press release.

Verify data use, retention, deletion, and audit rights before enabling any tool.

Treat a company pledge as an offer to negotiate, not as enacted policy.