A school district is preparing a GenAI tutoring pilot that will train or ground the tool on student academic data. District leaders are debating whether the IT department should independently own decisions about how that student data is governed, or whether a broader group should be involved. Which approach best reflects sound AI governance practice for this decision?

Student data governance touches privacy law, academic policy, and technical feasibility all at once, so no single function has the full picture needed to make sound decisions alone. A cross-functional data governance board that includes academic leadership, legal counsel, and privacy staff alongside IT can weigh those concerns together and produce policies that hold up to scrutiny. Letting IT decide alone confuses infrastructure ownership with governance authority; IT manages the systems, but questions like what data may train a model or how long it's retained require legal and academic judgment IT isn't positioned to make on its own. Deferring to the vendor inverts accountability, since the district, not the vendor, is legally responsible for how student data is protected and used. Letting individual teachers set their own rules produces inconsistent, unauditable practices across classrooms, which is precisely what governance structures exist to prevent. This applies specifically to decisions about data used to train or ground AI tools; day-to-day classroom use of an already-approved tool doesn't require board-level review each time. A practical check for the district is confirming the governance board has a documented charter naming who approves any new data use before a pilot expands.