From the K–12 edition of October 27, 2026
EPIC testimony to D.C. Council urges school AI procurement guardrails: independent audits, risk assessments, data minimization and limits on surveillance mission creep
Electronic Privacy Information Center (EPIC), testimony to D.C. Council Committee of the Whole · K-12 edtech and school-safety AI: procurement standards and student privacy · District of Columbia, United States
- Publisher
- Electronic Privacy Information Center
- Original publication
- October 22, 2026 (dated written testimony)
- Source retrieved
- 2026-10-28
What happened
EPIC's Oct. 22 testimony for the D.C. Council oversight hearing on technology in schools argues that weak procurement lets harmful or unproven AI into schools and asks the Committee to legislate procurement standards. It recommends benchmarks on safety, privacy, security and equity before vendors may sell to schools, plus standard contract clauses: data minimization and short deletion periods, purpose limitation, district data ownership, cybersecurity and breach compliance, independent risk and impact assessments, and independent audits of training data, stress testing and output accuracy. It cites mission creep in AI monitoring, noting Lightspeed (a DCPS vendor) can notify law enforcement of possible self-harm, and accuracy problems in facial recognition and weapons detection.
Why it matters
K-12 and newly relevant: it arrived days before tonight's district items (Long Beach, Sandy Valley) and translates privacy concern into specific contract clauses districts can adopt. It is distinct from the archived CDT D.C. testimony of Oct 9.
Evidence and measured results
Advocacy testimony with footnoted citations (FTC orders, AP investigation, court settlements); it presents no new primary data. Claims about specific vendors rely on cited secondary sources not opened here.
Limitations and uncertainty
Advocacy document seeking legislation; not an evaluation. Dated Oct. 22, before the last run, and included because it is unarchived and directly relevant to current district procurement debates. Vendor-specific claims were not independently verified.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-27; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Districts buy AI edtech and safety tools without standard benchmarks or contract terms for privacy, accuracy and oversight.
- Stakeholders
- D.C. Council Committee of the Whole
- DCPS procurement and technology leaders
- District privacy officers
- Student privacy advocates
- Edtech and safety vendors
- Discovery questions
- Does the district have a standard AI contract addendum?
- Which AI tools route alerts outside the school, and to whom?
- Has any AI tool undergone an independent risk or accuracy assessment?
- How quickly is student data deleted after contract end?
- Value hypothesis
- Standard clauses and pre-purchase assessments could reduce privacy and accuracy risk; this is a hypothesis, not a measured result.
- Potential engagement
- An AI procurement checklist and contract-clause gap review against EPIC's recommended terms.
- Unsupported claims
- That specific named vendors are unlawful or unsafe
- That procurement clauses measurably reduce harm
- That D.C. will pass such legislation
Pre-sales engineering
Role takeaway
- Fit
- Vendor transparency and testability for AI features in edtech and school-safety systems.
- Architecture and integration
- Interpretation: provide documented data flows, retention and deletion controls, alert routing and logs that allow third-party accuracy testing.
- Prerequisites
- System documentation
- Test environment or audit access
- Data inventory
- Constraints
- Vendor intellectual property limits on audit access
- FERPA and D.C. privacy rules
- Cost of independent audits
- Security
- Data minimization, short retention, breach notification compliance and controls on sharing alerts with third parties including law enforcement.
- Proof of value
- Complete a risk assessment template for one AI tool
- Run an accuracy test on a sample of monitoring alerts
- Verify deletion after a test contract termination
Delivery
Role takeaway
- Work
- Stand up an AI procurement review with standard contract language and periodic audits.
- Dependencies
- Legal counsel
- Procurement policy authority
- Vendor cooperation
- Ownership
- District procurement office with privacy officer and legal counsel.
- Skills and adoption
- Procurement and technology staff need training to evaluate AI risk assessments and audit reports.
- Governance checkpoints
- Pre-purchase risk assessment
- Contract addendum signed
- Annual accuracy and privacy review
- Acceptance criteria
- AI addendum used in all new AI contracts
- Risk assessment on file for each AI tool
- Annual review completed for high-risk systems
- Risks
- Vendor refusal of audit terms
- Procurement delays
- Checklist compliance without real testing
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Calls for audits of training data, stress testing and ongoing accuracy testing, which require vendor transparency and test access districts rarely have.
Governance
Who approves, reviews and stays accountable for outcomes?
The clause list is a ready template for district or state AI procurement policy; it shifts evaluation burden to vendors before purchase.
Security and privacy
What data, permissions and controls need testing?
Emphasizes breach risk (PowerSchool, Illuminate), data monetization and AI monitoring alerts shared beyond schools, including with law enforcement.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Raises equity and civil-rights concerns: biased outputs and surveillance concentrated in schools serving poor and minority students.
Procurement
What should contracts, pricing and exit terms secure?
Central: proposes pre-sale benchmarks and standardized clauses for all AI edtech contracts.
Operating model
Which teams own the service once it runs?
Requires ongoing oversight mechanisms, not one-time approval.
Publication history
- 2026-10-27K–12 · Issue 515 resources
Stable resource ID: epic-dc-council-tech-in-schools-ai-procurement-guardrails-testimony-20261022