{"resourceId":"epic-dc-council-tech-in-schools-ai-procurement-guardrails-testimony-20261022","versions":[{"version":"external-79c770cc812db4a9c29dd084ca0cb712191496bf6a32ea325905545ae0fd89b3","resource":{"id":"epic-dc-council-tech-in-schools-ai-procurement-guardrails-testimony-20261022","title":"EPIC testimony to D.C. Council urges school AI procurement guardrails: independent audits, risk assessments, data minimization and limits on surveillance mission creep","organization":"Electronic Privacy Information Center (EPIC), testimony to D.C. Council Committee of the Whole","sector":"K-12 edtech and school-safety AI: procurement standards and student privacy","geography":"District of Columbia, United States","publishedAt":"October 22, 2026 (dated written testimony)","publicationDate":"2026-10-22","eventDate":null,"sourceName":"Electronic Privacy Information Center","sourceLabel":"Nonprofit written public testimony (PDF)","sourceUrl":"https://epic.org/wp-content/uploads/2026/10/EPIC-Testimony-DC-Council-Hearing-on-Tech-In-Schools-Oct-2026.pdf","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["governance-procurement","data-security"],"finding":"EPIC's Oct. 22 testimony for the D.C. Council oversight hearing on technology in schools argues that weak procurement lets harmful or unproven AI into schools and asks the Committee to legislate procurement standards. It recommends benchmarks on safety, privacy, security and equity before vendors may sell to schools, plus standard contract clauses: data minimization and short deletion periods, purpose limitation, district data ownership, cybersecurity and breach compliance, independent risk and impact assessments, and independent audits of training data, stress testing and output accuracy. It cites mission creep in AI monitoring, noting Lightspeed (a DCPS vendor) can notify law enforcement of possible self-harm, and accuracy problems in facial recognition and weapons detection.","sledRelevance":"K-12 and newly relevant: it arrived days before tonight's district items (Long Beach, Sandy Valley) and translates privacy concern into specific contract clauses districts can adopt. It is distinct from the archived CDT D.C. testimony of Oct 9.","evidence":"Advocacy testimony with footnoted citations (FTC orders, AP investigation, court settlements); it presents no new primary data. Claims about specific vendors rely on cited secondary sources not opened here.","architectureImplications":"Calls for audits of training data, stress testing and ongoing accuracy testing, which require vendor transparency and test access districts rarely have.","governanceImplications":"Interpretation: the clause list is a ready template for district or state AI procurement policy; it shifts evaluation burden to vendors before purchase.","securityPrivacyImplications":"Emphasizes breach risk (PowerSchool, Illuminate), data monetization and AI monitoring alerts shared beyond schools, including with law enforcement.","caveats":"Advocacy document seeking legislation; not an evaluation. Dated Oct. 22, before the last run, and included because it is unarchived and directly relevant to current district procurement debates. Vendor-specific claims were not independently verified.","streamIds":["k12"],"roles":{"sales":"The framing point is that procurement terms, not product features, are where privacy advocates want AI controls. EPIC asks D.C. to require safety, privacy and equity benchmarks before vendors can sell, plus clauses for minimization, ownership, independent audits and risk assessments. A bounded offer is an AI procurement checklist and contract-clause review for a district. The testimony is advocacy without new data and cannot support claims that any specific vendor is unsafe or that clauses reduce harm.","engineering":"Fit is evaluation readiness. EPIC calls for independent audits of training data, stress testing and ongoing accuracy testing, which implies districts need test access, logs and documentation from vendors. Interpretation: pre-sales engineers should be ready to show data flows, retention, deletion and accuracy testing for any AI feature. Monitoring and safety tools that route alerts to law enforcement face the hardest scrutiny, so alert routing must be configurable and documented.","delivery":"Delivery work is building an AI procurement and oversight process. The district procurement office would own it with the privacy officer and legal counsel. Interpretation: acceptance criteria could include a standard AI contract addendum, a completed risk assessment for each AI tool and an annual accuracy review for high-risk systems. Risks include vendors refusing audit terms, slowed purchasing and assessments that become paperwork without real testing."},"roleDetails":{"sales":{"customerProblem":"Districts buy AI edtech and safety tools without standard benchmarks or contract terms for privacy, accuracy and oversight.","stakeholders":["D.C. Council Committee of the Whole","DCPS procurement and technology leaders","District privacy officers","Student privacy advocates","Edtech and safety vendors"],"discoveryQuestions":["Does the district have a standard AI contract addendum?","Which AI tools route alerts outside the school, and to whom?","Has any AI tool undergone an independent risk or accuracy assessment?","How quickly is student data deleted after contract end?"],"valueHypothesis":"Standard clauses and pre-purchase assessments could reduce privacy and accuracy risk; this is a hypothesis, not a measured result.","potentialEngagement":"An AI procurement checklist and contract-clause gap review against EPIC's recommended terms.","unsupportedClaims":["That specific named vendors are unlawful or unsafe","That procurement clauses measurably reduce harm","That D.C. will pass such legislation"]},"engineering":{"fit":"Vendor transparency and testability for AI features in edtech and school-safety systems.","architectureIntegration":"Interpretation: provide documented data flows, retention and deletion controls, alert routing and logs that allow third-party accuracy testing.","prerequisites":["System documentation","Test environment or audit access","Data inventory"],"constraints":["Vendor intellectual property limits on audit access","FERPA and D.C. privacy rules","Cost of independent audits"],"security":"Data minimization, short retention, breach notification compliance and controls on sharing alerts with third parties including law enforcement.","proofOfValue":["Complete a risk assessment template for one AI tool","Run an accuracy test on a sample of monitoring alerts","Verify deletion after a test contract termination"]},"delivery":{"work":"Stand up an AI procurement review with standard contract language and periodic audits.","dependencies":["Legal counsel","Procurement policy authority","Vendor cooperation"],"ownership":"District procurement office with privacy officer and legal counsel.","skillsAdoption":"Procurement and technology staff need training to evaluate AI risk assessments and audit reports.","governanceCheckpoints":["Pre-purchase risk assessment","Contract addendum signed","Annual accuracy and privacy review"],"acceptanceCriteria":["AI addendum used in all new AI contracts","Risk assessment on file for each AI tool","Annual review completed for high-risk systems"],"risks":["Vendor refusal of audit terms","Procurement delays","Checklist compliance without real testing"]}},"retrievedAt":"2026-10-27T22:06:27-05:00","enrichedAt":"2026-10-27T22:10:39-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Raises equity and civil-rights concerns: biased outputs and surveillance concentrated in schools serving poor and minority students.","procurementImplications":"Central: proposes pre-sale benchmarks and standardized clauses for all AI edtech contracts.","operatingModelImplications":"Requires ongoing oversight mechanisms, not one-time approval.","sourceVerification":{"openedUrl":"https://epic.org/wp-content/uploads/2026/10/EPIC-Testimony-DC-Council-Hearing-on-Tech-In-Schools-Oct-2026.pdf","referenceExcerpt":"Often, it is weak procurement processes that allow harmful and or unproven technology to enter schools.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}