The first enforceable rules for AI in American schools begin November 1, and almost no one in the private school or edtech world signed them. That is the reason they matter to you.
Picture your next renewal call with a district, a parent board, or a university buyer. The conversation is going well. Then someone asks a plain question: will you put in writing that you never train on our students’ data, and that you will tell us within 72 hours if there is a breach? Until recently, that request was a courtesy. Now a major vendor has agreed to it in writing, and every buyer has a model to point at.
Our view is simple. If you run a private school, a tutoring company, an edtech firm, or a school service provider, adopt the same contract language now, on your own terms. If you wait, a buyer will hand it to you on theirs.
What Took Effect
On September 9, Microsoft, the American Federation of Teachers, and its New York City affiliate, the United Federation of Teachers, announced what they call the National AI Safety and Privacy Standard. Microsoft’s fact sheet lists ten protections and says they begin November 1, 2026. Districts can add them to new or existing Microsoft agreements without renegotiating and without waiting for a renewal. AFT President Randi Weingarten called it an “iron-clad privacy agreement with real teeth,” according to GovTech.
The teeth come from the contract, not the press release. Once a district writes the standard into its Microsoft agreement, a broken promise becomes a breach of contract. Fortune reports that districts can cancel and seek damages. Fortune also reports that Microsoft faces annual certification requirements and audit rights. That second point rests on Fortune’s account; the fact sheet speaks of maintaining certifications without describing audits. Read it as reported, not yet settled.
The distinction matters more than it seems. A pledge on a website can be revised on a quiet afternoon. A clause in a signed agreement cannot. What changed this fall is not that a technology company said something reassuring about children’s data. Companies say reassuring things often. What changed is that one of them agreed to be held to it, in a form a school district can enforce.
Companies say reassuring things often. What changed is that one of them agreed to be held to it, in a form a school district can enforce.
The Ten Protections, in Plain Terms
The fact sheet groups the standard into ten commitments, and they are worth reading in full because buyers will. The first is a ban on training models with student or educator data, with a narrow exception for safety and security. The second is data minimization, which places limits on tracking, profiling, biometrics, and memory features. The third keeps ownership of the data with the customer; the provider may not sell it, use it for ads, or use it to build products.
The fourth requires human oversight of high-risk decisions. The fact sheet pairs it with a ban on AI companion chatbots: item four explicitly states “AI companions are prohibited.” That is one of the fact sheet’s ten protections, not just marketing language, though the full binding standard, a separate document AFT publishes, is the final word if you need legal certainty.
The fifth covers accountability, including certifications and breach reporting within 72 hours. The sixth asks for security matched to the stakes, with encryption, testing, and coverage that extends to subprocessors. The seventh calls for plain-language guides that explain to families how the tools work. The eighth addresses equity and accessibility, with gaps disclosed and fixed. The ninth forbids feature creep and lock-in; customers get notice of changes, free export, and the freedom to switch. The tenth makes some duties last. The bans on training and on sale are permanent, and they survive the end of the contract.
Notice what kind of list this is. Very little of it is about what the AI can do. Nearly all of it is about what the vendor may do with what the AI touches. That is the shape buyers will carry into every other negotiation.
Who It Binds, and Who It Doesn’t
Be precise here, because the headlines were not always. The standard binds Microsoft, in its relationships with school districts. It does not bind your school, your tutoring business, or your product. It does not bind other AI labs either. K-12 Dive reported that Microsoft was the only signer. Fortune noted that OpenAI and Anthropic are not parties, though Weingarten said both had shown willingness, and Engadget reported that the AFT is in talks with both.
So you have no legal obligation here. You have something more persistent: a reference point. Consider, as an illustration, a tutoring company with $40 million in revenue, or a private school with 600 students. Neither is party to anything Microsoft signed. Both will sit across the table from people who read about it.
Why a Contract You Didn’t Sign Still Reaches You
Buyers rarely write contract language from scratch. They copy what the largest vendor already accepted. Once Microsoft put “no training on student data” and “72-hour breach notice” in writing, those phrases became the floor in a buyer’s mind, not the ceiling. A procurement officer, a head of school, or a parent council does not need to know the standard’s name to ask for its terms.
We have watched this pattern before with security questionnaires. One large vendor accepts a clause. It shows up in a template. Within a year, smaller vendors receive the same form, often with no room to negotiate. The difference this time is speed; the template is a public fact sheet with a union’s name on it. We have written about how regulators keep sending the same letter in different envelopes. Buyers behave the same way, and they move faster than regulators do.
There is a quieter consequence, too. When a term becomes standard, refusing it starts to carry meaning. A vendor that declines a no-training clause in 2026 is no longer making a neutral commercial choice. It is telling the buyer something about its business model, whether it intends to or not.
A vendor that declines a no-training clause in 2026 is no longer making a neutral commercial choice. It is telling the buyer something about its business model, whether it intends to or not.
Families Are Paying Attention
The timing was not an accident of the calendar. Both K-12 Dive and Engadget reported that New York City announced a pause on student use of generative AI in elementary and middle grades the week before the announcement. K-12 Dive also reported that Los Angeles Unified announced its own moratorium on student-facing tools. Two of the most visible school systems in the country stepped back in the same season.
Parents read those stories. They bring them to open houses and enrollment interviews and board meetings. A private school that can show its AI terms in writing has a better answer than one that can only describe its intentions. A tutoring company that can hand a parent a one-page guide to how its tools use a child’s data has a better answer than one that points to a privacy policy written for lawyers. The question of where education is heading is large and unsettled. The question a parent asks this week is small and concrete, and you should be ready for it.
What to Ask of Your Vendors
If you buy AI tools for students or staff, ask every vendor for five terms, and ask for them in the contract rather than on a marketing page.
First, a flat ban on using your student and staff data to train or improve models, with any exception narrow and named. Second, breach notice within 72 hours of a confirmed or reasonably suspected incident, which is how GovTech describes the standard’s trigger, with coverage that reaches their subprocessors. Third, a written statement that the product has no companion or “friend” chatbot feature for students, and that one will not appear without your consent. You can ask for this regardless; the fact sheet already lists it among the ten protections. Fourth, deletion and export rights that you control, on a clear timeline. Fifth, notice before any material new feature or any new use of your data.
If a vendor says no to all five, that tells you something. If it says yes but will not write it down, that tells you more.
If a vendor says no to all five, that tells you something. If it says yes but will not write it down, that tells you more.
What to Offer Your Own Buyers
If you sell to schools, turn the list around. Put the same five terms into your standard agreement, or into a short AI addendum, before anyone asks. Then build the proof that stands behind them. You need an inventory of every AI model and subprocessor that touches student data. You need a breach response plan that can actually meet 72 hours, including weekends. You need a one-page guide for families, written in plain language.
The firms that move first get to write the clause in their own words and set reasonable limits. The firms that wait receive a buyer’s redline, usually stricter, on the buyer’s deadline. Offering the terms is also a commercial asset. It shortens security review. It gives your account team something concrete to say when a district mentions the Microsoft deal, which it will.
How the Same Rule Lands in Three Businesses
The examples that follow are illustrative, not drawn from any client, but they show how one standard asks different things of different operators.
Take a private school group with three campuses. It buys rather than builds, so its exposure sits in its vendor contracts. Its work is mostly reading: pulling every agreement for a learning platform, a writing assistant, or an AI grading tool, and checking what each one says about training and breach notice. The likely finding is that some contracts are silent. Silence is not a ban. The fix is a short addendum at the next renewal, and a policy that no new tool reaches students without one.
Now take a tutoring company that runs sessions online and has started using AI to draft practice problems and summarize progress for parents. It is both buyer and seller. It needs the five terms from its model providers, and it needs to offer the same five to the families and schools it serves. Its hardest question is the 72-hour clause. A small operations team can sign it easily and miss it on a holiday weekend.
Finally, take an edtech vendor with a product in a few hundred districts. For this firm the standard is a sales event. Districts that adopt it with Microsoft will ask why they should accept less elsewhere. The vendor’s best move is to publish its own AI terms before the question arrives, and to make sure engineering can prove each one. A promise of no training is only credible if the firm can show where student data flows and where it stops.
What This Will Not Do
A contract clause is not a control. Promising no training on student data means little if you cannot name every tool where that data flows. A 72-hour breach clause is only as good as your ability to detect a breach in the first place. We have made a related argument about confidentiality in AI automation: the governance has to exist before the promise does, or the promise is decoration.
The standard is also new. We do not yet know how audits will work in practice, or how many districts will add it to their agreements. Treat the whole thing as a strong signal of where buyers are heading, not as settled law, and not as a substitute for your own counsel’s review of your contracts.
Three Questions for Monday
Ask your leadership team three things. Which of our vendors could use student data to train AI today, and what does each contract actually say? If a buyer asked us for 72-hour breach notice tomorrow, could we sign it and meet it? Do any of our products or tools include a chatbot that a student could treat as a companion?
If the answers come back in a day, you are in good shape. If they take more than a week, that delay is itself the finding. An outside read can help. An Innovation Vista independent assessment brings in former CIOs and CISOs from our bench who have sat on both sides of these contracts. We are vendor-neutral and sell advice, not software. What you get is a clear view of where you stand, before a buyer draws it for you.
