It is recommended that the organization develop guiding principles to help staff approach the AI policy and decision-making process. AI can change the way humans work but should not replace humans when staff and students are involved.

It is also important to avoid a full ban on the use of AI. AI tools can help improve workflow, simplify tasks, and assist teachers. Leveraging AI and understanding that the technology is evolving makes the guiding principles important. Some AI tools are already widely used, such as spelling and grammar checking. This is traditional AI, which is rule-based and relies on programming code to make decisions. Generative AI uses the data entered to learn how to make better decisions. ChatGPT, for example. This means that data entered into ChatGPT, for example, could appear in the answers to those questions. This presents a privacy risk.

A newer category, agentic AI, goes further than generating content — these tools can take actions on their own, such as browsing the web, sending emails, or writing to files. Because agentic tools act rather than respond, guiding principles should address what actions a tool is permitted to take, whether those actions are logged, and whether they can be reviewed or reversed.

These updated resources were developed with the California Department of Education's guidance on AI in California public schools in mind. The CDE guidance calls for keeping educators and human judgment central to AI adoption, treating AI as a support to teaching rather than a substitute for it, and building procurement and governance practices around transparency, data privacy, and ongoing evaluation. The CITE checklist, companion guide, and quick-start guide for small districts help operationalize that guidance at the IT level — giving technology teams a practical way to vet vendors and tools while staying aligned with the state's broader framework.

Although this is not strictly an IT issue, IT leadership and staff should be part of this discussion. This will ensure that the principles align with IT standards and practices.

When new capabilities are released for applications already in use, the current contracts, including the Terms of Service, should be reviewed. Some items to consider include, but are not limited to, determining whether the intended users are students and whether use is limited to students above a certain age.

The contract should clearly state how LEA-provided data will be used, stored, and retained. It should also state whether the data is used for AI training or tuning. This verbiage should be in place regardless of whether or not the data is used for AI. If student data is entered, the contract should clearly state whether or not that data is used to train the AI models. Students may be entering sensitive personal information.

Contracts should also address vendor transparency around the underlying AI model. Some vendors dynamically route requests across multiple models for cost or performance reasons, which can make this harder to pin down. At a minimum, districts should ask whether the vendor will disclose which model(s) power the tool and notify the district when that changes.

The California Student Data Privacy Agreement includes an exhibit specifically addressing AI, available for download above. Contact privacyservices@cite.org with questions.

In California, since the enactment of Education Code 49073.6, schools have been tasked with ensuring that any applications used for instruction comply with student data privacy laws at both the federal and state levels. 

While many aspects of AI are already covered under existing law, it is important to remember to apply the guidelines for compliance with existing applications as they are updated to include AI capability.

Does the application align with the organization's instructional and overall goals? If guiding principles around AI are in place, how does the application compare? LEA leadership is responsible for evaluating any new applications or updates to existing applications to ensure compliance.

Use the AI Implementation Checklist to evaluate new applications systematically, and the Companion Guide for context on why each question matters and what a good vendor answer looks like. Smaller LEAs without dedicated technology teams may prefer the Quick-Start Guide, which distills the most critical questions into a condensed, plain-language format.

Safeguarding stakeholders' privacy is not new. This is an essential task whenever a new application is introduced or new features are added. The user should maintain control of how AI features are implemented. When implemented, user protection should be a priority.

To ensure the vendor is aware of state and federal laws regarding student data privacy, check whether they have signed a data privacy agreement. California has adopted a statewide data privacy agreement (CA-DPA) that is piggy-backable.

Has the vendor confirmed that any user-provided data (user prompts, supplied data, generated output, etc.) will remain the property of the LEA and that no LEA data will be retained past the timeline specified in the privacy agreement and/or terms of service (TOS)?

Does the vendor's privacy policy address FERPA, SOPIPA, COPPA, CCPA, and any AI-specific laws? The AI Implementation Checklist covers these questions in greater depth, including data retention, subprocessor agreements, and opt-out rights for AI model training.

AI doesn't work without user interaction. Generative AI works in the background, and the user won't know it. As it develops, it is important to continually train users to help them understand the importance of data safety and privacy. Teachers and students should be trained as end users not to input any sensitive or identifying data to minimize risk in the event of a leak. Training should also cover agentic AI tools specifically — staff and students should understand that some tools take actions rather than generate text, and that this carries different risks worth understanding before use. Remember to continue training as new staff and students enter the environment.