Congress Is Looking at AI Guardrails for Schools. Here’s What Districts Should Know
Artificial intelligence is moving into K-12 classrooms faster than most school districts can build policies around it. Teachers are experimenting with generative AI, familiar education products are adding AI features, and new tools are appearing almost weekly. For district leaders, the challenge is no longer deciding whether AI will be used in schools. The challenge is determining which tools can be trusted, what risks they create, and how those decisions should be documented.
A new proposal in Congress offers a glimpse of what a future federal approach to those questions could look like.
On September 22, 2026, Rep. Suzanne Bonamici of Oregon introduced the Artificial Intelligence Education and Workforce Readiness Act, a broad proposal covering the use of AI in education and the workforce. The bill is not law, and districts do not have new federal obligations because of it today. Still, the proposal deserves attention because many of the safeguards it identifies are the same issues school districts are already beginning to confront as they evaluate AI-enabled technology.
The technology review process is getting more complicated
For years, student data privacy has been at the center of most district technology reviews. A school might look at what information an application collects, whether the vendor complies with FERPA or COPPA, whether a Data Privacy Agreement is in place, how long information is retained, and whether student records can be deleted.
Those questions have not gone away. AI has simply added another layer.
A vendor may have reasonable privacy protections and still present AI-related risks that require a different kind of review. Districts may need to understand whether student information is being sent to an AI model, whether prompts or uploaded materials are retained, whether those data can be used to improve a model, whether automated recommendations affect students, and whether a person remains responsible for important decisions.
Bonamici's proposal reflects that broader view of technology governance. Among other provisions, it calls for AI risk-assessment standards for classroom technology, safeguards against harmful content, parental notice and opt-out rights, human oversight, bias testing, independent evaluations, stronger data-security requirements, and the use of the National Institute of Standards and Technology's AI Risk Management Framework.
If provisions like these eventually become federal requirements, technology approval would become much more than checking a privacy policy and collecting a signed agreement.
One of the biggest questions is what happens to student data
The proposal specifically includes a prohibition on using student data to train AI models. That is an important issue for districts because the presence of AI can change the meaning of a traditional privacy review.
With a conventional education application, a district may primarily be concerned with where student information is stored, who receives it, how long it is retained, and whether it is deleted when the relationship ends. AI introduces another question: Can information provided by students, teachers, or the district become part of the system used to improve the technology?
That answer is not always obvious.
The vendor's privacy policy may describe one set of practices, while its terms of service, AI terms, enterprise agreement, or Data Privacy Agreement provide additional conditions. A district may also need to understand whether the vendor operates its own AI model or sends information to another model provider behind the scenes.
This is why simply asking whether a product is "FERPA compliant" is becoming less clear. Districts increasingly need to understand exactly what data enter the AI system, what happens to those data once they are there, and what contractual or technical controls prevent them from being used in ways the district did not authorize.
Human oversight is likely to become an important part of AI review
Another significant theme in the proposed legislation is human oversight.
That issue becomes especially important when artificial intelligence moves beyond helping someone write an email or create a lesson plan and begins influencing decisions about students. An AI system might evaluate student work, identify students who appear to need intervention, recommend instructional pathways, flag behavior, or help educators make decisions that affect individual students.
In those circumstances, the important question is not simply whether AI is involved. The district needs to know what authority the system has and what role a person plays in the final decision.
An AI system that provides information for a teacher to consider is very different from one that effectively determines an outcome. The proposed legislation's emphasis on human oversight and bias testing recognizes that distinction.
For districts, that could mean future technology reviews need to document not only what an AI system does, but also what happens when it is wrong, whether its recommendations can be overridden, and whether the vendor has evaluated the system for biased or discriminatory outcomes.
Districts also need to know where AI is being used
Parental notice and opt-out provisions in the proposal raise another practical challenge: a district cannot provide meaningful transparency about AI if it does not know which technologies are using it.
That sounds obvious, but it is becoming increasingly difficult.
AI is not limited to products marketed as "AI tools." Vendors are adding AI functionality to applications that schools may have used for years. A writing platform may add generative feedback. An assessment tool may add automated recommendations. A classroom application may introduce an AI tutor. A product that passed a district's review two years ago may now operate very differently.
That means technology approval cannot always be treated as a one-time event.
Districts need a way to maintain an accurate inventory of approved technology, document how each product was evaluated, record restrictions on its use, and revisit those decisions when the product or the vendor's policies change.
This is really a shift from app approval to technology risk management
That may be the most important implication of the proposal for school districts.
The traditional idea of an approved-app list is becoming too simple for the environment districts are operating in. A product can create different levels of risk depending on what information it collects, whether students use it directly, whether AI is involved, what decisions the technology influences, how the vendor handles data, and whether the product is accessible to students with disabilities.
Privacy is still part of the review, but increasingly it sits alongside AI risk, cybersecurity, accessibility, contractual protections, vendor practices, and transparency.
In other words, districts are moving from approving applications to managing technology risk.
The difficulty is that this expanded responsibility often falls on the same technology, curriculum, privacy, and administrative teams that were already stretched before generative AI arrived.
A district might have hundreds or even thousands of technologies in use. Conducting a thoughtful review is challenging enough. Conducting that review consistently, documenting the decision, communicating with vendors, keeping records current, and revisiting products when they change is a much larger operational problem.
This is where EdPrivacy helps
EdPrivacy was built to give school districts a structured way to manage that process.
Rather than keeping privacy reviews in one spreadsheet, AI questions somewhere else, vendor agreements in a shared drive, and teacher requests in email, EdPrivacy brings the technology review process into one workflow.
When a new product is requested, a district can evaluate its privacy practices and document the decision before approving it for use. If the technology includes artificial intelligence, the district can also conduct an AI Risk Review that looks at issues including transparency, data handling, whether student information may be used for AI training, bias, and human oversight.
That distinction matters because AI risk should not replace student privacy review. The two need to be considered together.
A product might receive acceptable marks in one area while raising questions in another. Giving reviewers a broader picture makes it easier to make a decision based on how the technology will actually be used rather than relying on a single compliance claim from the vendor.
EdPrivacy also helps districts maintain the documentation behind those decisions. Teacher requests, administrator reviews, vendor communications, agreements, approval decisions, and technology records can be managed through the same process. Accessibility information can also be reviewed alongside privacy and AI concerns, helping districts avoid creating a separate manual workflow for every new technology requirement.
The result is not simply an approved list. It is a record of how and why the district made its decisions.
A signed DPA is important, but it is not the entire review
The growth of AI also reinforces an important lesson about technology governance: a signed agreement is only one source of information.
Data Privacy Agreements remain an important part of protecting student information, but an agreement alone may not tell a district whether a product has introduced a new AI feature, how that feature interacts with student information, whether an outside model provider receives data, or whether a vendor's current practices still match what the district originally reviewed.
AI makes ongoing vendor oversight more important because technology can change substantially without a district changing products.
That is why districts increasingly need to evaluate both the protections vendors promise and the practices reflected in their current policies, documentation, and product functionality.
Districts do not need to predict what Congress will do
The Artificial Intelligence Education and Workforce Readiness Act is a proposal. It may change considerably during the legislative process, and there is no guarantee that it will become law.
But districts do not need to predict its future to learn something from it.
The issues identified in the proposal — AI risk assessments, limits on student-data training, transparency, human oversight, bias, security, parental involvement, and continuing evaluation — are already becoming part of the conversation around responsible AI use in schools. The U.S. Department of Education has also received comments calling for clearer vendor data-governance practices, disclosure of whether student information is used for AI training, and frameworks for evaluating AI tools for data safety, accessibility, and effectiveness.
The direction is becoming clearer even if the final rules are not.
Districts will need to know what technology is being used, understand the risks behind it, document why it was approved, and continue evaluating it as the technology changes.
That is exactly the kind of technology governance process EdPrivacy is designed to support.
Learn more about EdPrivacy's privacy, AI risk, accessibility, and technology review tools at edprivacy.com/tech-review.
