Why AI Governance in K-12 Districts Requires Enforceable Controls, Not Policy Language Alone
Districts are deploying chatbots, adaptive learning platforms, and administrative copilots faster than governance structures can keep pace. Each new tool introduces a distinct data-handling profile, vendor relationship, and decision-support function, yet many districts still manage AI adoption through informal approval by individual teachers or schools rather than a documented review process. This creates three concrete exposures: student data moving through AI systems without confirmed FERPA-compliant handling, a growing inventory of vendor tools with no central record of what data each vendor can access, and no defined accountability for decisions influenced by AI output, such as grouping recommendations or automated parent communications.
Federal frameworks, including FERPA, COPPA, and NIST's AI Risk Management Framework, establish the baseline obligations a district policy must operationalize, but none of them provide a ready-made K-12 enforcement structure. This checklist translates those obligations into specific policy items and the operational control that enforces each one, so governance leaders can move from stating a requirement to verifying it is followed.
What a K-12 AI Governance Policy Must Cover
A workable AI governance policy for a school district needs to address five interconnected domains rather than treat them as separate documents.
- Student data handling defines what personally identifiable information an AI tool may access and under what conditions, drawing directly from FERPA's disclosure restrictions.
- Vendor management defines how a new AI tool is vetted before deployment, including data retention and deletion terms in the contract.
- Acceptable use defines what students, teachers, and administrators may and may not do with AI tools, and it needs to apply consistently across every school in the district rather than vary from site to site.
- Accountability defines who signs off on a new AI tool and who is responsible when an AI-informed decision is challenged.
- Risk management, following the general structure NIST's AI RMF proposes for organizations, defines how the district identifies, measures, and manages AI-related risk on an ongoing basis rather than only at the point of initial vendor approval.
The checklist below pairs each domain with the control that makes it enforceable.
K-12 AI Governance Policy Checklist
- Define student data access boundaries for every AI tool and limit access to the minimum category required for the stated function.
- Require FERPA- and COPPA-aligned handling confirmation before any student data is processed by an AI system.
- Maintain a centralized registry of every approved AI vendor, including data access scope and approval status.
- Vet vendor contracts for data retention periods, deletion procedures upon termination, and limits on data reuse for model training.
- Name a clear approval authority (district-level, school-level, or both) and require documented sign-off before deployment.
- Publish acceptable-use rules that apply consistently across all schools for students, teachers, and administrators.
- Separate instructional and administrative AI with different access-control tiers and review criteria.
- Log usage and outputs for tools that inform instructional or administrative decisions so actions remain auditable.
- Assign ongoing risk ownership using Govern, Map, Measure, and Manage functions adapted to named district roles.
- Reference applicable state student-data privacy laws as a distinct policy section where they exceed the federal baseline.
Enforcement principle: Each checklist item is only effective when paired with a specific operational control (registry entry, contract clause, approval record, access tier, or log) rather than remaining policy language alone.
Governance Considerations and Open Questions for District Policy
Several judgment calls remain within federal baseline requirements, and districts should resolve them explicitly rather than leave them implicit. FERPA and COPPA govern data handling but do not address who is accountable when an AI tool contributes to an academic or disciplinary decision, so districts must define that accountability internally.
NIST's AI RMF, including the July 2024 Generative AI Profile addressing content provenance and human oversight, provides a voluntary structure organized around Govern, Map, Measure, and Manage functions, built for organizations generally rather than schools specifically, so districts need to translate its functions into named roles instead of adopting it as-is.
A common open question is whether individual schools can approve AI tools independently or whether all approvals must run through a district-level authority; policy should state this explicitly, since undefined authority is one of the more common sources of inconsistent enforcement across a district. State student-data privacy laws vary and may impose requirements stricter than the federal baseline, so district policy should reference applicable state law as a distinct section rather than assume federal frameworks alone are sufficient.