A Shortlist for Schools Assessing AI Learning Tools

When evaluating an AI learning tool, our recommendation is to assess the proposed educational activity alongside its data arrangements. A useful demonstration should be the beginning of that review, not its conclusion. This best-of-style reference shortlist selects evidence requests from official education, privacy and standards materials. It is an editorial selection of review criteria, not a ranking of products, a government checklist or legal advice.

Request a defined school use case

The Department of Education online-services guidance addresses privacy and security considerations for third-party tools used as part of school activities. Its provider-responsibility resource is specifically intended to help educational service providers, vendors and contractors understand FERPA.

Our recommendation is to begin with a written description of who will use the proposed service, for what activity and with which information. Ask the provider to respond to that actual scenario rather than offering a generic privacy statement. This makes the subsequent contract and risk review specific to the proposed use.

Examine the basis for data access

Department of Education FERPA FAQs describe conditions governing the use of outside parties under the school-official exception, including institutional functions and direct control. Our recommendation is to have the responsible school team identify the applicable basis for any proposed disclosure and assess the relevant conditions.

Do not infer that the presence of an educational feature automatically resolves that question. Ask the vendor to identify the service it will perform and the proposed controls over the data. Record unresolved questions for the institution to assess before approving the particular deployment.

Inspect terms and data descriptions

The department model-terms resource provides a checklist for evaluating terms of service and data handling. Its online-services privacy material also discusses the significance of removing direct and indirect identifiers from metadata in the FERPA context.

Our recommendation is to ask for a readable inventory of inputs, outputs and retained interaction data, then compare that inventory with the proposed contract. Do not assume that describing information as metadata answers every privacy question. Ask the provider and the school reviewer to explain the treatment of the information actually involved.

Ask how risks will be evaluated

NIST AI risk-framework guidance is intended for voluntary use in incorporating trustworthiness into the design, development, use and evaluation of AI systems. The framework core discusses the value of diverse teams in surfacing problems and risks.

Our recommendation is to include relevant school perspectives in the review and request a documented process for raising concerns. Ask which use cases the school proposes to evaluate, how it will record the results and who can stop or change the rollout. Do not describe use of the NIST framework as proof of legal compliance or validated educational outcomes.

Make retention part of the decision

Where COPPA applies, the FTC compliance guidance includes retaining information only as long as necessary for its purpose and deleting it using reasonable protective measures. Our recommendation is to request a concrete retention and deletion explanation for the proposed service, while assessing applicability rather than assuming every school tool has the same obligations.

The selection method behind this shortlist is practical: prioritize evidence about purpose, access, contractual terms, risk review and retention. These criteria do not establish that any named product is safe or effective. Use them to organize a documented institutional decision and specify what still requires review before adoption.

Related Business 2.0 reading: related sector analysis; further business coverage; additional technology analysis; more industry context; related reference coverage.