From the K–12 edition of September 15, 2026
Idaho GenAI education framework requires DPAs and multi-statute privacy vetting for school platforms
Idaho Department of Education · State education agency / K-12 · United States — Idaho public K-12 districts, schools, and charters
- Publisher
- Idaho State Department of Education
- Original publication
- 2026 (framework PDF path dated August 2026; tied to 2026 SB 1227)
- Source retrieved
- 2026-09-15
What happened
Following 2026 Senate Bill 1227, the Idaho Department of Education published a statewide Generative AI in Education Framework covering literacy, age appropriateness, appropriate/inappropriate uses, academic integrity, and platform purchasing. On purchasing, it instructs schools to vet vendors on data use, whether data are used for model training, retention/access/deletion, safety controls, and compliance with COPPA, FERPA, PPRA, CIPA, IDEA, Title VI, state student privacy laws, and state AI legislation, and states that after selection a district, school, or charter should always require a Data Privacy Agreement covering ownership, use limits, data types, compliance, security, and retention/deletion. The Department commits to at least annual review.
Why it matters
Actionable SEA template for U.S. district AI procurement and staff/student use policy. Newly relevant as states translate 2026 AI legislation into operable K-12 purchasing controls beyond generic ethics statements.
Evidence and measured results
Official state education agency framework PDF with platform-purchasing checklist and DPA component list; legislative anchor SB 1227; includes draft policy annex materials.
Limitations and uncertainty
Guidance and draft policy language, not an audit of district compliance or measured learning outcomes. Idaho statute context; other states may differ. Annual revision means controls may change.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-15; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Schools adopt GenAI tools without DPAs or clear answers on training use, retention, and multi-statute student-privacy compliance.
- Stakeholders
- Superintendent / board
- CIO / IT security
- Privacy counsel
- Curriculum leadership
- Discovery questions
- Which AI tools currently process student or staff data without a DPA?
- Do vendor contracts prohibit model training on district data?
- Who owns annual re-vetting as state AI guidance updates?
- Value hypothesis
- Adopting an Idaho-style purchasing and DPA gate reduces privacy and compliance exposure before instructional AI scale-up—without claiming learning gains from the policy itself.
- Potential engagement
- Two-to-four-week AI tool inventory, vendor questionnaire, and DPA remediation sprint aligned to the framework’s purchasing section.
- Unsupported claims
- Framework adoption improves student achievement
- Any enterprise AI tool is automatically FERPA/COPPA compliant
- One-time DPA signing removes need for annual review
Pre-sales engineering
Role takeaway
- Fit
- Enterprise-approved GenAI services with contractual privacy controls suitable for K-12 tenants.
- Architecture and integration
- Approved-app catalog, SSO enforcement, network controls against consumer AI endpoints, and evidence stores for DPAs and vendor attestations.
- Prerequisites
- Authority to require DPAs
- Inventory of current AI use
- Privacy/security review capacity
- Constraints
- Idaho-specific legislative context
- Guidance not a compliance certification
- Rapid vendor model changes require re-checks
- Security
- Verify encryption, access control, breach processes, training prohibitions, and deletion on exit as part of DPA diligence.
- Proof of value
- 100% of in-scope AI tools have signed DPAs
- Vendor answers on training/retention documented
- Shadow-AI discovery findings trending down after controls
Delivery
Role takeaway
- Work
- Inventory tools, apply purchasing checklist, remediate contracts, publish approved-use guidance, and schedule annual framework-aligned review.
- Dependencies
- Legal counsel time
- Vendor responsiveness
- Staff communications channels
- Ownership
- Privacy officer / CIO with curriculum co-sponsor for instructional use rules.
- Skills and adoption
- Staff need training to stop pasting PII into unapproved consumer tools and to use approved enterprise alternatives.
- Governance checkpoints
- Board or superintendent endorsement of purchasing gates
- DPA completion gate before production student data use
- Annual framework revision sync
- Acceptance criteria
- Published approved/prohibited AI use list
- Signed DPAs for tools handling student data
- Documented answers to training-data and deletion questions
- Risks
- Shadow AI persists on personal devices
- Vendors refuse training prohibitions
- Policy shelfware without enforcement
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
District architectures should prefer enterprise tools that can contractually prohibit training on district data, document subprocessors, and support deletion certificates—consumer AI endpoints are misaligned with the framework’s vetting bar.
Governance
Who approves, reviews and stays accountable for outcomes?
Boards and superintendents can adopt or adapt the framework’s purchasing questions and DPA requirements as mandatory gates before AI tools process student or staff data.
Security and privacy
What data, permissions and controls need testing?
Elevates FERPA/COPPA/PPRA/CIPA/IDEA and state AI/privacy statutes as explicit vendor compliance questions and makes DPAs non-optional after tool selection.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Framework emphasizes age-appropriate use and educator AI literacy training; implementation workload falls on teachers and tech leads who need time for vetting and annual re-training.
Procurement
What should contracts, pricing and exit terms secure?
Make DPA execution and answers to training-data, retention, and multi-statute compliance questions mandatory award conditions for GenAI platforms.
Operating model
Which teams own the service once it runs?
Establish a standing AI purchasing review board (curriculum, privacy, cybersecurity) that re-checks vendors at least annually as the framework itself is updated.
Publication history
- 2026-09-15K–12 · Issue 104 resources
Stable resource ID: idaho-genai-k12-framework-2026