A school-district security manager maps state student-privacy rules to an AI tutoring vendor’s data practices. What should drive the governance decision?

Ensuring the vendor's data handling conforms to applicable student-privacy rules and that prompt logging and retention comply with state education law is the action that best addresses the manager's mandate. Student-privacy rules (state statutes, FERPA, SIS records policies) govern how student-generated data may be stored, logged, used for training or fine-tuning, and disclosed. The vendor's contractual commitment, technical controls (encryption at rest, access logging), and data-deletion procedures must all map to these statutory obligations before the district approves. A vendor that cannot commit to student-privacy-rule compliance is disqualified regardless of accuracy.

Approving the vendor for school use after confirming its published privacy policy mentions student-data protection commitments mistakes a public statement for enforceable compliance; a mention in a policy does not prove that storage, logging, use for training, and deletion actually conform to state student-privacy rules and FERPA obligations. Requiring the vendor to encrypt student prompts in storage while permitting retained prompts for future model improvement still fails governance because encryption does not authorize secondary use; retaining student prompts to improve models allows training or fine-tuning on student data and extended retention that state privacy law prohibits without authorization. Selecting the vendor hosting arrangement based on regional data residency with standard retention and deletion controls confuses generic hosting controls with legal conformance; residency and standard settings do not by themselves ensure that data handling, logging, training-use limits, and deletion map to applicable student-privacy regulatory expectations before approval.

Operational check: before any AI tool purchase, legal has reviewed the vendor's data retention, student-data use, teacher access, and fine-tuning policies against state privacy law and the district's records-retention schedule.