Are AI Vendors School Officials under FERPA?
Emmerson Mirus , Brian P. Goodman , Heather Curnutt | 09.29.26
Many school districts are moving quickly to adopt AI tools for everything from lesson planning to grading and assessment. When implemented properly, these tools can save staff time and improve services. Before your district signs on the dotted line, however, it is important to consider whether the vendor’s agreement complies with the Family Educational Rights and Privacy Act (FERPA) and Wisconsin Pupil Records Law.
Many AI vendor contracts include a provision stating that the vendor qualifies—or that the district agrees that the vendor qualifies—as a “school official” with a “legitimate educational interest” under FERPA. The “school official” designation is the legal mechanism that allows districts to share personally identifiable student information with outside individuals, companies, or organizations without obtaining parental consent. While this sounds reassuring on paper, it may not be enough in practice.
FERPA does not let school districts hand out the “school official” designation to just anybody. Under 34 C.F.R. § 99.31(a)(1)(i)(B), a vendor may be treated as a school official only if it (1) performs a service the district would otherwise perform using its own employees, (2) remains under the district’s direct control with respect to how it uses and maintains education records, and (3) is bound by FERPA’s restrictions on using and redisclosing that information for any purpose beyond the purpose for which it was disclosed.
An AI vendor contract might assert that the vendor is a “school official” in one section, while in another section grant the vendor sweeping rights to retain student data indefinitely, use it to train or improve its AI models, share it with affiliates or subcontractors or for marketing purposes, and limit the district’s ability to demand deletion of records. Those provisions undermine a district’s “direct control” and likely do not comply with FERPA’s use-and-redisclosure restrictions. AI vendors cannot make themselves school officials for FERPA purposes simply by saying so; the operative terms of the agreement must back up that designation.
The stakes are real. If a vendor’s practices exceed the parameters of FERPA’s school official exception, the district generally bears the compliance risk. AI vendor contracts frequently contain language that limits the district’s ability to take legal action against the vendor—even for the vendor’s errors or violations of law.
The takeaway for school districts is simple: do not rely on marketing language or a single term buried in a services agreement. Before signing any AI vendor contract, have legal counsel review the data use, retention, training, and redisclosure provisions to confirm their compliance with the requirements of FERPA and Wisconsin Pupil Records Law. A quick legal review upfront is generally far less costly than untangling a compliance problem after the fact.
If you have any questions, please contact a member of the Boardman Clark School Law Practice Group.
DISCLAIMER: Boardman & Clark LLP provides this material as information about legal issues and not to give legal advice. In addition, this material may quickly become outdated. Anyone referencing this material must update the information presented to ensure accuracy. The use of the materials does not establish an attorney-client relationship, and Boardman & Clark LLP recommends the use of legal counsel on specific matters.
