Student Safety: What Microsoft’s New AI Standard Entails

The agreement was announced on September 9, 2026, by Microsoft, the American Federation of Teachers (AFT), and the United Federation of Teachers (UFT). Microsoft then provided details on its commitments on September 16. The document is titled “National AI Safety & Privacy Standard for Schools” and applies to Microsoft’s artificial intelligence products designed for education.^[1][2]

It operates on a contractual basis. Effective November 1, 2026, a U.S. school district will be able to add the standard to a new Microsoft agreement or an existing contract, without waiting for its renewal. The ten principles will then become enforceable within the framework of that business relationship. The text provides for a two-year term, renewable, and allows the affected institutions to seek remedies in the event of a breach.^[3][4]

This clarification is essential: although the word “national” appears in the standard’s name, the agreement is not a federal law applicable to all AI providers. It is not binding on institutions that do not adopt it, nor on competing companies. It supplements existing obligations without replacing the Family Educational Rights and Privacy Act (FERPA) or the Children’s Online Privacy Protection Act (COPPA).^[3][6][7]

Most of the principles cited are not new when considered individually: purpose limitation, data minimization, security, informing families, and human oversight are already part of the vocabulary of data protection. What is new is their combination within a contractual commitment specifically designed for AI in education, with precise obligations regarding input data, outputs, and certain agentic functions.

The standard broadly defines the data it covers. It includes requests, generated responses, transmitted files, behavioral signals, metadata, and multimodal content. It also covers aggregated or de-identified data derived from these interactions. This definition seeks to prevent information from being excluded from protections solely because it is not part of the traditional school record.^[3]

Another notable point is that the training ban is not limited to foundation models. The provider may not use the covered data to train, refine, update, evaluate, or improve its models and products. An exception is provided for detecting violations, dangerous content, or security incidents, but it must be limited to what is strictly necessary, documented, and subject to retention periods.^[3]

MSc AI Governance, Risk & Compliance

The Bac+6 program that trains legal professionals to understand AI and Data technologies so they can master their governance, risks and compliance.

12 months — Bac+6 Entry with a Bac+5 Work-study internship, initial or continuing education Paris-Villejuif campus

Discover the program → RNCP Level 7 certification

The text organizes the obligations around ten principles. The table below provides a practical overview of these principles, without replacing the full provisions of the agreement.^[3][4]

An educational AI system does more than just process answers to exercises. Depending on the tool, it can reveal a student’s academic level, comprehension difficulties, writing style, work pace, a disability, or personal details shared in a conversation. With minors, there is a significant imbalance: students do not always choose the tool, may not fully understand the implications of data collection, and may confuse technical assistance with a relationship of trust.

The issue, therefore, goes beyond confidentiality. A generated response can influence a referral, an evaluation, a disciplinary action, or access to support services. The standard stipulates that the teacher and the school must retain the final decision-making authority. It also requires clear explanations of the model’s limitations. However, this oversight does not guarantee that a human will detect every error, especially if the tool is used on a large scale or if its results appear convincing.

Restrictions on companion-type functions and on agents capable of taking action are also significant. They acknowledge two distinct risks: the creation of emotional dependence and the shift from a tool that advises to a system that executes. In a school setting, this second development requires strict permissions, activity logs, and the ability to interrupt the action.

The document confirms that Microsoft accepts more explicit contractual limitations for certain educational uses of its products. It provides participating school districts with a clearer framework for negotiating, monitoring, and, if necessary, challenging data processing practices. The Associated Press notes, however, that the scope of the program will depend on its adoption by schools, the quality of the audits, and whether other providers choose to participate.^[5]

It does not allow us to conclude that all risks are under control. The provisions do not demonstrate the educational accuracy of the answers, nor do they demonstrate improved learning or the absence of bias. Nor do they resolve issues of cognitive dependence, reduced effort, cheating, or inequalities in access. A data protection policy is a prerequisite for trust, not a comprehensive assessment of educational effectiveness.

Nor does the text establish that the data will never be processed. A functional service must necessarily receive certain information, secure it, and sometimes retain it. The progress lies rather in limiting the purposes for which data is processed, controlling the duration of retention, ensuring the possibility of erasure, and prohibiting the use of these data traces to improve models in general.

The standard was designed for U.S. school districts and is aligned with FERPA, which governs access to and disclosure of educational records in the relevant institutions, as well as with COPPA for certain services intended for children under the age of thirteen.^[6][7] It does not automatically apply in France or the European Union.

For a French institution, the General Data Protection Regulation, the CNIL’s recommendations, education law, and public procurement rules remain the relevant frameworks. In particular, the CNIL emphasizes the special vulnerability of minors, the need to supervise their interactions with AI systems, the provision of information to individuals, and the involvement of the data protection officer.^[8]

A European organization should therefore not consider a provider’s adherence to this standard as automatic proof of compliance. It must verify the legal basis, the purposes, the transfers, the retention period, the processors, the exercise of rights, security, and the impact on minors. Microsoft’s commitments can serve as a contractual benchmark, but they do not replace this analysis.

For school administrators and local authorities, the standard translates general principles into concrete negotiation points. A contract should specify what data is entered into the system, which data is stored, who can access it, when it is deleted, how an incident is reported, and which features are enabled for students. A procedure for rapid suspension must also be in place in case a particular use results in unintended consequences.

For teachers, the challenge is to distinguish between providing assistance and delegating responsibility. Summarizing a document, adapting an exercise, or providing formative feedback does not carry the same consequences as assigning a grade, identifying risky behavior, or recommending a course of action. The more a decision affects a student’s rights and educational path, the more substantial, documented, and subject to review the human validation must be.

For families, clear information should answer simple questions: Is the tool mandatory? What information does it process? Can certain uses be refused? How can data be corrected or deleted? And who should be contacted if a problem arises? Transparency is only useful if it enables real action and if it can be understood without legal or technical expertise.

The first measure of the standard’s scope will be its adoption rate after November 1, 2026. It will be important to determine how many districts actually implement it, which products and uses are covered, and whether the provisions hold up in real-world situations: security incidents, data that cannot be deleted, features added without sufficient information, or decisions based on erroneous output.

The second issue concerns verification. Audits must be sufficiently independent, regular, and transparent to demonstrate that practices align with commitments. It will also be necessary to monitor how Microsoft documents its security exceptions and oversees its subcontractors, as a strict clause loses its value if its implementation remains opaque.

Finally, industry-wide adoption will be decisive. If other major providers adopt comparable safeguards, the agreement could help establish a common foundation for AI in education. If it remains an isolated initiative, schools will continue to manage a patchwork of contracts and levels of protection. The central question, therefore, will not only be whether a tool can be used in the classroom, but under what conditions it deserves the trust of students, teachers, and families.