Five steps for tech directors.
Teachers are pasting rosters into ChatGPT, running IEP drafts through free summarizers, and signing up for AI tools with their school email. A few are building their own apps. Almost none of it runs under an agreement the district has signed. At the end of this plan you have an inventory, a rule for every tool, and a policy for your superintendent.
Ask staff which AI tools they use for school work and whether they have built anything themselves. Make it clear nobody will get in trouble. If you ban AI instead, staff keep using it and stop telling you about it. The Department of Education's guidance says to keep a list of every online service in use and review free tools the same way you review paid ones.3 Here is an email you can send.
Hi all. Many of you are using AI tools for school work this year, and some of you have built your own. Reply with the tools you use, what you use them for, and whether any student information goes into them. If you built something, tell us where it runs. Nobody is in trouble. We want your tools to keep working and student data to stay protected. Thanks.
Put each tool in a tier based on the student data that goes into it. It does not matter whether the tool is ChatGPT, a browser extension, or an app a teacher built. The tiers follow FERPA's definitions of directory information and education records.4 Several states go further than FERPA. New York, Illinois, and California each have their own student privacy laws, so check yours before you set the rules in Step 3.5
Tier 1
No restrictions. Keep it on your list so you know it exists.
Tier 2
Only in tools the district has approved, behind district sign on. Staff built tools run on a district server or cloud account, with the code in a district owned account and a named backup owner.
Tier 3
All the Tier 2 rules, plus three more. A signed data privacy agreement with the district. A written promise from the AI provider not to keep or train on the data. Role based access with a log of who looked at what. Miss any one and student records stay out.
Then give staff an approved option. One AI tool with a signed privacy agreement for everyday work, and one district approved place to host what they build. Make approval quick. If it takes a week, staff go back to the free version. Start from the Student Data Privacy Consortium's National Data Privacy Agreement, which has been signed more than 222,000 times, so most vendors already accept it.6
Edit this to fit your district and send it to your superintendent. Only 1% of districts ban AI, and 88% already have AI initiatives underway. A policy that allows AI with conditions is the normal position, not a risky one.7
"Staff are encouraged to use AI tools that make their work easier. Any tool used for district business must be registered with the technology office. Student information may only go into tools the district has approved and that run behind district sign on. Tools staff build themselves must run on district managed hosting. The technology office will provide an approved option within five school days of a request."
FERPA lets a vendor or tool act as a "school official" and handle education records only if it is under the district's direct control with respect to the use and maintenance of those records, uses them only for the district's purposes, and does not redisclose them.8 A free AI account a teacher signed up for on their own meets none of those tests. A tool with a signed privacy agreement that staff log into with their district account does.
Start with what Step 1 turned up. If student records are already in a tool that fails the Tier 3 test, stop using it, delete the account, and ask the vendor in writing to purge the data. Then review the list twice a year. Is anyone still using each tool? Is it in the right tier? Is the privacy agreement still in effect? Is its owner still at the district? Remove anything nobody uses.
About Upstart
Upstart lets district staff ask plain English questions of their SIS data with full role based access control. Each user sees only the students they may see, every query is logged, and student data never trains AI models. That is the Tier 3 rule. Want a second set of eyes on your Step 1 list? That is a 30 minute call.