Schools would require privacy safeguards in new AI contracts

A covered school must put required privacy and security safeguards in each contract for an AI service. This covers school districts, charter schools, and other listed public school bodies that contract with a company or nonprofit provider; individual contractors are excluded. Contracts must bar providers from collecting, storing, or selling personal data and from using it to train broad AI models. They must also protect data, bar student biometric collection unless required by law, require breach notice, and require deletion of covered data within 90 days after a contract ends or a school asks. If enacted, the proposal would take effect immediately. Its contract rules would apply to contracts entered into on or after that date.

AI vendors must report information about their school products to the Education Department. The report covers each vendor's contracted school customers and every AI program, platform, or other technology it provides. Vendors must provide contact information, describe each product and its type of AI, and confirm that each product meets the required contract safeguards. The department may require other information. The section would cover contracts entered into on or after enactment, but no reporting deadline is stated.

Schools must send the department a copy of a covered AI contract when asked, and the department must publish implementation guidelines. The contract-copy rule covers schools that contract with company or nonprofit AI providers. The guidance must include at least the contract safeguards in this section. The department must review the guidance each year and tell schools when it changes. The department would have 180 days after enactment to post the guidance; the contract-copy rule would cover contracts entered into on or after enactment.