What Should Schools Require Before Approving an AI Tool?

Require two signatures before an AI tool goes on your approved list. The first is the supplier's: written answers on what happens to your students' and staff's data, what a student-facing product blocks and logs, and what it can decide about a child without a person looking. The second is your school's own: what this tool is for, who owns it, and what would take it off the list. A tool carrying only the first signature is not approved yet, however good the paperwork.

Most schools have the first and skip the second. That is why approved lists grow and almost never shrink, and why so few leadership teams can name the last tool that came off one.

The question has a live edge this term. On September 9, 2026, the American Federation of Teachers, the United Federation of Teachers and Microsoft announced what they call a National AI Safety & Privacy Standard for schools. Some version of the same question is already reaching leadership teams, from a teacher, a parent or a governor: does this mean we can approve it now? Not on that alone, and not because the standard is weak. It settles the supplier's half about as firmly as a standard can. The other half was never going to be settled by anyone but you.

What should a school require before approving an AI tool?

A school should require two signatures before approving an AI tool: the supplier's and its own. I call this the Two-Signature Rule, and I offer it as a way of thinking rather than a tested method:

The Two-Signature Rule is the test I ask leadership teams to apply before any AI tool goes on an approved list: it needs two signatures, not one. The first is the supplier's, a written promise about what the product will and will not do with your people's data and attention. The second is the school's own, a written statement of what the tool is for, who owns it, and what would take it off the list. A vendor standard can supply the first signature. Only the school can supply the second.

Most vetting checklists online concentrate on the first signature: privacy law, data retention, security. Those questions matter. But a tool can pass every one of them and still be the wrong thing for your students to use, or a tool nobody owns, or a tool that stays on the list for years after anyone last opened it. A standard can make a product safe to use. It cannot make it worth using.

What does the new AFT, UFT and Microsoft standard actually settle?

The new standard settles the supplier's side of the decision, for one supplier, in a form a district can enforce.

According to the AFT's announcement, the agreement rests on three priorities: protecting privacy, enhancing safety, and providing transparency and control. Its central privacy line is plain: "Student and educator data will not be used to train AI models, sold or repurposed." Schools, it says, will "maintain control over how data is used, retained and deleted." The feature that makes it more than a statement of intent is that districts can write these protections into their Microsoft customer agreements, which makes them contractually enforceable. GovTech's report on the same day describes ten principles in the underlying standard, including bans on behavioral tracking and keystroke logging, human review before AI influences discipline or academic placement, a 180-day data removal timeline and breach notification within 72 hours. Those details come from GovTech's reporting; the union's own release summarizes them at a higher level.

In England, the Department for Education (DfE) has been building the supplier's side from a different direction. Its Generative AI: product safety standards, published January 19, 2026, set out thirteen areas that edtech developers are expected to meet, from filtering and security to cognitive development, emotional and social development, mental health and manipulation. Two of them go further than a typical privacy checklist. A product should be able to "detect cognitive offloading actions that indicate the learner is asking the system to do the work for them." It should "avoid attempting to cultivate personal relationships with users." The document is written for suppliers, and says only that schools "may also find these standards helpful in assessing which AI products are safe for use in education."

That matters more this term because of safeguarding. SWGfL's summary of Keeping children safe in education 2026, in force since September 1, 2026, notes that it points schools to the DfE's generative AI product safety guidance when applying filtering and monitoring duties, and names chatbots and companion-style systems among contact risks. For a school in England, the supplier's signature is no longer only good practice. It is part of showing that you took your safeguarding duties seriously, and what AI means for safeguarding in schools sets out the rest of that duty, from filtering and monitoring to companion-style chatbots.

Why is a vendor standard not enough on its own?

A vendor standard is not enough because it answers the question "Is this product safe to use?" while the approval decision asks "Is this use right for us?"

The sharpest version of this objection came within hours of the announcement. In a statement on the deal, Josh Golin, executive director of the children's advocacy group Fairplay, argued that the agreement "elides the most important question of all: Should student-facing AI products be used in schools at all?" He made two further points any school leader should weigh. The agreement "only applies to Microsoft, not to the many other companies selling AI products to schools." And it "places the burden on schools to execute and enforce the contract, which they are not in a position to do, and which should be the job of regulators."

You do not have to share Fairplay's view of AI in classrooms to see the force of the enforcement point. A contract clause protects you only if someone in your school knows it exists, checks it and acts when it is breached. That is a job, and jobs need owners.

There is also the question of scale. Instructure's 2026 EdTech Top 40 report, covering September 2025 to April 2026, found that US districts had access to an average of 3,001 unique digital tools each, while the average student and the average educator actually used four of them across the year. No leadership team can meaningfully approve three thousand of anything, and nobody is using three thousand either. An approved list that long is not a decision. It is an inventory. A list nothing ever comes off is not an approved list at all.

The first signature: what to require from the supplier

The first signature is a set of written answers from the supplier, in the contract or terms rather than on a marketing page.

Between the AFT standard and the DfE's thirteen areas, the ground is well mapped. Before approval, I would ask every supplier of an AI tool to answer these in writing:

1. Training and reuse. Will any student or staff data be used to train or fine-tune a model, sold or repurposed? The answer you want is no, without conditions buried in a later clause.
2. Retention and deletion. Who decides how long data is kept, and how quickly is it deleted when you ask?
3. Breach and change. How quickly will you be told about a breach, and how will you be told when the product changes in a way that affects students?
4. Filtering and monitoring. For any student-facing tool, what does it block, what does it log, and who in the school can see those logs?
5. Learning and well-being. Does the product notice when a learner is asking it to do the work for them, and does it avoid presenting itself as a friend? Both come straight from the DfE's standards, and neither appears on a typical privacy checklist.
6. Consequential decisions. Can the product influence a decision about a student, such as placement, discipline or a grade, without a named person reviewing it first?

If a supplier cannot answer these clearly, that is your answer. If they point to a standard they have signed, read what it commits them to; one supplier's commitment says nothing about the next.

How do you vet an AI vendor's data privacy and security?

Vet an AI vendor's data privacy and security by asking for proof you can file, not assurances you can quote: what the product collects and why, a written agreement that limits how the supplier uses the data, a list of everyone else who handles it, independent security assurance, a deletion promise with confirmation, and a breach deadline. The six questions above tell you what a supplier promises. These requests tell you whether you can check.

Every promise needs a proof, and every proof needs a place in the file. A supplier who says "we take privacy seriously" has given you a mood. A supplier who sends a named list of sub-processors, the outside companies that handle your data on its behalf, has given you something a governor can read.

The promise	The proof to ask for	What to file
"We collect only what the tool needs"	A list of every category of data the product collects, each with its purpose	The list, dated, beside the approval record
"We use your data only for your purposes"	A written agreement that limits the supplier to the service it provides you and bars passing the data on	The signed agreement, not the order form
"We control who else sees it"	A named list of sub-processors and what each can access	The list, with the date you received it
"Your data is secure"	The supplier's account of its encryption, sign-in controls and audit logging, plus the report or certificate from an independent audit, and what that audit covers	The report or certificate, with its scope and date
"Your data stays where we say"	Where the data is stored and processed, and the safeguards for any transfer to another country	The supplier's written answer
"We delete on request"	How long data is kept, how backups and caches are handled, and written confirmation once deletion has happened	The confirmation, each time
"We will tell you if something goes wrong"	A deadline for telling the school about a breach, and a named person at the supplier to call	The clause that sets the deadline

The security row deserves the most skepticism. My reading is that the useful question is not whether the supplier holds a certificate but what the auditor actually looked at. A certificate shows that a company's controls were examined. It does not show that the feature your students use was inside the scope. Ask for the scope, not the logo.

What does the law add in England and the United States?

In England, the Department for Education's guidance on procuring educational technology, last updated October 14, 2026, treats an AI feature as a reason to look harder, not a reason to skip a step. It tells schools to consult their data protection officer, to complete a data protection impact assessment (DPIA) early where the processing is likely to result in a high risk to people's rights and freedoms, and to set responsibilities out in a contract or data processing agreement. For AI tools it asks suppliers to explain whether data trains the model, how outputs are moderated and how bias and inaccuracy are handled, and it says to consult the designated safeguarding lead before deciding to buy.

In the United States, the Department of Education's Privacy Technical Assistance Center set out the route most online services rely on in its February 2014 guidance, Protecting Student Privacy While Using Online Educational Services. Under FERPA's school official exception, the provider performs a service the school would otherwise do itself, stays under the school's direct control over the use and maintenance of the records, and uses them only for authorized purposes without passing them on. A written contract is usually how a school shows that control. The document predates generative AI and says nothing about models, so read it as the floor for any online service rather than a guide to AI, and check your state's student privacy law, which can add requirements.

The same guidance makes a point that belongs on every approval record. Accepting click-through terms can create a contract, so an individual teacher can bind a district without anyone approving it. It advises schools to save a copy of the terms, to check whether the provider can change them without notice, and to limit who may accept them. Add one rule to your list: nobody clicks "I agree" on a tool that has not been approved. The rule for staff who paste student data into a chatbot is set out in can staff put student data into ChatGPT, and what FERPA and COPPA settle for a district covers the federal clauses a policy can copy and the ones it must decide.

Sources for this section were last checked on October 16, 2026.

The second signature: what the school has to write itself

The second signature is three sentences the school writes about each tool: what it is for, who owns it, and what would take it off the list.

What it is for. Name the job, not the category. "Supporting teachers" is a category. "Drafting first-pass feedback on Year 10 English essays, which the teacher then edits" is a job. If you cannot name the job, you are approving curiosity, and curiosity belongs in a time-limited trial, not on a permanent list. Schools that have already settled what they want AI to do find this line quick to write, because the job is named in a document they wrote before any supplier was in the room; that is the everyday use of an AI strategy people actually use, and the approval record inherits its answers instead of improvising them one tool at a time.

Who owns it. One named person who knows what the supplier promised, checks that it is still true, and is the first call when something goes wrong. This is the answer to Fairplay's enforcement point. The contract does nothing until a person picks it up. If the owner leaves, the tool is unowned until someone else signs.

What would take it off the list. A condition and a date. "We will review this in February and remove it if teachers are not editing the feedback before students see it" is a removal condition. "We will keep it under review" is not. It is the same logic as the Exit Question I put to AI pilots, set out in why AI pilots so often go nowhere: anything without a decision date stays forever by default.

For student-facing tools, add a fourth line: what students would lose if the tool did this work for them. Sometimes the honest answer is "nothing much," and the tool frees time for better work. Sometimes the answer is "the thinking we are trying to teach," and then approval should come with limits on when and how students may use it.

Here is how the two signatures work together in a hypothetical case. A head of English asks to approve an AI feedback tool for Year 10 essays. The supplier has signed a standard and confirms in writing that essays are not used for training, are deleted within a set period and are never used to grade a student without teacher review. That is the first signature, and it is solid. The school's side reads: for first-pass feedback that teachers edit before students see it; owned by the head of English; removed if an audit in February shows unedited feedback reaching students, or if students begin submitting the tool's suggestions as their own redrafts. Both signatures are there. The tool goes on the list, with a date beside it.

Change one detail. The head of English leaves at Christmas and nobody takes over. The first signature is unchanged, but the second is now blank. Under the Two-Signature Rule, the tool is no longer approved until a new owner signs.

The approval record: one page per tool, and what goes on it

An approval record is a single page per tool carrying both signatures, short enough that a busy leader will fill it in.

The first signature has no shortage of forms behind it. The Future of Privacy Forum's checklist for vetting generative AI tools, published April 24, 2024, walks a school through the legal-compliance questions in more detail than I would attempt, and it is the better instrument for that job. What it does not do, because it was never meant to, is decide whether your school should use the tool. Nearly every form of this kind stops where the law stops, which is one reason so many approved lists are long and so few are defensible.

So here is a record that carries both halves. Copy it into a document, or into twelve columns of a spreadsheet, one row per tool.

Part one. The supplier's signature, answered rather than asked.

1. Training and reuse. Their written answer on whether student or staff data trains a model, is sold, or is repurposed.
2. Retention and deletion. Who decides how long data is kept, and how fast it goes when you ask.
3. Breach and change. How quickly they tell you about a breach, and how they tell you when the product changes.
4. Filtering and logging. For student-facing tools: what it blocks, what it logs, and who in school can read the logs.
5. Learning and well-being. Whether it notices a learner outsourcing the thinking, and whether it avoids presenting itself as a friend.
6. Consequential decisions. Whether it can touch a decision about a student without a named person reviewing it first.

Part two. The school's signature, in the school's own words.

7. What it is for. The job, in one sentence, specific enough that someone else could tell whether it is being done.
8. Who owns it. One name. Not a committee, not a job title with nobody in it.
9. What would take it off the list. A condition and a date, both written before anyone is under pressure.
10. What students would lose. Student-facing tools only: the thinking this tool now does instead of them, and whether you mind.

Part three. The part everyone forgets.

11. Approved by, and when. A name and a date, so the decision has an author.
12. Where the supplier's answers are filed. A link or a folder. An answer nobody can find is an answer nobody has.

Two things make the difference between a record that works and one that decorates a shared drive. Keep it to one page: a form that takes an hour will be filled in once, and a form that takes ten minutes will be filled in every time. And write lines 7 to 9 in plain sentences rather than ticks, because a tick cannot be checked against reality later and a sentence can.

Here is the record filled in for a hypothetical tool, a revision assistant that students use at home.

Line	Entry
What it is for	Answering Year 11 students' questions on the science topics they are revising, outside lesson time, at the level of a patient study partner rather than an answer key
Who owns it	The head of science
What would take it off the list	Removed at the February review if students cannot explain answers they arrive at with it, or if the supplier changes what it does with students' questions
What students would lose	The productive struggle of being stuck and working out, which is where most of the learning in revision happens. Approved for questions, not for worked solutions, and the setting that reveals full solutions stays off
Approved by, and when	Deputy head, curriculum, September 2026

Notice what the fourth line does. It is the only line on the form that can stop a tool which passes every other test, and it is the line no vendor standard will ever write for you.

One limit worth stating plainly. A record is true on the day it is signed, and these products change underneath it: the model is swapped, the terms move, a new feature widens the job. That is a separate discipline, and what a school should do when an approved tool changes takes it up. Line 3 of this record is where the two meet, which is why it asks how you will be told rather than only what the product does today.

If you already have a list, do not start at the top and work down. Sort it first, in one sitting. Student-facing tools go in the first pile and get the full record. Tools that touch student data go in the second and get lines 1 to 3 and 7 to 9. Everything else goes in the third pile, which needs one line saying what it is for and who to ask. Most lists are mostly third pile, and seeing that is usually the moment a leadership team realizes the work is smaller than it looked. What the sort tends to expose is not a tooling problem. It is whether anyone owns this work, whether staff were ever told what they may use, and whether the school could show its reasoning to a governor next week, which is the ground the seven dimensions of AI readiness cover: they score the conditions the list sits inside rather than the list itself.

What Good Looks Like

Good tool approval is visible in a short list, a name beside every entry, and at least one tool that has come off.

When I work with leadership teams on AI governance, the first thing I ask to see is not the approved list. It is the last tool that came off it, and why. Across the schools and organizations I work with, the teams with the healthiest lists can answer that question in a sentence. The teams that cannot usually have a list that only grows.

In practice, the schools with the strongest lists share a handful of habits:

• The list is short enough to read. Staff can name what is on it without looking it up.
• Every entry has both signatures. The supplier's written answers are filed, and the school's three sentences sit beside them.
• Student-facing tools face a higher bar than staff tools. The approval for a tool students use directly includes the fourth line about what they would lose.
• Removal is normal. Taking a tool off the list is treated as a decision working, not a failure.
• Parents can see it. The list, and what each tool is for, is published in plain language.

I have advised the UK Department for Education, the Knowledge and Human Development Authority (KHDA) in Dubai and the Ministry of Education in Kazakhstan on AI in education, and I have a lot of sympathy for the people who write standards. A national standard has to work for every school, which is precisely why it cannot tell any one school what to choose. That choice was always going to land with you.

When is a supplier's signature enough on its own?

A supplier's signature can carry most of the weight when a tool is used only by staff, touches no personal data and does no more than the tools staff already use.

The counterargument deserves a fair hearing: requiring a written purpose, owner and removal date for every staff productivity tool can turn governance into paperwork, and paperwork is how approved lists end up ignored. The answer is to scale the second signature to the stakes, not to drop it.

Use	First signature (supplier)	Second signature (school)
Staff only, no personal data	Enterprise terms and data protection checked once	One line: what it is for and who to ask
Staff use involving student data	Full written answers on training, retention, breach and change	Purpose, named owner, removal condition and date
Student-facing	Full written answers, plus filtering, monitoring, learning and well-being	Purpose, owner, removal condition, and what students would lose

The bottom row is where the Two-Signature Rule matters most and a contract alone is weakest. It is also where the public argument is loudest this month, from the restriction decisions some US districts have made to Fairplay's challenge to the question itself.

What should leaders do this term?

Take your current approved list, or the tools staff are already using if you do not have one, and check every entry for both signatures. The record above is the form for that, and the three piles are how a leadership team gets through it in an afternoon rather than a term. If you are new in post, this is one of several jobs arriving in the same fortnight and its place in the order is not obvious; the first 90 days of leading AI change sets out where the approved list sits among them, and why it rarely belongs in week one.

Anything missing the supplier's written answers gets a request this month, using the six questions above. Anything missing the school's three sentences gets a named owner and a review date, or comes off. Anything student-facing gets the fourth line. Then publish the result, in plain language, to staff and parents. Keep the policy around the list short enough to be read: why a short school AI policy beats a long one recommends holding the approved tools in a separate one-page appendix that you update each term, and the records above are what belongs in it.

Where a supplier has signed the new standard, or can show how its product meets the DfE's thirteen areas, welcome it: the first signature gets quicker and firmer. Then do the part no standard will do for you. It is the principle behind the decisions AI should never make in your school: the tool can be excellent, but the approval still has to belong to a person.

The next step

If your leadership team is working out what belongs on its approved list and who should own it, this is the kind of work I support through AI strategy sessions for schools, alongside the governance questions that sit underneath it. For the wider picture, what responsible AI adoption looks like in practice sets out the habits an approved list belongs to. If you would rather read than book anything, I write a newsletter for school and trust leaders on the decisions this kind of work turns on.

Sources and further reading

• American Federation of Teachers, "AFT, UFT and Microsoft Announce 'National AI Safety & Privacy Standard' for Schools to Protect Students, Families and Educators," September 9, 2026. aft.org
• Microsoft, "AFT, UFT and Microsoft announce 'National AI Safety & Privacy Standard' for schools," Microsoft Source, September 9, 2026. news.microsoft.com
• GovTech, "Microsoft, AFT, UFT Set Precedent for District AI Governance," Government Technology, September 9, 2026. govtech.com
• Fairplay, "Statement on AFT/UFT Deal with Microsoft," Josh Golin, September 9, 2026. fairplayforkids.org
• Department for Education, "Generative AI: product safety standards," GOV.UK, January 19, 2026. gov.uk
• Department for Education, "Data protection in schools: Procuring educational technology (edtech)," GOV.UK, last updated October 14, 2026. gov.uk
• U.S. Department of Education, Privacy Technical Assistance Center, "Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices," February 2014. studentprivacy.ed.gov
• Future of Privacy Forum, "FPF Develops Checklist & Guide to Help Schools Vet AI Tools for Legal Compliance," April 24, 2024. fpf.org
• SWGfL, "Keeping Children Safe in Education 2026: What Do Schools Need to Know?," July 9, 2026. swgfl.org.uk
• Instructure, "New Instructure Data Shows K-12 Districts Are Demanding Evidence, Not Just Access to Edtech Tools," 2026 EdTech Top 40 report, June 29, 2026. instructure.com

Dan Fitzpatrick is the founder of The AI Educator, a Forbes contributor and the author of bestselling books on AI in education. Read more about Dan.