Microsoft said it will make its National AI Safety and Privacy Standard available to every school district in the United States from November 1, 2026, turning a September agreement with teachers unions into a contract option districts can add to their Microsoft deals. The standard bars the use of student and educator data to train AI models, bans companion-style features, and requires human oversight of consequential decisions. It is a contract framework, not a new federal law, and its protection depends on districts putting its terms into their own agreements.
What the standard is
The agreement was announced on September 9, 2026, by Microsoft, the American Federation of Teachers and the United Federation of Teachers. Microsoft described it as the first agreement of its kind, establishing enforceable protections for students, families and educators. The document is a memorandum with the National Academy for AI Instruction, a body announced by the AFT in 2025.
Microsoft Vice Chair and President Brad Smith said the standard sets a high bar for child privacy and AI safety. AFT President Randi Weingarten called it a hard-fought, iron-clad agreement with real teeth, arguing that anything less than legally enforceable provisions is a wish list. UFT President Michael Mulgrew said it empowers districts to end agreements and seek damages.
The training ban at the centre
The first of the standard’s ten binding principles bars a provider from using any Covered Data to train, fine-tune or benchmark any AI model. Covered Data is defined broadly, covering prompts, AI outputs, uploaded files, behavioral signals and metadata, and the ban applies retroactively to previously collected data. It also binds subsidiaries, subprocessors and partners, and survives termination indefinitely.
There is a narrow exception for safety and security purposes, and it expressly forbids general model improvement. On request, a provider must supply an annual statement signed by a senior officer confirming that no Covered Data was used for training outside that exception. That promise matters because a training ban is otherwise hard for a school to verify.
Data control, tracking and deletion
The second and third principles limit collection to what is strictly necessary to deliver the contracted product, and prohibit precise geolocation tracking, behavioral tracking, keystroke logging, long-term profiling and biometric collection. Collecting data from students under 13 requires verifiable parental consent compliant with COPPA, the federal children’s online privacy law, where that consent is legally required.
The district and its students own all Covered Data, and the provider may never sell it or use it for advertising. Schools control retention and deletion, with data deleted within 180 days of a request and stored in the EU or North America. De-identified telemetry is carved out for security and product improvement, but not for training, profiling or advertising.
Human oversight and companion features
The fourth principle requires meaningful human review before any covered AI system makes decisions for educators or students. It prohibits companion-style features designed to foster emotional attachment or dependency, and requires consequential agentic features to be disabled by default unless a district administrator enables them. Providers must also maintain crisis protocols for high-risk content involving self-harm or violence.
The Academy will instruct educators that they cannot use AI for automated grading without human review, automated disciplinary or placement decisions, emotional assessment, or behavioral surveillance. That matters because the riskiest classroom uses are often the decision a school lets a model make without a person checking. Human oversight here is a workflow rule, not just a design preference.
Security, transparency and enforcement
The fifth principle requires independent certifications, including SOC 2 Type II, ISO 27001, ISO 27701 and ISO 42001, plus FedRAMP Moderate authorization where required. Providers must notify a district of a confirmed or suspected breach within 72 hours, and maintain a public trust page listing certifications, audit summaries and known incidents, updated at least quarterly.
The remaining principles require encryption and multi-factor authentication, backed by annual independent penetration testing, plain-language guides for families within 90 days, and fairness testing across diverse student populations, including a provider-funded equity analysis within 12 months. They also guard against feature creep and vendor lock-in, with data exportable at no cost, and deletion and breach-reporting duties that outlive the contract.
What November 1 actually changes
November 1 is the availability date, not the day every classroom is automatically covered. Microsoft says the protections will be available to every school district from that date, addable to new or existing agreements with no renegotiation or renewal required. Under the agreement, each participating provider must make the protections available on request within 90 days of the effective date.
That distinction is the whole story for administrators. A district that does nothing gains no new contract right on November 1, while a district that asks for the addendum gains enforceable terms, including termination and damages for violations. The standard therefore rewards districts with the legal capacity to act, and leaves less resourced districts on default terms until they ask.
Our read: strong terms, narrow scope
Our read is that the standard is strong where it applies, and limited in where it applies. Its training ban, ownership rule and 180-day deletion duty go further than the voluntary pledges that have dominated school AI so far. But it covers only AI products designed and marketed for education, while general-purpose productivity, search, cloud and workplace products are excluded.
The agreement runs for two years from signing and must be renewed in writing, and a provider may withdraw with 60 days’ notice. An addendum records that Microsoft has not completed an ISO 42001 assessment for education AI products and is targeting certification by December 31, 2027. Speaker Coach and Speaker Progress are exempt during user-initiated speaking activities.
Other providers’ data rules sharpen the point. OpenAI has carved out a different exception, allowing training on security researchers’ Daybreak sessions under its own controls, showing that training bans are rarely absolute and depend on the exception beside them. Microsoft’s exception is narrower, limited to safety and security, but scope, exception and enforcement matter as much as the ban.
Why It Matters
The standard arrives in a regulatory gap the unions have stressed. Weingarten said HIPAA and FERPA never envisioned AI, and that companies need to take responsibility for products they market to students and educators. A contract standard cannot replace a statute, but it can create enforceable duties district by district, where AI rules for schools do not yet exist.
So far, Microsoft is the only provider in the agreement, while the AFT says it is in talks with OpenAI and Anthropic about safeguards. That makes November 1 a test: wide adoption would pressure other providers to match the terms, while stalled adoption would leave it a model contract. The next data point is how many districts sign the addendum.
Microsoft is also changing commercial terms for business customers, with usage-based billing for Copilot business customers beginning on December 1, so school and business administrators must re-read Microsoft contracts. The school standard matters more for children’s data, but both warn against accepting a vendor’s default AI terms without checking the addendum.
Background
The standard extends AFT work, including its 2024 Commonsense Guardrails for Using Advanced Technology in Schools, built around nine principles, and the National Academy for AI Instruction announced in 2025 to train educators in AI tools. Los Angeles Unified, New York State United Teachers, and New York City Public Schools adopted similar frameworks just before the September announcement.
Source: Microsoft announcement and ten-principle summary
0 Comments