What changed on 1 November 2026?
Microsoft's AI Safety and Privacy Standard for schools is now open to every U.S. school district. From 1 November 2026, districts can add the standard's protections to a new or existing Microsoft agreement. Microsoft's fact sheet says no contract renegotiation or renewal is required.
The standard itself dates from September. Randi Weingarten, president of the American Federation of Teachers, and Brad Smith, Microsoft's vice chair and president, signed the 31-page agreement on 7 September 2026. The organisations announced it in New York on 9 September.
Microsoft described the deal as following months of intense negotiations. It also builds on the AFT's 2024 “Commonsense Guardrails for Using Advanced Technology in Schools”, which set out nine principles. The new agreement turns several of those principles into contract terms.
What changes today is access, not the text. A district must request the terms and incorporate them into its own contract. Once that happens, Microsoft says the protections become contractually enforceable. They are not automatic, and they are not a statute.
The agreement rests on three priorities: protecting privacy, enhancing safety, and giving schools transparency and control. Microsoft's fact sheet reduces the legal text to 10 protections. Each one binds a signing AI provider, but only for the products a district has opted into.
That distinction matters this month. Districts are finalising AI purchases for the 2026-27 school year. New York City and Los Angeles chose moratoriums. Microsoft's standard offers a contract route instead, with terms a district can enforce against one vendor.
What are the 10 protections?
The agreement lists ten binding principles. Microsoft's fact sheet describes all ten as contractually enforceable. The full text is more specific than the summary suggests.
The data rules are broad. The training ban covers prompts, outputs, uploaded files, behavioural signals, metadata and de-identified derivatives. The only exception is safety and security work, such as detecting self-harm, grooming or attacks. That work must be purpose-limited and auditable on request.
The feature bans are direct. Companion-style features designed to foster emotional attachment are prohibited. Biometric collection of any kind is prohibited, including facial recognition, voice prints, gaze tracking and emotional inference. Automated grading without review and disciplinary decisions appear as prohibited uses in the addendum.
Several duties carry deadlines. Breaches must be reported within 72 hours. Plain-language family guides and FAQs are due within 90 days of signing. An independent equity and accessibility study must be funded within 12 months.
The operational detail goes further. Providers must complete a privacy impact assessment before any material new feature that raises risk. Where a provider is a data controller, it must handle verifiable parental consent for students under 13 as COPPA requires. A senior officer must sign an annual statement, on request, confirming that student data was not used for training.
- •No training on student or educator data. The ban survives termination indefinitely and covers subsidiaries and subprocessors.
- •Data minimisation. Precise geolocation tracking, keystroke logging, attention monitoring and long-term profiling are prohibited.
- •Customer ownership. Schools control export, retention and deletion. Data cannot be sold or used for advertising.
- •Human oversight. High-risk decisions require human review. AI must not replace an educator's judgement.
- •Real accountability. Providers need SOC 2 Type II, ISO 27001, ISO 27701 and ISO 42001 certifications, or equivalents.
- •Security. Data must be encrypted, access-controlled and independently tested. Incident plans must cover subprocessors.
- •Family transparency. Providers publish plain-language guides, FAQs and a route for families to ask questions.
- •Equity and accessibility. Tools need screen-reader support, captions, keyboard navigation and translation.
- •No feature creep or lock-in. New data-collecting features need notice, and data must be exportable at no cost.
- •Long-term responsibility. Deletion and post-termination breach duties continue for two years or until the data is gone.
Does the standard cover Copilot in Word, Teams and Windows?
Not necessarily. The agreement applies to what it calls an AI Provider Educational Product. That means a service primarily designed and marketed for students, educators and administrators, with authenticated use under a district agreement.
The definition excludes general-purpose productivity, collaboration, communication, search, cloud, development and workplace-assistance products. The text says products “not primarily designed for educational purposes do not constitute an AI Provider Educational Product.”
That boundary looks deliberate. The AFT and Microsoft aimed at classroom tools, not every Microsoft licence a district owns. But it leaves a practical question for buyers. A district that rolls out a general Copilot licence may find that much of its use falls outside the standard, even when teachers use it with students.
The addendum makes the gap visible. Providers must list the product name and version, intended users, authorised use cases and prohibited uses for each covered product. Districts can use that schedule to check whether the tool they are buying is actually in scope.
There is a second limit. The signature page lists eight AI provider slots. Microsoft is the only one filled in. The other seven are blank.
So this is not an industry code of conduct. It is one vendor's contract terms, endorsed by a union and offered to districts. Microsoft's fact sheet says the protections are available to every district. It does not say that other vendors have agreed to match them.
The agreement also lets districts adopt terms that “meet or exceed” the standard rather than the exact text. That flexibility helps procurement. It also means two districts can end up with different wording and different protections.
The standard does not decide whether a district should use AI. It sets no screen-time limits and no curriculum rules. Those remain district decisions, which is why the New York City moratorium and the Microsoft contract can coexist. One restricts use; the other sets terms for tools a district chooses to allow.
How enforceable is the standard?
For a district, enforcement runs through its own contract. Once the terms are incorporated, the agreement says the district can terminate for an uncured material breach. The district can also seek damages or other remedies under its agreement or applicable law.
That is real leverage, but it depends on the district. It must ask for the terms, incorporate them, and be willing to enforce them against a vendor it relies on. Small districts with limited legal staff may struggle to do all three.
The AFT's leverage is different. The National Academy for AI Instruction can pause or deny deployment and revoke a provider's participation. It can also publish the revocation, after which the provider must stop claiming that it participates. A public trust page, updated at least quarterly, must list certifications, audit summaries and past security incidents.
The agreement also contains exit routes. An AI provider can end its participation with 60 days' written notice. The principles section sets a two-year term that needs written renewal. Revocation does not release obligations already written into a district's contract.
The cure process is detailed. A remediable breach gets a cure period that is reasonable under the circumstances. Disputes escalate to senior representatives before revocation. The provider gets five business days to review a proposed public statement that names it. The provider must also defend the academy and the AFT against third-party claims arising from covered products.
Some duties are enforceable only by the academy. The independent equity study is one example. The text calls it a commitment solely between the provider and the academy, and says no district or third party may rely on or enforce it. Full audit reports and annual training confirmations are provided on request; the public trust page carries summaries.
No regulator oversees the standard, no public register lists participating districts, and no outside body audits compliance with its terms. The standard's strength is contractual. Its limits are contractual too.
Why are schools turning to contracts now?
The backdrop is a policy gap. Microsoft's announcement describes it as “the absence of any meaningful federal and state rules governing artificial intelligence in schools.” FERPA and COPPA set floors for student privacy, but neither was written for generative AI.
Districts have responded with bans. On 2 September 2026, New York City announced a one-year moratorium on student-facing generative AI for 2-K through 8th grade. The mayor's office says it covers nearly 600,000 students, or two-thirds of enrolment. DW reported the same scale. Companion chatbots are prohibited in all grades. A limited group of high schoolers gets five AI pilots, capped at 50,000 students. All high schoolers get twice-yearly AI literacy modules.
Los Angeles Unified restricted student access to generative AI platforms for the 2026-27 school year, K-12 Dive reported. Microsoft's announcement says LAUSD adopted a similar framework.
The release points to a gap, not a specific bill. It says the deal was struck in the absence of federal and state rules. The AFT's 2024 guardrails filled part of that space. New York State United Teachers adopted a similar framework, according to Microsoft.
The union's position has been building for a year. In May, Weingarten called for a screen ban from kindergarten through second grade. She also sought a ban on student-facing AI in elementary school and on companion chatbots for students under 16.
In July 2025, the AFT launched the National Academy for AI Instruction with Microsoft, OpenAI, Anthropic and the UFT. The $23 million programme aims to train 400,000 educators over five years. That is about 10 percent of the U.S. teaching workforce, reaching more than 7.2 million students.
Weingarten has framed contracts as the alternative to voluntary pledges. “Anything less than legally enforceable provisions is simply a wish list,” she said when the standard was announced. She has also said that “HIPAA and FERPA never envisioned the advent of AI.”
Microsoft has a commercial interest as well. The education consultancy 9ine noted that turning safety terms into a contract is “raising the procurement bar” for rivals. Vendors that cannot match the terms may face harder questions in district tenders.
What should districts and parents check before opting in?
The standard is detailed, but it is not self-executing. Districts should treat it as a contract negotiation, not a press release.
Parents have a narrower role. The agreement gives families plain-language information and a route to ask questions where the vendor is a data controller. It does not give parents a veto over district purchases. That remains a school board decision.
The most useful test is coverage. A district should ask Microsoft to confirm in writing which products fall inside the education-product definition. It should also ask whether a general-purpose licence used in classrooms is included or excluded.
- •Confirm the product list. Ask which Microsoft products are covered and whether each meets the education-product definition.
- •Choose the retention setting. The addendum supports session-only zero retention, a fixed maximum or a custom schedule.
- •Request the family materials. Guides and FAQs are due within 90 days of signing, which points to early December for Microsoft.
- •Review subprocessors. The provider must publish a list, give notice of new ones and allow districts to object or exit without a fee.
- •Test the exit. Data must be exportable at no cost in standard formats, with at least 30 days to export after termination.
- •Check state and federal law. The agreement says it does not reduce FERPA, COPPA, IDEA or state privacy protections.
What to watch next
The first test is adoption. Microsoft's materials do not list which districts have added the terms, and the agreement creates no public register. Watch whether large districts name the standard in board documents and vendor contracts.
The second is whether other vendors sign. OpenAI and Anthropic helped launch the AFT's academy, but neither is named as a signatory to the standard. Whether they, or Google, adopt similar terms is the open question.
The third is the December deadline for family materials. Plain-language guides are easier to promise than to produce. They will show how much of the standard is operational rather than aspirational.
The fourth is enforcement. A public revocation, or a district terminating a contract over a breach, would test whether the terms have teeth. Until then, the standard's strength is the paper it is written on and the contracts it is written into.
One more variable is litigation. A district that terminates a Microsoft contract over a data breach would create the first public test of the remedies. A vendor that walks away would test the 60-day exit clause. Both outcomes would tell districts more than another announcement.
For schools, the practical question is simpler than the policy debate. If a district is buying AI this year, it can ask for these terms at no extra cost. The only way to know whether it gets them is to ask.