Microsoft, the American Federation of Teachers, and the United Federation of Teachers have announced a national school AI safety and privacy standard that U.S. districts can add to Microsoft agreements beginning November 1, 2026. The agreement, announced September 9, is designed to make classroom AI safeguards contractually enforceable rather than leaving them as product promises or district-by-district negotiating points.
The announcement matters because schools are trying to decide whether AI tutors, writing tools, study agents, and classroom assistants can be used safely while federal AI rules remain limited. The standard gives districts a concrete set of terms covering student data, model training, memory, agentic features, audits, human oversight, family transparency, and product changes.
It also arrives at a moment when large school systems are moving cautiously. The Associated Press reported that New York City and Los Angeles, the two largest U.S. school districts, have paused student AI use while they evaluate privacy and safety issues. The Verge reported that districts can begin incorporating the protections into new or existing Microsoft contracts in November without waiting for a full renewal.
What the standard changes
The core shift is that the standard turns AI safeguards into procurement language. Microsoft says school districts will be able to add the protections to Microsoft customer agreements, making them enforceable if the commitments are not met. The Microsoft-backed fact sheet says the protections will be available to every U.S. school district starting November 1, with no contract renegotiation or renewal required.
The full 31-page memorandum is broader than a simple promise not to train models on student work. It defines student data to include prompts, AI-generated outputs tied to a student, grades, disciplinary records, device identifiers, location data, behavioral patterns, audio or visual data, metadata, and saved memory files. Covered data also includes data generated by educators, administrators, or the education customer while using covered AI education products.
That definition is important because many AI privacy fights turn on what counts as data. A classroom chatbot may process obvious student content, but it may also generate usage patterns, summaries, uploaded files, memory entries, or telemetry. The standard draws a line around those categories and treats them as school-controlled data, not raw material for product growth.
No training on student or teacher data
The most visible rule bars AI providers from using covered student, educator, or customer data to train, fine-tune, benchmark, update, or otherwise improve AI models. The agreement also closes off common workarounds: de-identified, aggregated, transformed, or covered-data-derived datasets cannot be used as training data, and covered data cannot be used as the source material for synthetic data generation.
There is a narrow safety and security exception. Covered data can be processed when reasonably necessary to detect, prevent, investigate, mitigate, or remediate harms such as self-harm risk, child sexual abuse material, grooming, threats of violence, bullying, malicious activity, security incidents, vulnerabilities, or unauthorized access. But the memorandum says that exception cannot become a path for general model improvement, profiling, advertising, market research, or unrelated product development.
For districts, that distinction is practical. A vendor may need to process some data to block abuse or investigate a security issue. The standard requires that use to be purpose-limited, minimized, auditable, and separate from general model training.
Memory, agents, and classroom control
The standard is unusually specific about AI product behavior. It treats memory files as covered data and says users or schools should be able to see, erase, and turn off retained student information where memory is enabled. Providers cannot require memory as a condition of using the service.
It also addresses agentic features, which are increasingly relevant as AI tools move beyond answering questions. The memorandum defines an action-taking feature as an AI capability that can initiate, approve, transmit, modify, or execute actions for a user. For students, externally consequential agent features must be disabled by default unless an authorized school administrator enables them with scoped permissions, oversight, and audit logging.
That could matter for future classroom tools that send messages, submit work, change settings, access third-party systems, or make purchases or commitments. The agreement does not assume those features are inherently off-limits, but it treats them as higher-risk functions that should not quietly arrive as defaults.
What schools still have to decide
The standard does not tell every district when to use AI in classrooms or which grade levels should get access. It gives schools control over enablement, including the ability to turn products on or off by grade level, age, and use case. It also calls for more restrictive settings for students under 13.
Some uses are explicitly prohibited for educators under the Academy’s instruction framework. The memorandum lists automated grading without human review, automated disciplinary decisions, automated placement decisions such as course selection or special education referrals, emotional or psychological assessment, and surveillance for behavioral prediction as no-exception uses.
That makes the standard more than a privacy document. It is also a deployment checklist for where schools should keep humans in the loop. AI can help students practice, summarize, draft, or study, but it should not quietly become the decision-maker for grades, discipline, placement, psychological assessment, or monitoring.
Why it matters beyond Microsoft
Microsoft is the first major provider attached to the standard, but the broader question is whether other AI and education technology vendors adopt similar contract language. AP reported that OpenAI and Anthropic are in discussions with the AFT, while Google had not made the same commitment at the time of its report.
That competitive pressure matters because schools rarely run on a single software provider. A district may use Microsoft 365, Google Workspace, learning management systems, assessment platforms, security tools, and dozens of smaller classroom apps. If only one vendor offers enforceable AI terms, district technology officers still face a fragmented privacy map.
The Microsoft agreement gives procurement teams a reference point. Districts can now ask whether an AI education product blocks training on student and teacher data, limits telemetry, gives schools control over retention and deletion, documents model limitations, permits audits, restricts agentic actions, bars manipulative companion-style features, and gives families plain-language information about classroom AI use.
The next test is adoption
Microsoft’s own education AI documentation already reflects parts of this posture. Its support page for the Study and Learn Agent says student content stays within the Microsoft 365 tenant, is not used to train underlying models, is filtered through content safety systems, is available only to users 13 or older in managed K-12 tenant accounts, and is designed for learning rather than grading.
The contract standard goes further because it gives districts a legal framework for asking what happens when products change, when data needs to be deleted, when a breach occurs, when subprocessors are added, and when a new AI feature increases student privacy or safety risk.
For families, the useful question is not whether AI is present in school at all. It is whether the school can explain what tool is being used, what data it collects, whether student work can train models, whether memory can be turned off, whether a human reviews consequential decisions, and what happens if a vendor breaks the rules.
For schools, the standard turns those questions into contract language. That does not settle every debate over AI in education, but it gives districts something more concrete than trust: terms they can request, review, and enforce.
