Executive Summary

Key numbers

Four figures pulled out of the full agreement. The first two say how far the standard reaches today; the last two say what remains after a breach and after the contract ends.

Sources: AFT full agreement (Version 1.0, September 2026) · Microsoft announcement (2026-09-09)

Federal law covering student data already exists in several forms. FERPA protects education records, COPPA protects children under 13, and IDEA governs special education records. None of them was written to aim squarely at a generative AI product taking the prompts and conversation logs it collects in a school and feeding them to a model. Randi Weingarten, president of the American Federation of Teachers, said the union had to hammer out a privacy agreement with real teeth because nobody, the federal government included, had done the substantive work.

So it is worth being precise about what this standard is in law. The 31-page document signed on September 7 is neither statute nor regulation but a memorandum of agreement (MOA). The two signatories are the National Academy for AI Instruction, founded by the AFT and the UFT, and Microsoft, which came in under the role of AI Provider. The term runs two years and extends if both sides renew in writing. Neither union holds authority to contract on behalf of every school in the country, so this one document does not place every school in the nation under its protection automatically.

Binding force takes one more step. The preamble carries a clause written so that districts outside the Academy can request the same protections. Once a district asks, the provider has 90 days from the effective date to fold the standard's substantive protections into that district's privacy contract or license addendum through a simple process. The wording does not have to be copied word for word, as long as the level of protection is equal or stronger. Microsoft stated in its fact sheet that no contract renegotiation or renewal is required, and the day that door opened was November 1.

The setting this agreement came out of has a history. In July last year the AFT and the UFT launched the National Academy for AI Instruction together with Microsoft, OpenAI and Anthropic, a $23 million institution offering free AI training to the federation's 1.8 million member teachers. Meanwhile New York City's education department banned student use of AI through eighth grade and allowed only pre-vetted programs in high schools, and the Los Angeles Unified School District announced restrictions of its own for the new school year. The side banning AI and the side expanding training sat inside the same organization, and what emerged between them was a contract with the conditions written down.

The agreement is built out of ten principles, and the document is explicit that compliance means all of them. Partial compliance with a few is not compliance. Federal, state and local law apply alongside it, and the standard does not displace the stronger protection a law may give. What it protects is bundled under the name Covered Data: the prompts students and staff enter and the model's responses, the files they upload, the behavioral signals and metadata left behind in use, and everything derived from those.

The first principle is the training ban. It forbids outright any use of Covered Data for model training, fine-tuning, updates, benchmarking and improvement, and it states that de-identifying, aggregating or transforming the data makes no exception. The document sets down a separate sentence saying de-identification is not an escape hatch. The ban reaches back over data collected in the past, and it does not disappear when the contract ends.

There is one exception. Data may be processed solely to detect, prevent and investigate risk of self-harm, child sexual abuse material, grooming, threats of violence, harassment and security breaches. Even under this narrow exception, general model improvement, profiling, advertising and marketing remain off limits, and only the minimum needed may be processed, to be erased once the purpose is met. A duty to submit a statement signed by a senior executive, confirming that nothing was used for training outside the safety purpose over the past 12 months, is attached here as well. That statement, though, comes out when the school asks for it.

The remaining nine principles take one piece each: the scope of collection, ownership of the data, human oversight, accountability when something is broken, security, the explanation owed to families, equity, the right to move to another provider, and what survives the end of the contract. Together with the first one, that makes ten, and here is a line on what each of them shuts down.

Of everything on the prohibited list, the fourth principle sits closest to the classroom. It nails down, with no exception, five things a teacher cannot hand over to AI: grading without human review, discipline decisions, placement decisions covering course selection, ability grouping and special education referral, emotional and psychological assessment, and monitoring aimed at predicting behavior. The fourth principle also bans companion features. A product cannot carry relationship-oriented features that simulate friendship, pull for engagement beyond the learning task, or coax a student into disclosing something sensitive.

A sentence saying data will not go into training can sit in any company's contract. The hard part is how the other side checks that the sentence held. This is where the agreement parts from ordinary terms of service. Inside the third principle stands a clause of its own, named Administrative Access Required.

What the clause calls for is a secure administrative means. An admin portal, a report issued on a schedule, an API, or a documented request procedure — the provider picks the form. What the school receives through it, though, has to be enough to understand five items. Which categories the data now being processed falls into, what retention period applies to each of them, which region they are stored in, which subprocessors they pass to, and who has access.

The third principle also carries a storage restriction. Covered Data has to be kept and processed inside the European Union or North America, and a school has to be able to confirm which region specifically holds its own data, through an admin tool or a request. On a deletion request, absent a legal hold, everything including backups is permanently erased within 180 days, and a written confirmation follows when it is done. Where a memory feature is used for personalization, the user has to be able to see what is stored, erase it, and switch the feature off.

This window is not the only channel the agreement leaves open. The fourth principle calls on the provider to publish plain-language documentation covering how the model produces its results, what data went into training it, and what its known limits and failure modes are, and to refresh that documentation whenever the product changes significantly. That document, though, is an explanation anyone can read, while the administrative window is where a district asks about its own students' data. Neither stands in for the other.

From here on is this article's reading. What the clause demands of a provider is not a declaration of intent but a condition: being able to produce, at any moment, where our data sits, who it goes to and how much of it remains. That comes to the same thing as keeping a lineage system running continuously, the practice of tracking where data came from and where it went. Digging through logs to reconstruct the picture after an incident will not meet this clause. Subprocessor lists and access rights move every time a contract changes, and retention periods are set separately for each category of data.

The fifth principle handles enforcement. It opens with the duties that follow a breach: notify within 72 hours, keep updating the state of the investigation, and cooperate fully with regulators. The certifications to hold in ordinary times are listed alongside. SOC 2 Type II renewed every year, ISO 27001, ISO 27701 and ISO 42001, and FedRAMP Moderate where it is required. Any certification not yet held has to come with a target date written into an addendum.

The road after a violation surfaces forks in two. One fork is the district's. Where the standard has been written into that district's contract, the agreement states that the district holds the remedies under its own contract, including the right to terminate for an uncured material breach and to claim damages. The other fork is the Academy's. Good-faith discussion comes first, then a reasonable period to cure, and where the provider still does not fix it, participation in the standard can be revoked and the revocation made public.

One more duty sits on the provider. It has to run a public trust page and refresh it quarterly with the certifications it currently holds, a summary of recent audits, and known security incidents. A provider removed from the standard has to record that removal on the same page. The duty to defend and indemnify the Academy and the AFT in third-party suits brought by users falls on the provider as well.

The tenth principle deals with what follows the end of the contract. The training ban and the bans on sale and sharing, those two, stay permanently. The duty to delete on district instruction and the duty to give after-the-fact breach notice run for two years past termination, or until the provider no longer holds the data. That parts ways with the common structure where the promise ends the moment the contract is cut.

The name says national, but the AI provider bound by these clauses today is Microsoft alone. The signature page of the agreement leaves eight more slots open for other providers, which shows the document was designed around further signatures. Randi Weingarten has publicly called on other companies including OpenAI and Anthropic to sign, and said discussions are under way. Both were founding partners who launched the Academy together last year, and neither has put its name to this standard yet.

Seen from a school, that fact sets the real scope. What gets the protection is a district using Microsoft products that has put these clauses into its own contract, and the same prohibitions do not attach to other generative AI tools running in the same classroom. Writing the ten principles into a contract does not mean every AI a school uses stops training on student data. Brad Smith, Microsoft's vice chair and president, said the standard sets a high bar for children's privacy and AI safety, and a high bar is not yet the same thing as a bar that reaches everyone.

Procurement conditions in American school districts are not something Pebblous has to follow. The reason for looking into this document lies in the structure of its clauses. A sentence saying customer data will not go into model training is already common in corporate contracts and terms of service at home and abroad. What is not common is writing the means of confirmation next to that sentence. This agreement sets the prohibition clause and the inspection clause side by side in one document, and the effect is that what the provider owes turns from a declaration into a condition.

For anyone working with data, the demand is familiar homework. Without tracking, as a matter of routine, which data came in from where, what processing it passed through, where it piles up and who it is handed to, there is no way to prove that nothing went into training. A prohibition that cannot be proven is indistinguishable, once something goes wrong, from a prohibition that was never there. Any organization writing the same sentence into a contract, school or not, could start by checking three things.

• How far the data covered by the no-training sentence reaches, as written in the document. This agreement bundled prompts and responses together with uploaded files, behavioral signals, metadata and derivatives under one name
• Whether the contract also spells out the means by which the other side can confirm the promise held. This agreement left the form to the provider, whether a portal, a report or a request procedure, and required that categories, retention, location, subprocessors and access rights come out of it
• Whether the duties surviving the contract are separated from the ones ending with it. This agreement wrote the bans on training and sale as permanent, and deletion and notice as two years

Plenty of terms of service attach a proviso saying data processed so that no individual can be identified may be used for training, and this agreement closed that proviso explicitly. Which approach is right is a judgment each organization makes for itself, but at least a district handed this document can read where the line was drawn. In a contract that leaves the line unwritten, both sides find out they had drawn different ones only after a dispute begins.

Thanks for reading this far. The ten principles, the administrative access requirement, the enforcement procedure and the survival periods were confirmed in the full agreement published by the AFT (Version 1.0, September 2026) and in Microsoft's fact sheet. The September 7 signing, the September 9 announcement and Brad Smith's remarks come from Microsoft's official announcement, while Randi Weingarten's and Michael Mulgrew's remarks and the background of the New York City and Los Angeles restrictions come from reporting by The Hill. That districts can apply the clauses from November 1 without renegotiation, the state of signatures, and how the Academy came about were confirmed in K-12 Dive's reporting and Microsoft's fact sheet. Reading the administrative window as a demand for continuous data lineage in section 3, the point about the missing response deadline, and the three checks in section 6 are this article's interpretation. If your organization keeps a clause saying customer data will not go into training, we would like to hear how you have set up the way the other side confirms it.

Pebblous Data Communication Team
November 2, 2026

Primary Sources

• 1.National Academy for AI Instruction (AFT/UFT). (2026). "National AI Safety & Privacy Standard for Schools — Memorandum of Agreement (Version 1.0)." American Federation of Teachers.
• 2.Microsoft Corporation. (2026). "AI Safety and Privacy Standard Fact Sheet." Microsoft Corporate Social Responsibility.
• 3.Microsoft Source. (2026, September 9). "AFT, UFT and Microsoft Announce 'National AI Safety & Privacy Standard' for Schools to Protect Students, Families and Educators." news.microsoft.com.

Industry Coverage

• 4.The Hill. (2026, September 9). "Microsoft and AFT set new AI privacy standards following NYC and LA bans."
• 5.Merod, A. (2026, September 9). "Teachers unions announce AI safety agreement with Microsoft." K-12 Dive.