Compliance decisions
FERPA’s school-official exception for AI
An AI vendor is not a FERPA school official simply because a school buys its product. The exception requires the relevant institutional function, direct control over record use and maintenance, and applicable use and redisclosure restrictions. Check the school’s notice criteria and limit access to legitimate educational interests.
For School and district privacy officers, education IT and procurement
An education plan or school email address does not establish the exception.
Synthetic district, vendor and terms. No real FERPA exception, contract or institutional approval is determined.01
Identify the records and disclosure
FERPA applies to covered educational agencies and institutions and protects education records under its definitions. Start with the actual record, the student and the proposed recipient. A student-support document or copied excerpt may remain an education record even when it is removed from the main student system.
This guide examines the school-official exception to consent for disclosure. It does not assume that every educational AI task requires that exception or that no other lawful route could apply. Identify the relevant authority first, including any additional state or contractual requirements.
Source context: US Department of Education: FERPA regulations
02
Connect the vendor to an institutional function
Under 34 CFR 99.31(a)(1), a contractor, consultant, volunteer or other outside party may be treated as a school official where the specified conditions are met. One condition is performing an institutional service or function for which the agency or institution would otherwise use employees.
Write the function narrowly: for example, processing a defined administrative record for the school. “AI innovation” or a vendor’s broad product category is not a useful description. Separate that institutional purpose from an independent use of the information by the vendor or another recipient.
Source context: US Department of Education: FERPA regulations
03
Establish direct control and use restrictions
The outside party must be under the agency’s or institution’s direct control with respect to the use and maintenance of education records and subject to the relevant 99.33(a) use and redisclosure requirements. Review the terms and actual operation together: who can use the data, for what purpose and with what onward access?
A contract can document these controls, but an attractive privacy statement alone does not demonstrate the complete arrangement. Review data reuse, service changes, access, retention and the ability to enforce the intended limits. Do not treat an unrestricted right to use student records independently as consistent with a narrowly documented school purpose without further review.
Source context: US Department of Education: FERPA regulations
04
Limit access to legitimate educational interests
The institution must use reasonable methods to ensure school officials access only education records in which they have legitimate educational interests. Its annual FERPA notice must specify the criteria for determining who constitutes a school official and what constitutes such an interest when relying on the exception.
Map the actual feature and users to those criteria. A school-wide licence does not mean every employee or connected service needs every student record. Check whether the input path, file permissions and administrative procedures enforce the defined scope rather than relying solely on a staff member’s school email address.
Source context: US Department of Education: FERPA regulations
05
Record the exception analysis before the input
The fictional worksheet describes a proposed AI provider that has not established direct control and permitted reuse. It reaches an evidence-based stop for that example, not a declaration that all AI vendors fail FERPA. The missing condition must be resolved or another applicable disclosure route identified.
Keep the final institutional decision, permitted task and service boundary with the staff instruction. Reassess changes to the vendor’s terms, model-data use, features or recipients. A technical sensitive-input control can support a policy but cannot designate a vendor as a school official.
Source context: US Department of Education: FERPA regulations
Put it into practice
School-official exception review
An invented district considers a vendor for administrative drafting with student-record excerpts. Its proposed terms leave several required conditions unestablished.
Synthetic district, vendor and terms. No real FERPA exception, contract or institutional approval is determined.
Function
A defined institutional task
Control
Use and maintenance under school control
Restrictions
Permitted use and onward disclosure
Access
Legitimate interest and notice criteria
| Condition | Fictional evidence | Outcome or next step |
|---|---|---|
| Institutional service or function | The school describes a limited administrative drafting task normally handled by employees. | Record that exact task; do not extend the scope to unrelated vendor uses. |
| Direct control | The proposal gives the vendor broad reuse discretion and no demonstrated school control over record maintenance. | Condition is not established in this case; resolve the arrangement before disclosure. |
| Use and redisclosure | Onward access by a connected service is not explained. | Identify recipient and purpose restrictions under the applicable rules. |
| Annual notice criteria | The district’s actual notice criteria have not been compared in the example. | Check school-official and legitimate-interest criteria with the institutional owner. |
| Access limitation | Only the assigned team needs the specific administrative record. | Define users, records and feature permissions; a whole-school licence is insufficient evidence. |
| Illustrative decision | Required direct-control and onward-use facts remain unresolved. | Do not send student records on this route based on the school-official exception yet. |
Work through your review
Use the checks to organise the evidence you need. Your selections stay in this tab.
0 of 3 reviewed
Example files for this task
Keep the source material and the instructions together. You can also download the complete worksheet or matrix as CSV.
ferpa-ai-school-official-review.mdInspect
# School-official exception review
Synthetic district, vendor and terms. No real FERPA exception, contract or institutional approval is determined.
An invented district considers a vendor for administrative drafting with student-record excerpts. Its proposed terms leave several required conditions unestablished.
| Condition | Fictional evidence | Outcome or next step |
| --- | --- | --- |
| Institutional service or function | The school describes a limited administrative drafting task normally handled by employees. | Record that exact task; do not extend the scope to unrelated vendor uses. |
| Direct control | The proposal gives the vendor broad reuse discretion and no demonstrated school control over record maintenance. | Condition is not established in this case; resolve the arrangement before disclosure. |
| Use and redisclosure | Onward access by a connected service is not explained. | Identify recipient and purpose restrictions under the applicable rules. |
| Annual notice criteria | The district’s actual notice criteria have not been compared in the example. | Check school-official and legitimate-interest criteria with the institutional owner. |
| Access limitation | Only the assigned team needs the specific administrative record. | Define users, records and feature permissions; a whole-school licence is insufficient evidence. |
| Illustrative decision | Required direct-control and onward-use facts remain unresolved. | Do not send student records on this route based on the school-official exception yet. |
## Review steps
- Name the institutional task: Explain which service the school would otherwise use employees to perform.
- Review enforceable control: Document actual terms and procedures for use, maintenance and onward disclosure.
- Match interest and access: Apply the annual-notice criteria and limit the feature to the users and records needed.
## Conditional decision path
- All applicable school-official conditions established: record the institution’s scoped decision and safeguards.
- A required condition is not met: do not rely on this exception for the proposed disclosure.
- A material condition is unknown: resolve it before sending education records, or identify another applicable lawful route.
## Safe alternative
Practise the administrative wording task with invented student information while the actual disclosure authority is assessed. This document does not obtain consent or approve a provider.
## Source and scope
Guide: https://aona.ai/resources/guides/ferpa-ai-school-official-exception/
Source check: 21 September 2026. General information, not professional approval or a completed control test.
- US Department of Education: FERPA regulations: https://studentprivacy.ed.gov/ferpa
ferpa-ai-school-official-review.csvInspect
Condition,Fictional evidence,Outcome or next step
Institutional service or function,The school describes a limited administrative drafting task normally handled by employees.,Record that exact task; do not extend the scope to unrelated vendor uses.
Direct control,The proposal gives the vendor broad reuse discretion and no demonstrated school control over record maintenance.,Condition is not established in this case; resolve the arrangement before disclosure.
Use and redisclosure,Onward access by a connected service is not explained.,Identify recipient and purpose restrictions under the applicable rules.
Annual notice criteria,The district’s actual notice criteria have not been compared in the example.,Check school-official and legitimate-interest criteria with the institutional owner.
Access limitation,Only the assigned team needs the specific administrative record.,"Define users, records and feature permissions; a whole-school licence is insufficient evidence."
Illustrative decision,Required direct-control and onward-use facts remain unresolved.,Do not send student records on this route based on the school-official exception yet.
Before you proceed
Keep these distinctions clear
- A school account is not legal authority
- The exception depends on the institutional conditions, not the login domain.
- A label does not establish direct control
- Review the actual agreement and operation of the service.
Apply it to employee AI use
Bring your actual data path.
Aona can support a scoped evaluation of employee-AI visibility and sensitive-input policies.
It does not designate school officials, establish consent or approve FERPA disclosure exceptions.
Use invented student-record excerpts to verify the intended rule for a selected installed application and input path.
Review your use caseFAQ
Questions for this decision
Does a ChatGPT education account establish the exception?
Must every AI vendor receive complete student files?
Is the school-official exception the only possible disclosure route?
Can a security tool make a provider a school official?
Evidence behind the guide
Sources and scope
Prepared by Aona. Sources checked 2026-09-21. The cited material supports the specific points below; it does not certify a product or your use case.
- US Department of Education: FERPA regulations
34 CFR 99 definitions, annual notice, school-official exception, legitimate educational interests and use/redisclosure restrictions.
law · checked 2026-09-21