From the K–12 edition of October 16, 2026
CDT testimony to D.C. Council: school AI use tied to more breaches, deepfakes and monitoring harms; calls for AI inventories, vendor transparency and procurement resources
Center for Democracy & Technology (CDT) · K-12 student privacy, civil rights and AI governance · Washington, D.C. (testimony) drawing on U.S. nationally representative polling
- Publisher
- Center for Democracy & Technology
- Original publication
- October 9, 2026 (testimony to D.C. Council Committee of the Whole)
- Source retrieved
- 2026-10-17
- Event date
- 2026-10-09
What happened
CDT's Maddy Dwyer told the D.C. Council on October 9 that 85% of teachers and 86% of students used AI in 2024–25 and that teachers report more large-scale data breaches the more ways their school uses AI (23% of teachers reported a large-scale breach). Thirteen percent of teachers said an AI tool failed to work as described (23% where AI is used more often). Students reported deepfakes involving their school community (36%; 61% in frequent-AI schools), and fewer than a quarter of teachers report clear deepfake response policies. Nine in ten teachers say their schools use student activity monitoring; 25% of those know a student contacted by law enforcement because of it. Fifty-seven percent of special education teachers used AI for IEPs or 504 plans. CDT urges high-risk AI identification, AI literacy, model policies, community engagement, research, model procurement resources, documented response processes for safety alerts, vendor transparency, AI inventories and notice to families. Why now: not previously archived; it packages CDT polling into concrete local-government asks as D.C. and other jurisdictions set AI policy.
Why it matters
Gives K-12 leaders a risk inventory and a policy checklist (inventories, transparency, procurement resources, alert response processes) directly usable in district and SEA governance.
Evidence and measured results
Testimony citing CDT's nationally representative polling about the 2024–25 school year (published October 2025) and earlier CDT research. Associations between AI use intensity and harms are correlational. No new data collection in the testimony itself.
Limitations and uncertainty
Advocacy testimony; underlying survey is about 2024–25 and correlational. Figures come from CDT's own research. D.C.-specific recommendations may not transfer directly to other jurisdictions.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-16; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Districts expand AI and monitoring tools without inventories, vendor transparency, high-risk definitions or response procedures, while breaches, deepfakes and community backlash grow.
- Stakeholders
- Privacy officer
- Technology director / CISO
- Student services and counseling
- Special education director
- Board and parent advisory groups
- Discovery questions
- Do you maintain a public inventory of AI tools, including student-facing ones?
- How are monitoring-software alerts reviewed before discipline or police contact?
- Do you have a deepfake NCII response policy?
- How do special education staff use AI for IEPs, and under what privacy controls?
- Value hypothesis
- An inventory, high-risk classification and response procedures could reduce privacy and civil-rights exposure; the source shows associations, not causal reductions.
- Potential engagement
- An 8–10 week AI risk and transparency program: inventory, high-risk use classification, vendor transparency review, alert and NCII response procedures, and family notice templates.
- Unsupported claims
- CDT data do not prove AI causes breaches.
- No evidence that inventories alone reduce harm.
- Testimony does not evaluate specific products.
Pre-sales engineering
Role takeaway
- Fit
- Fits districts using AI-powered monitoring, AI-drafted special education documents or broad student AI tools.
- Architecture and integration
- Central AI registry with vendor transparency fields; alert routing from monitoring tools into a documented review queue; access controls on AI use with IEP data.
- Prerequisites
- List of AI and monitoring tools
- Vendor documentation on testing and data use
- Defined alert reviewers
- Constraints
- Correlational evidence
- Vendor transparency is often limited
- Jurisdiction-specific law (FERPA, IDEA, state privacy)
- Security
- Require vendor disclosures on data use and security testing; restrict AI processing of IEP and disability data; log alert handling.
- Proof of value
- Registry covers all AI and monitoring tools with transparency fields
- Test alerts follow the documented review path
- IEP-related AI use runs only in approved, logged tools
Delivery
Role takeaway
- Work
- Build the AI inventory, classify high-risk uses, adopt alert and deepfake NCII procedures, and set up family notice for new tools.
- Dependencies
- Vendor cooperation on transparency
- Student services staffing
- Legal review
- Ownership
- Privacy officer with technology director and student services leadership.
- Skills and adoption
- Train teachers and counselors on responding to concerning student AI interactions and deepfake incidents; only one in ten teachers report such training today per CDT.
- Governance checkpoints
- High-risk use list approved
- Alert review procedure adopted
- Public inventory published
- Annual review with community input
- Acceptance criteria
- Proposed: inventory published and updated annually
- Proposed: 100% of monitoring alerts follow documented review
- Proposed: staff trained on NCII response
- Risks
- Monitoring harms to protected students
- Privacy violations in AI-drafted IEPs
- Backlash from lack of family engagement
- Vendor non-disclosure
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Calls for AI tool inventories, documented response workflows for AI safety alerts (monitoring, facial recognition), and transparency from vendors on testing and data use. Interpretation: districts need a registry and alert-handling workflow integrated with counseling rather than discipline by default.
Governance
Who approves, reviews and stays accountable for outcomes?
Recommends defining high-risk AI uses with heightened protections, model AI and deepfake NCII policies, formal parent and community engagement, ongoing research, and notice and disclosure when adopting new tools.
Security and privacy
What data, permissions and controls need testing?
Links greater AI use to more reported breaches, cites the Canvas breach exposing data of over 275 million users, and flags FERPA and IDEA concerns for AI-drafted IEPs. Recommends vendor transparency and inventories.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Students with disabilities are acutely affected (AI-drafted IEPs, higher self-censorship under monitoring); fewer than half of teachers and students report AI training, and urban/higher-income communities report more AI use.
Procurement
What should contracts, pricing and exit terms secure?
Calls for model procurement resources, vendor transparency requirements and inventories so purchasing decisions rest on disclosed testing and data practices.
Operating model
Which teams own the service once it runs?
Shifts AI oversight toward a standing transparency regime: inventory, high-risk tiering, alert workflows, family notice and community engagement.
Publication history
- 2026-10-16K–12 · Issue 405 resources
Stable resource ID: cdt-dc-council-tech-in-schools-testimony-20261009