{"resourceId":"idaho-genai-k12-framework-2026","versions":[{"version":"external-f7c07cd1072741493061eb522eec5890314394fcdd6303d64c4b32d2cfa9d0c9","resource":{"id":"idaho-genai-k12-framework-2026","title":"Idaho GenAI education framework requires DPAs and multi-statute privacy vetting for school platforms","organization":"Idaho Department of Education","sector":"State education agency / K-12","geography":"United States — Idaho public K-12 districts, schools, and charters","publishedAt":"2026 (framework PDF path dated August 2026; tied to 2026 SB 1227)","publicationDate":"2026-08-01","eventDate":null,"sourceName":"Idaho State Department of Education","sourceLabel":"Generative Artificial Intelligence in Education Framework","sourceUrl":"https://www.sde.idaho.gov/wp-content/uploads/2026/08/Generative-Artificial-Intelligence-in-Education-Framework.pdf","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["governance-procurement","data-security","accessibility-workforce"],"finding":"Following 2026 Senate Bill 1227, the Idaho Department of Education published a statewide Generative AI in Education Framework covering literacy, age appropriateness, appropriate/inappropriate uses, academic integrity, and platform purchasing. On purchasing, it instructs schools to vet vendors on data use, whether data are used for model training, retention/access/deletion, safety controls, and compliance with COPPA, FERPA, PPRA, CIPA, IDEA, Title VI, state student privacy laws, and state AI legislation, and states that after selection a district, school, or charter should always require a Data Privacy Agreement covering ownership, use limits, data types, compliance, security, and retention/deletion. The Department commits to at least annual review.","sledRelevance":"Actionable SEA template for U.S. district AI procurement and staff/student use policy. Newly relevant as states translate 2026 AI legislation into operable K-12 purchasing controls beyond generic ethics statements.","evidence":"Official state education agency framework PDF with platform-purchasing checklist and DPA component list; legislative anchor SB 1227; includes draft policy annex materials.","architectureImplications":"District architectures should prefer enterprise tools that can contractually prohibit training on district data, document subprocessors, and support deletion certificates—consumer AI endpoints are misaligned with the framework’s vetting bar.","governanceImplications":"Boards and superintendents can adopt or adapt the framework’s purchasing questions and DPA requirements as mandatory gates before AI tools process student or staff data.","securityPrivacyImplications":"Elevates FERPA/COPPA/PPRA/CIPA/IDEA and state AI/privacy statutes as explicit vendor compliance questions and makes DPAs non-optional after tool selection.","caveats":"Guidance and draft policy language, not an audit of district compliance or measured learning outcomes. Idaho statute context; other states may differ. Annual revision means controls may change.","streamIds":["k12"],"roles":{"sales":"Lead with procurement readiness: map the district’s AI shortlist against Idaho-style DPA and multi-statute questions before demos. This source supports a bounded policy-and-procurement engagement—inventory, vetting checklist, and DPA gap closure—not a claim that the framework itself improves learning. Bring privacy counsel and IT security into first calls; do not sell consumer AI for student data use cases that fail the training-data and deletion tests.","engineering":"Fit is governance and integration control planes: approved-tool catalogs, IdP-restricted enterprise endpoints, and contractually enforced no-training / deletion clauses. Architecture should route school AI traffic to vetted tenants with logging for shadow-AI discovery. Proof of value is a completed vendor questionnaire plus signed DPA covering ownership, use limits, retention, and security—not model quality benchmarks alone.","delivery":"Delivery work inventories current AI tools, runs the purchasing checklist, closes DPA gaps, and trains staff on approved versus prohibited uses. Ownership sits with the CIO/privacy officer alongside curriculum. Acceptance includes signed DPAs for tools touching student data and an annual re-review calendar; risks include shadow AI continuing on consumer accounts despite policy."},"roleDetails":{"sales":{"customerProblem":"Schools adopt GenAI tools without DPAs or clear answers on training use, retention, and multi-statute student-privacy compliance.","stakeholders":["Superintendent / board","CIO / IT security","Privacy counsel","Curriculum leadership"],"discoveryQuestions":["Which AI tools currently process student or staff data without a DPA?","Do vendor contracts prohibit model training on district data?","Who owns annual re-vetting as state AI guidance updates?"],"valueHypothesis":"Adopting an Idaho-style purchasing and DPA gate reduces privacy and compliance exposure before instructional AI scale-up—without claiming learning gains from the policy itself.","potentialEngagement":"Two-to-four-week AI tool inventory, vendor questionnaire, and DPA remediation sprint aligned to the framework’s purchasing section.","unsupportedClaims":["Framework adoption improves student achievement","Any enterprise AI tool is automatically FERPA/COPPA compliant","One-time DPA signing removes need for annual review"]},"engineering":{"fit":"Enterprise-approved GenAI services with contractual privacy controls suitable for K-12 tenants.","architectureIntegration":"Approved-app catalog, SSO enforcement, network controls against consumer AI endpoints, and evidence stores for DPAs and vendor attestations.","prerequisites":["Authority to require DPAs","Inventory of current AI use","Privacy/security review capacity"],"constraints":["Idaho-specific legislative context","Guidance not a compliance certification","Rapid vendor model changes require re-checks"],"security":"Verify encryption, access control, breach processes, training prohibitions, and deletion on exit as part of DPA diligence.","proofOfValue":["100% of in-scope AI tools have signed DPAs","Vendor answers on training/retention documented","Shadow-AI discovery findings trending down after controls"]},"delivery":{"work":"Inventory tools, apply purchasing checklist, remediate contracts, publish approved-use guidance, and schedule annual framework-aligned review.","dependencies":["Legal counsel time","Vendor responsiveness","Staff communications channels"],"ownership":"Privacy officer / CIO with curriculum co-sponsor for instructional use rules.","skillsAdoption":"Staff need training to stop pasting PII into unapproved consumer tools and to use approved enterprise alternatives.","governanceCheckpoints":["Board or superintendent endorsement of purchasing gates","DPA completion gate before production student data use","Annual framework revision sync"],"acceptanceCriteria":["Published approved/prohibited AI use list","Signed DPAs for tools handling student data","Documented answers to training-data and deletion questions"],"risks":["Shadow AI persists on personal devices","Vendors refuse training prohibitions","Policy shelfware without enforcement"]}},"retrievedAt":"2026-09-15T18:49:10.771Z","enrichedAt":"2026-09-15T18:49:10.771Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Framework emphasizes age-appropriate use and educator AI literacy training; implementation workload falls on teachers and tech leads who need time for vetting and annual re-training.","procurementImplications":"Make DPA execution and answers to training-data, retention, and multi-statute compliance questions mandatory award conditions for GenAI platforms.","operatingModelImplications":"Establish a standing AI purchasing review board (curriculum, privacy, cybersecurity) that re-checks vendors at least annually as the framework itself is updated.","sourceVerification":{"openedUrl":"https://www.sde.idaho.gov/wp-content/uploads/2026/08/Generative-Artificial-Intelligence-in-Education-Framework.pdf","referenceExcerpt":"After a tool is selected, a district, school or charter should always require a Data Privacy","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}