AI Safety & Privacy in Schools: What Tutors Need to Know | Evallo
New AI Safety and Privacy Rules for Schools: What Tutors Need to Know in 2026
A new U.S. agreement on AI safety and privacy in schools gives tutors and education businesses a useful preview of where expectations around student-facing AI are heading. On September 9, 2026, Microsoft, the American Federation of Teachers (AFT), and the United Federation of Teachers (UFT) announced a National AI Safety & Privacy Standard for schools. The agreement centers on four ideas: protect student and educator data, keep humans in control of consequential decisions, make AI use transparent, and let schools control how tools are used.
For tutoring businesses, the important point is not that this agreement automatically governs every private tutor. It does not. The useful question is: what operating standard should a tutoring company adopt when it uses AI with minors?
What Changed in September 2026?
The Microsoft–AFT–UFT announcement says U.S. school districts can incorporate the new protections into Microsoft customer agreements, making them contractually enforceable. The standard says student and educator data should not be used to train AI models, sold, or repurposed; schools should retain control over data use, retention, and deletion; consequential decisions should retain human oversight; and families should receive understandable information about how AI is being used.
Microsoft followed that announcement on September 16 with a broader five-principle commitment for AI in education, emphasizing safety and privacy by design, educator control, AI that supports rather than replaces student thinking, stronger education systems, and preparation for an AI-powered future.
Why Tutors Should Care Even If They Are Not School Districts
Private tutoring businesses often sit outside district procurement systems, but they handle many of the same sensitive inputs: student names, school information, diagnostic scores, learning gaps, parent contact details, session notes, writing samples, and sometimes disability or accommodation information. Adding generative AI creates another question: where does that information go after a tutor pastes it into a tool?
The emerging standard is therefore useful as a procurement checklist. A tutoring company choosing an AI note-taking, content-generation, assessment, CRM, or communication tool should be able to answer basic questions about data training, retention, deletion, access, human review, and disclosure.
The Four AI Guardrails Tutoring Businesses Should Adopt
Guardrail | What it means | Tutor-business practice |
|---|---|---|
Data protection | Student and educator data should not become raw material for unrelated model training or advertising. | Know what data a tool collects, why it collects it, how long it keeps it, and whether it is used to train models. |
Human oversight | AI should not be the final authority for consequential educational decisions. | A tutor or academic manager should review placement, intervention, scoring, and high-stakes recommendations. |
Transparency | Families and educators should understand when and how AI is being used. | Explain material AI use in plain language, especially when student work or records are processed. |
Organizational control | The education provider should control access, retention, deletion, and acceptable use. | Use approved tools, role-based access, documented policies, and a process for removing data or disabling a tool. |
1. Stop Pasting Sensitive Student Data Into Unapproved AI Tools
The easiest privacy mistake is also the most common operational mistake: a staff member copies a student report, essay, diagnostic, or session note into a consumer AI tool without knowing the provider’s data terms. A tutoring business should define what information may be entered into AI systems and what must be de-identified first.
A simple internal rule is useful: if the prompt does not require the student’s identity, remove it. Replace names with neutral labels, avoid unnecessary contact information, and do not include sensitive records merely because they are available.
2. Keep Tutors Accountable for the Final Educational Decision
AI can draft explanations, suggest practice questions, summarize notes, or surface patterns. That is different from delegating professional judgment. A tutor should remain responsible for deciding whether a generated question is correct, whether an explanation matches the curriculum, whether a student has actually mastered a skill, and whether an intervention is appropriate.
This is especially important in test prep. Evallo’s framework for SAT practice-test analysis treats test results as evidence for a tutor to interpret—not as an automatic verdict on what the student needs next.
3. Tell Families Where AI Actually Enters the Workflow
Transparency does not require turning onboarding into a technical manual. It does require avoiding surprises. If AI is used to summarize session notes, generate assignments, assist with grading, or analyze student work, the business should be able to explain that use in ordinary language.
This also improves internal discipline. A team that cannot explain why it uses an AI tool probably has not defined the tool’s role clearly enough.
4. Audit the Tools, Not Just the Tutors
Training staff is necessary, but vendor behavior matters too. Ask whether the product offers organizational controls, data deletion, access restrictions, auditability, and clear terms for education data. Review product changes periodically because AI features can change faster than annual policy reviews.
The U.S. Department of Education’s August 20, 2026 guidance on responsible classroom technology provides a useful broader test: what learning problem does the technology solve, when should it be used, for whom, for how long, and what evidence shows that it improves learning? Those questions are just as useful for tutoring businesses as they are for schools.
AI Safety Is Becoming an Operations Issue, Not Just an IT Issue
The practical shift is important. AI governance is no longer only a question for a technical administrator. It affects tutor training, onboarding, lesson planning, assessment, CRM practices, parent communication, and vendor selection.
That is why tutoring businesses should connect AI rules to their broader operating system. A well-structured tutoring CRM should collect the information a team actually needs without becoming a dumping ground for unnecessary student data.
Likewise, tutoring scheduling and billing workflows work best when responsibilities, statuses, and exceptions are explicit. AI governance needs the same clarity.
A 10-Minute AI Privacy Audit for Tutoring Companies
List every AI tool currently used by tutors, administrators, marketers, and academic managers.
Mark which tools ever receive student work, scores, session notes, contact information, or other identifiable data.
Check whether each provider uses submitted data for model training, advertising, or unrelated product development.
Confirm who can access the data and whether the organization can delete it.
Identify any educational decision currently made automatically without a human review step.
Write a one-paragraph explanation of material AI use that a parent could understand.
Create an approved-tool list and a simple rule for requesting new tools.
Schedule a recurring review because product terms and AI capabilities change.
What This Does Not Mean
The new Microsoft–AFT–UFT standard is not a blanket federal law for every tutor, and it should not be described that way. Nor does responsible AI mean banning every useful tool. The more defensible approach is to match the level of control to the sensitivity of the data and the consequence of the decision.
A tutor asking AI to create five anonymous algebra warm-up questions is not the same risk as uploading a named student’s psychoeducational report and asking a model to decide placement. Good policy recognizes that difference.
FAQ: AI Safety and Privacy for Tutors
Does the new Microsoft AI standard legally apply to private tutoring businesses?
Not automatically. The September 2026 agreement is designed around Microsoft education products and school-district contracts. Private tutoring businesses should treat its principles as a useful emerging benchmark, while separately complying with the laws and contractual obligations that apply to them.
Can tutors use AI to generate practice questions?
Yes, but generated content should be reviewed for correctness, curriculum fit, difficulty, bias, and originality before students receive it. Human review is particularly important for standardized-test material.
Should tutors put student names into generative AI tools?
Only when there is a legitimate need and the organization has approved the tool and its data practices. In many common tutoring prompts, the student’s identity is unnecessary and should be removed.
What should tutoring businesses tell parents about AI?
Explain material uses that involve student work, records, assessment, or communication in plain language. The goal is informed transparency, not a vague statement that 'AI may be used.'
Bottom Line: Use AI, but Make the Rules Visible
The most important lesson from the new U.S. school AI standard is not that every education business needs the same contract. It is that responsible AI use is becoming concrete: protect data, keep humans accountable, explain what the technology does, and preserve organizational control.
Tutoring businesses that establish those habits now will be better prepared as schools, families, regulators, and technology providers raise their expectations. More importantly, they will be able to use AI without weakening the trust that makes tutoring work in the first place.
Other Stories
