Artificial intelligence tools are quickly becoming part of the education landscape. From lesson planning and tutoring support to communication, accessibility, and administrative tasks, AI may offer valuable opportunities for schools.
However, before approving a new tool, school leaders should understand how it collects, uses, stores, and protects information. An AI tool can create privacy, cybersecurity, operational, and reputational risks if it is introduced without appropriate review and oversight.
Before adopting a new AI tool, ask these seven questions.
-
What information will the tool collect?
Start by identifying what data users may enter into the platform. This could include student names, email addresses, grades, assignments, learning plans, staff information, or other sensitive records.
Schools should understand whether users can enter personally identifiable information and whether the tool needs that information to serve its intended purpose.
-
How will the information be used?
Ask the vendor how it uses data submitted to the platform. Specifically, determine whether information may be used to train or improve the AI model, shared with other parties, retained after use, or used for marketing or advertising purposes.
Schools should have a clear understanding of how their information will be handled before staff or students begin using the tool.
-
Where is the data stored, and how is it protected?
Understand where the vendor stores information and what safeguards are in place to protect it. Ask about encryption, multifactor authentication, access controls, monitoring, data backups, and incident response procedures.
A vendor should be able to explain its security practices in clear terms.
-
Who can access the data?
Access should be limited to authorized users who need it. Ask who within the school, the vendor, and any third-party service providers can access information entered into the platform.
Schools should also consider how user accounts are created, managed, and removed when students or employees leave.
-
Does the tool align with district policy and applicable requirements?
Review the tool against district policies, technology standards, and applicable privacy requirements. Depending on the information involved and the users of the platform, this may include considerations related to FERPA, COPPA, state privacy laws, records retention requirements, and board policy.
School leaders should involve the appropriate internal stakeholders, such as technology, curriculum, legal counsel, data privacy, and risk management personnel.
-
What happens if the vendor experiences a security incident?
A written agreement should address the vendor’s responsibilities if a data breach or security incident occurs. Ask how quickly the vendor will notify designated technology and leadership contacts, what support it will provide, and how it will cooperate with investigation, notification, and recovery efforts.
Establishing these expectations in advance can help the school organization respond more effectively if an incident occurs.
-
How will the school manage the tool over time?
Approval should not be the end of the process. Schools should establish clear expectations for appropriate use, train staff and students, monitor adoption, and periodically review the tool’s privacy and security practices.
If the relationship ends, schools should know how their data will be returned or securely deleted and how user access will be removed.
Build a Thoughtful AI Approval Process
AI can support meaningful innovation in education, but adoption should be intentional. A consistent review process can help schools evaluate new tools, protect sensitive information, and make informed decisions that align with their educational goals and risk management strategy.
Before the next AI tool is introduced, start with the right questions. Contact our Education Practice team to learn more.
