In the last two years, a Pennsylvania school head lost their job, a Maryland district paid a confidential settlement, and LA Unified spent $3M on an AI tool that infringed on student privacy because of gaps in AI governance.
AI is moving through schools faster than most districts can write rules for it. About three in ten teachers now use AI tools in their work, while a similar share of districts have issued no formal guidance on generative AI at all. That gap, the space between what is happening in classrooms and what the board has actually decided, is where risk lives.
Educators have adopted AI tools. Does your AI governance protect your district from liability?
Some states now require educational institutions to adopt a formal AI policy, and many other states have issued informal guidance.
AI Policy is not AI Governance
Most districts have a policy. Far fewer have governance. AI governance refers to a system of policies and standard practices that help educators manage how AI is used, managed, and discussed. The goal of AI governance is to ensure educators understand the implications of AI and are also prepared to equip students with the tools they will need when entering a workforce where employers expect familiarity with AI.
Three principles separate the two:
- Governance requires accountability. Someone owns each decision, and there is a named path for when a tool is misused or behaves unexpectedly.
- Staying current is part of the practice. State rules, federal guidance, and insurer terms are changing quickly. Tracking them is not overhead; it is what keeps your practice defensible.
- Missing documentation is the expensive part. When something goes wrong, the absence of a documented framework, not the incident itself, becomes the most expensive line item.
Insurance Companies Are Taking Notice
Insurance companies are also closely monitoring the rollout of AI in business and schools, and some are issuing exclusions. Insurance companies are beginning to define AI as a machine learning system or a model trained on human data that can produce content. These exclusions are meant to eliminate coverage for harm caused by generative AI.
For example, W.R. Berkley’s Absolute AI Exclusion policy excludes not only content generated by AI but also calls out “inadequate AI governance” by name. ISO and Verisk filed generative-AI exclusion endorsements for general liability that took effect in January 2026, and major carriers have followed, with the large majority of these filings approved by early 2026.
A staff-driven AI mistake, a bias when automating a lesson plan, an AI-assisted discipline decision, a deepfake handled badly, do not land on your cyber policy. It lands on D&O or E&O, and those are exactly the policies the new exclusions touch. A documented AI governance framework is the one level of protection for educators and students from these worst-case scenarios.
What Has Gone Wrong
Four recent cases show how fast an ungoverned AI decision becomes a headline, a lawsuit, or a resignation.
Student Harm
In some of the most traumatizing cases to date, two 14-year-old boys at a private school in Lancaster, PA used publicly available photos, including yearbook pictures, Instagram posts, and FaceTime screenshots, to create explicit images of students using AI. These “deepfakes”
The fallout went well beyond the two students. Parents and students protested what they saw as a slow, inadequate district response. The school's Head of School and Board President both left their positions. Families have since filed a civil suit alleging the school knew about the images and failed to act. They also named the AI companies they say were negligent in preventing this kind of material from being generated in the first place.
This case serves as a reminder to districts that they need to respond rapidly to cases of student harm involving AI. When allegations surface, a district without a clear, pre-established protocol for investigating and reporting AI-enabled harm could be named as a party in the lawsuit.
Vendor & Procurement Risk
In March 2024, the Los Angeles Unified School District (LAUSD) introduced the ED platform and chatbot. This AI tool was intended to be a one-stop solution for school-related information with an eye towards improved efficiency. Though the goal of this program was to improve the educational experience, three months later, the parent company, AllHere, was under fire for data breaches.
AllHere had laid off a number of employees and was unable to properly monitor the chatbot. So the district pulled that feature of Ed. Though they responded in time to prevent further issues, the LAUSD had already sunk over three million dollars into an AI program that was no longer fully viable.
This incident resulted in calls from parents to abandon AI efforts in the classroom altogether. Claiming that the school district needs smaller class sizes and more qualified teachers, not AI.
As your district tackles the incorporation of AI tools into school life, consider the vetting of vendors and the rollout of AI features with intention.
Data Privacy
In Lawrence, KS, nine current and former students filed a federal lawsuit against their school district, claiming that the district's use of the monitoring tool, Gaggle, violated their Fourth Amendment rights. Gaggle scanned students' school Google accounts and flagged content it deemed a safety risk. However, the suit alleges it also seized student journalism drafts, intercepted mental-health disclosures to trusted teachers, and flagged artwork as explicit content.
The school district dropped the use of Gaggle and switched to a similar monitoring tool. The district then attempted to procure a partial dismissal of the charges, claiming it no longer used the software in question. However, a judge ruled that swapping vendors did not eliminate liability.
The takeaway for districts: a privacy or Fourth Amendment problem isn't tied to one product name. Districts require governance around what's monitored, how broadly, and with what oversight.
The Legal Landscape is Shifting to Catch Up with AI
Compliance with AI policy may soon be mandatory. Ohio now requires every public, community, and STEM school to adopt a formal AI policy by summer 2026. Tennessee required districts to adopt similar AI use policies in 2024. Other states, including Maryland and Oklahoma, have bills advancing that would require state guidance, local policies, and even designated AI coordinators.
Texas now requires school district cybersecurity coordinators to complete certified AI Awareness Training annually. This signals the direction that many states can be expected to take regarding AI competency training.
Beyond the mandates, roughly 35 states have issued non-binding guidance, and well over 100 AI-in-education bills were introduced in the 2026 legislative session.
Together, these threads point to the same conclusion. You can expect requirements for documented policy, staff training, and human oversight protocols.
Manage AI Risk
As more states require meaningful AI policy, roughly 60% of educators say they have received no guidance regarding AI. Many districts are open to risks. It is time to take AI governance seriously.
Much of the fear around AI in schools comes from ambiguity. When districts are clear about how AI is used, it opens up a conversation about appropriate use instead of speculation. A published AI tool inventory, visible to families and staff, does more to build trust than any policy document sitting in a drawer.
Sound AI risk management starts with the basics.
- Vet your vendors. Before approving a tool, ask what it can access, where the data goes, what third parties touch it, and who owns the content it produces. The LA Unified and Kansas cases both trace back to a tool that was bought before it was vetted.
- Protect sensitive information. Know what your AI-enabled systems can reach, where student data goes, and how intellectual property and third-party access are handled.
- Require human oversight. A person, not a model, makes the consequential call. Authentication of suspicious media, integrity decisions, and discipline all stay human.
- Be transparent. Many objections to AI come from not knowing, not from the tool itself.
Human oversight ties all of this together. Wherever AI touches a decision about a student, a human needs to be the one making it.
5 Levels of Mitigating Risk with AI Governance
Managing all of this piecemeal is how districts end up with a binder no one follows. Check out this 5-Layer Framework that organizes AI governance around instructional integrity rather than compliance alone.
1.Strategic Clarity
This is the why. Why is your district using AI at all, stated clearly enough to guide every downstream decision.
2. Risk & Compliance
Explicit rules for protecting student data, meeting legal requirements, and defining acceptable use.
3. Instructional Integration
How AI can support instruction without displacing the thinking, writing, and problem-solving skills necessary for learning.
4. Operational Implementation
This is where policy becomes practice. Professional development and community outreach need to be in place to ensure the policy is actually implemented.
5. Infrastructure & Future-Readiness
The systems and capacity underneath it are all, built to adapt as the tools change.
Prevention is the best way to mitigate risk. Evolving AI governance and risk planning are the best ways to future-proof your district.
FAQ
What is AI governance?
It is the system a district uses to decide how AI is adopted, who is accountable for it, and how the district responds when something goes wrong. It is broader than an AI policy document; it is the practice that makes the policy real.
Why is AI Governance Important?
Because AI is already in classrooms, whether or not a district has decided how to handle it, and the cost of an ungoverned misstep, legal, financial, and reputational, now exceeds the cost of getting ahead of it.
How Does AI Governance Work?
AI Governance starts with strategic clarity about why you are using AI, then layers risk management, instructional integrity, day-to-day implementation, and infrastructure on top, with clear owners at each level.
Where to start
You do not need every answer today. You need to know where your district actually stands. Our free 10-minute AI readiness self-assessment maps your district across the five governance layers and returns a 2-page report showing your biggest gaps and the first move to close them.
Establish your AI governance. Start with the self-assessment, then decide whether a Readiness Scan is your next step.