AI in K-12 Education: A State-by-State Compliance Tracker
The AI policy landscape in K-12 changed dramatically in 2025–2026. In just over twelve months, eight states moved from "watching and waiting" to actively requiring school districts to adopt AI policies, designate AI coordinators, vet AI tools against new privacy standards, or integrate AI literacy into the curriculum.
For district leaders, this creates a fast-moving compliance picture. The laws vary in scope, Maryland requires every district to designate an AI coordinator, Utah restricts how generative AI can be used to grade student work, Illinois will publish statewide guidance by July 2026 that districts are expected to align with, but the common thread is clear: AI is no longer something districts can leave to individual teachers or vendors to figure out.
One important pattern across nearly every state law: AI compliance isn't a new program. It's a new layer on top of the student data privacy work your district already does. Every state law in this tracker references FERPA, COPPA, and state-level privacy statutes (SOPPA in Illinois, Title 53E in Utah, the Student Data Privacy Act in Maryland, and soon). The districts that handle this well are the ones treating AI as the next chapter of their privacy program, not a separate initiative.
This tracker lays out what each state requires, when deadlines hit, and how AI requirements connect to the privacy obligations you're already managing. We update it whenever new laws pass or guidance is published.
The 8 States
California: AB 2876 + AB 1159 (pending)
· Status: Enacted (AB 2876) | Pending(AB 1159)
· Effective: Rolling implementation
· Key requirements:
o Integrate AI literacy intoK-12 instructional materials and the Model Curriculum
o AB 1159 (if enacted) would prohibit using student data to train AI models
· Privacy connection: Builds directly on SOPIPA, California's existing student privacy law
· Source: AB 2876 on California Legislative Information
Idaho: Senate Bill 1227
· Status: Enacted Law
· Effective: July 1, 2026 (signed March19, 2026)
· Key requirements:
o Statewide framework for AI use in K-12 schools
o District-level AI policies required
o AI literacy standards and educator training mandated
o Data privacy requirements for AI tools used in schools
o AI cannot replace human teachers
· Privacy connection: Explicitly extends Idaho's existing student data privacy framework to AI tools
· Source: Idaho SB 1227
Illinois: Public Act 104-0399 (105 ILCS 5/2-3.118a)
· Status: Enacted Law (statewide guidance to be issued)
· Effective: Law in effect January 1,2026 | ISBE guidance due July 1, 2026
· Key requirements:
o ISBE must publish comprehensive AI guidance for K-12 by July 1, 2026
o Guidance will cover bias, privacy, transparency, and risk assessment
o Explicit alignment with SOPPA, COPPA, CIPA, and the Illinois School Student Records Act
o Internet safety instruction expanded to include AI-generated deepfakes
· Privacy connection: The law is explicit, AI guidance must align with SOPPA, the strictest state student data privacy law in the country
· Source: Public Act 104-0399 on Illinois General Assembly
Maryland: Senate Bill 720 / House Bill 1057 (AI Ready Schools Act)
· Status: Enacted Law
· Effective: June 1, 2026
· Key requirements:
o MSDE must publish formal AI guidance for districts, educators, parents, and students
o Each district must adopt an aligned AI policy within 120 days of guidance publication
o Each district must designate an AI coordinator
o Districts must procure AI tools consistent with state evaluation rubric
o AI literacy added to workforce preparation and CS standards
o Teacher PD on AI required by July 1, 2027
o Maryland AI Education Collaborative established through 2028
· Privacy connection: Procurement rubric incorporates Maryland's Student Data Privacy Act
· Source: SB 720 on Maryland General Assembly
Ohio: HB 96 AI policy mandate
· Status: Enacted Law
· Effective: July 1, 2026
· Key requirements:
o Every district must adopt aboard-approved AI usage policy
o Policy must address student use, staff use, data privacy, and academic integrity
· Privacy connection: Data privacy is one of four required policy elements, your AI policy is partly a privacy policy
· Source: Ohio HB 96
Tennessee: SB 1711 (AI policy mandate for districts)
· Status: Enacted Law
· Effective: 2024-25 school year
· Key requirements:
o Every LEA must have a board-adopted AI policy on file
o Policy must address responsible use, data privacy, and academic dishonesty
· Privacy connection: Mandate explicitly requires AI policies to address student data privacy
· Source: Tennessee Department of Education AI Guidance
Utah: HB 273 (Classroom Technology Amendments)
· Status: Enacted Law
· Effective: Signed March 18, 2026 |District policies due July 1, 2027
· Key requirements:
o State Board to publish model AI classroom policy; LEAs adopt by July 1, 2027
o Generative AI cannot independently grade student work or issue high-stakes determinations
o Parent notification required when AI is used for instruction or assessment
o Students need educator authorization to use Gen AI on academic work
o Optional "AI sandbox" courses allowed with parental consent and Title 53E privacy safeguards
o Screen time limits by grade band
· Privacy connection: Built on top of Title 53E, Utah's student data protection law
· Source: Utah HB 273 on Utah Legislature
Virginia: Executive Order 30 (AI Education Guidelines)
· Status: Guidance Issued
· Effective: 2025-26 school year
· Key requirements:
o Districts expected to align AI use with Virginia Department of Education guidance
o Focus on student data privacy, equitable access, and educator training
o Governor's directive emphasizes responsible AI integration
· Privacy connection: Student data privacy is one of three core pillars of the guidance
· Source: Virginia DOE AI Guidance
What This Means for Your District
Regardless of which state you're in, the trajectory is the same. State leaders are converging on a small set of expectations:
1. A board-adopted AI policy that addresses staff use, student use, and academic integrity
2. A designated AI lead or coordinator, someone whose role explicitly includes governing AI use
3. Vendor vetting that screens for AI features, model training on student data, and FERPA/COPPA alignment
4. AI literacy for educators and students, with structured PD
5. Transparency with families about how AI is used in classrooms
How this fits into your existing privacy program
Most AI compliance work isn't new infrastructure, it's a layer added to the privacy work your district already does.
If your team already handles vendor reviews, FERPA disclosures, COPPA consents, and SDPC contracts, you have most of the muscle you need. AI compliance extends that work in five practical ways:
1. Vendor vetting: Add AI-specific questions to your existing process. Does the vendor train models on student data? Are Gen AI features built in? What opt-out rights do students have?
2. Contracts and DPAs: Update your data sharing agreements (or SDPC member contracts) to address AI: restrictions on model training, retention of AI outputs, and third-party model use.
3. Annual notices and parent communication: Add language about AI use in classrooms, AI-driven personalization, and opt-out workflows for AI-driven instruction or assessment.
4. Staff training: Layer an AI literacy module onto your existing privacy training: acceptable use, prompt hygiene, and what student PII should never go into a prompt.
5. Procurement standards: Apply the same FERPA/COPPA/state-law screen to AI tools, plus the new state-specific AI rules (Maryland's evaluation rubric, Utah's Title 53E safeguards, Illinois's SOPPA alignment).
Where accessibility fits in
Most state AI guidance includes equity and access requirements, AI tools must work for students with disabilities and meet WCAG and ADA expectations. In practice, this falls to the same district lead managing privacy and AI, because all three areas review the same vendors and the same contracts.
This is why districts that treat privacy, AI, and accessibility as one connected program move faster than districts that treat them as three separate initiatives.
Key takeaway: Districts that get ahead of these expectations now will save themselves a scramble in late 2026 and 2027.
Frequently Asked Questions
Q: How often is this tracker updated?
A: We review and update it monthly, or sooner when significant new legislation is enacted.
Q: My state isn't listed, does that mean we have no AI requirements?
A: Not necessarily. Many states have issued informal guidance or have pending legislation. We track only states with enacted laws or formal state-agency guidance. Federal laws like FERPA, COPPA, and CIPA still apply to AI use everywhere, and they're the foundation that almost every state-level AI law builds on.
Q: How does AI compliance relate to student data privacy?
A: AI compliance is a layer on top of student data privacy, not a separate program. Every state AI law in this tracker references existing privacy statutes (FERPA, COPPA, SOPPA, Title 53E, the Student Data Privacy Act, etc.).The same vendor reviews, contracts, and disclosures you already maintain for privacy compliance need to be extended to cover AI-specific issues like model training on student data, Gen AI features, and AI-driven assessment.
Q: What about accessibility, how does that fit in?
A: Most state AI guidance includes equity and access requirements. The same district lead who manages privacy and AI is increasingly responsible for ensuring AI tools meet WCAG and ADA standards for students with disabilities. We treat privacy, AI, and accessibility as three connected pillars of K-12compliance, because in practice, they share the same vendor pipeline and the same point person.
Q: Where do I start if my district has no AI policy yet?
A: The fastest path is to: (1) form a small AI committee with IT, curriculum, legal, and special ed representation; (2) inventory AI tools currently in use;(3) draft a policy aligned with your state's requirements (or model language from a peer state); (4) get board approval. We can help reach out.
Q: Does AI tool procurement require updating our vendor agreements?
A: In most cases, yes. New AI laws typically require explicit disclosure of AI features, restrictions on training models with student data, and clearer data-handling terms. EdPrivacy's vendor evaluation framework covers all of this, see our K-12 AI Vendor Vetting Checklist for a starting point.
About EdPrivacy
EdPrivacy is the K-12 compliance platform for student data privacy, AI governance, and digital accessibility, three areas that increasingly share the same workflows, the same vendor reviews, and often the same district lead. We're the platform behind protecting millions of students, with deep insight into FERPA,COPPA, WCAG, and the growing patchwork of state student data privacy and AI laws.
Whether you're navigating your first AI policy, layering AI requirements onto an existing privacy program, or trying to get accessibility into the same governance system, EdPrivacy is built for that.
See how EdPrivacy works→ EdPrivacy.com
