EdTech AI Procurement Rubric: 2026 District Compliance Checklist

Aligning Procurement with the 2026 CoSN & SETDA GenAI Privacy Framework

The procurement landscape shifted decisively in early 2026. The Consortium for School Networking (CoSN) updated the Trusted Learning Environment (TLE) Seal requirements to explicitly address Generative AI data ingestion, model training retention, and prompt hallucination logging. Simultaneously, the State Educational Technology Directors Association (SETDA) released its 2026 Interoperability Standards for AI-Driven Adaptive Platforms, mandating real-time data portability via OneRoster 1.2 and LTI Advantage 1.3 extensions. If your Request for Proposal (RFP) does not require vendors to demonstrate compliance with both frameworks simultaneously, you are exposing student PII to ungoverned model training loops.

Mapping Vendor Data Flows to CoSN TLE Seal v2.0 Requirements

The updated TLE Seal now demands evidence across five new practice areas specific to GenAI: Model Transparency, Data Minimization in Prompts, Output Audit Trails, Opt-Out Mechanisms, and Third-Party Sub-processor Governance. Procurement officers should require vendors to complete a Data Flow Diagram (DFD) that traces a single student interaction—from prompt entry through vector embedding, LLM inference, and response logging—back to the district’s Student Information System (SIS).

• Verify Data Minimization: Contracts must stipulate that prompts are stripped of direct identifiers (Name, SSID, IEP status) before hitting the model context window. Vendors claiming “anonymization” must define their k-anonymity threshold; anything below k=50 fails the 2026 TLE benchmark.
• Demand Output Audit Trails: The TLE framework requires immutable logs of every AI-generated output served to a minor. Ask for the vendor’s SOC 2 Type II report covering the logging infrastructure—specifically checking for prompt_id, model_version, temperature_setting, and timestamp fields.
• Sub-processor Accountability: If the vendor calls OpenAI, Anthropic, or Google Vertex APIs, the district’s Data Privacy Agreement (DPA) must flow down FERPA and COPPA obligations to those sub-processors. Require a signed Data Processing Addendum (DPA) from the LLM provider, not just the EdTech vendor.

Cross-Referencing SETDA 2026 Interoperability Standards for Adaptive AI

SETDA’s 2026 standards move beyond static rostering. They require dynamic competency mapping via CASE (Competencies and Academic Standards Exchange) network integration and real-time xAPI (Experience API) statement streams from the AI tutor to the district’s Learning Record Store (LRS). This is non-negotiable for adaptive platforms claiming “personalized pathways.”

• OneRoster 1.2 + AI Extensions: Verify the vendor supports the new ai_metadata object in the OneRoster enrollment payload. This allows the district to push student accommodation flags (e.g., “text-to-speech required,” “dyslexia font”) directly into the adaptive engine’s prompt engineering layer without manual configuration.
• LTI Advantage 1.3 Deep Linking for AI Tools: The standard mandates that AI-generated content (quizzes, reading passages, feedback) launches via LTI Deep Linking with lineitem and score services pre-configured. If the vendor requires a separate login or iframe bypass for the “AI Tutor” module, they fail the interoperability test.
• Data Portability & “Right to Exit”: SETDA mandates a standardized export format (CSV + JSON-LD schema) for the student’s complete interaction history—including prompt/response pairs and model confidence scores—deliverable within 72 hours of contract termination. Write this SLA into the Master Services Agreement (MSA) with liquidated damages for non-compliance.

By anchoring your 2026 RFP scoring rubric to these specific CoSN TLE v2.0 artifacts and SETDA interoperability endpoints, you transform privacy compliance from a legal checkbox into a technical architecture requirement. This baseline ensures that before a single dollar of ESSER III or Title IV-A funds is committed, the vendor has proven their GenAI stack operates within the guardrails of federal law and modern data stewardship.

Federal & State Law Compliance Matrix: FERPA, COPPA, SOPIPA & 2026 State Amendments

If a vendor cannot map their GenAI data flows to the CoSN TLE Seal v2.0, they fail the technical screen. If they cannot survive this legal matrix, they fail the contractual screen—period. In 2026, the “School Official” exception under FERPA (§99.31) is the most litigated clause in EdTech Master Service Agreements (MSAs). Your contract must explicitly designate the vendor as a “School Official” with “Legitimate Educational Interest” and, critically, assert direct control over the maintenance and use of Personally Identifiable Information (PII). If the MSA grants the vendor unilateral rights to de-identify and retain data for model improvement—even aggregated—flag it as a hard FAIL. The Department of Education’s 2026 guidance (still governing in 2026) requires districts to maintain direct control; a vendor’s promise to “anonymize later” does not satisfy the regulatory burden.

COPPA Verifiable Parental Consent (VPC) in AI Onboarding

Generative AI onboarding flows frequently trigger COPPA because they collect persistent identifiers (voice prints, keystroke dynamics, prompt history) from students under 13. A compliant 2026 workflow requires:

• Pre-collection Notice: Clear, standalone disclosure to parents describing the specific AI model capabilities (e.g., “voice-to-text assessment,” “adaptive tutoring chat”) before any data hits the inference engine.
• VPC Mechanism: Credit card transaction, knowledge-based challenge, or government ID verification—not just an email “confirm” button.
• Granular Opt-Out: Parents must reject AI-specific processing (profiling, predictive analytics) without losing access to the core curriculum platform.

If the vendor’s DPA treats AI training data as “service improvement” exempt from VPC, mark the contract FAIL. The FTC’s 2026/2027 enforcement actions against major EdTech players established that model training on child data is commercial use requiring consent.

2026 State Law Triggers: The New Compliance Floor

Federal law is the basement; state law is the ceiling. Your rubric must verify alignment with three major 2026 regimes:

California SB 1177 (SOPIPA) Updates

The 2026 amendments (effective Jan 1, 2026) explicitly ban the use of student data—including de-identified metadata—for training proprietary or third-party Large Language Models (LLMs) without express written consent. The rubric check: Does the DPA contain a “No Training” clause covering both the vendor’s models and sub-processor APIs (e.g., OpenAI, Anthropic)? Absent this, FAIL.

Colorado Privacy Act (CPA) Education Provisions

Colorado treats student data as “Sensitive Data” requiring a Data Protection Assessment (DPA) before processing. For 2026 procurements, demand the vendor’s completed DPA before signature. The law mandates a 45-day deletion response window post-contract termination. If the vendor’s SLA promises “commercially reasonable efforts” instead of a hard 45-day guarantee, FAIL.

New York Ed Law 2-d & Part 121 Alignment

NYSED’s Part 121 regulations now require the “Parents’ Bill of Rights” to be appended to every contract, detailing the specific AI algorithms used, data retention schedules per data element, and encryption standards (NIST SP 800-53 Rev. 5 minimum). Vendors must sign the NYSED “Third-Party Contractor” certification. Missing appendix or outdated encryption standard? FAIL.

Bottom Line: Attach this matrix as Exhibit A to every RFP. Score each vendor Pass/Fail per row. Zero tolerance on deletion guarantees and “No Training” clauses. In 2026, ambiguity is a liability the district cannot afford.

Validating ESSA Evidence Tiers (1-4) for Generative AI Adaptive Learning Claims

When a vendor pitches a Generative AI tutor as “ESSA-aligned,” your first move is to demand the specific study design backing that claim. The law distinguishes sharply between Tier 1 (Strong) and Tier 4 (Demonstrates a Rationale), and in 2026, the gap is where procurement budgets get burned. Tier 1 requires a well-designed, well-implemented Randomized Controlled Trial (RCT) showing statistically significant positive effects on student outcomes in a setting similar to yours. For GenAI tools—which iterate weekly—true Tier 1 evidence is virtually non-existent. Most vendors wave Tier 4 logic models: a theoretical chain linking product features to outcomes, absent empirical proof. Accepting Tier 4 for a core instructional purchase exposes the district to Title IV-A audit findings and supplanting violations.

Demand WWC Standards for Algorithmic Bias Mitigation

The What Works Clearinghouse (WWC) standards are your shield against “black box” bias. Since the 2026 WWC Procedures Handbook update (Version 5.0), reviewers scrutinize whether analytic samples represent the target population and whether attrition biases results. For adaptive AI, you must require the vendor’s bias mitigation report to map directly to WWC Group Design Standards. Ask for the disaggregated effect sizes by subgroup—race, IEP status, English Learner classification, and FRPL eligibility. If the vendor cannot produce a WWC-aligned analysis showing the algorithm does not widen gaps for historically marginalized students, the tool fails the “evidence-based” threshold for federal funds, regardless of its Tier rating.

Documenting Tier 4 Logic Model Artifacts for Audit Defense

If you proceed with a Tier 4 tool—common for early-stage GenAI pilots—you must build a paper trail that survives an E-rate or Title IV-A audit. The Department of Education’s 2026 Non-Regulatory Guidance (still operative in 2026) requires a documented Logic Model connecting inputs, activities, outputs, and outcomes. Your procurement file must contain:

• A signed Logic Model artifact co-authored by the vendor and your curriculum team, explicitly naming the theoretical research citations (e.g., learning science principles like retrieval practice or spaced repetition) the AI operationalizes.
• A local evaluation plan with a timeline, budget line items (minimum 5% of license cost), and a designated internal or external evaluator. This plan must specify the quasi-experimental design (QED) you will run locally to move toward Tier 2 or 3 within 24 months.
• Board-approved adoption minutes referencing the Logic Model and the specific federal funding stream (Title IV-A, ESSER III carryover, or E-rate Category Two) covering the expense.

Without these three artifacts, a Tier 4 purchase is a compliance liability, not an instructional investment. Treat the Logic Model as a living contract, not a marketing brochure.

Mandatory Vendor Questionnaire: Model Transparency, Bias Audits & Training Opt-Out Clauses

Districts cannot evaluate risk if they cannot see the engine. This questionnaire is designed to be appended directly to your 2026 RFP as a mandatory pass/fail exhibit. Vendors who refuse to answer specific line items—or who answer with marketing boilerplate instead of technical specifications—should be automatically disqualified before the demo stage. The goal is to force disclosure of the exact model lineage, the audit trail governing bias, and the contractual architecture protecting student PII.

Section A: Foundation Model Lineage & Fine-Tuning Disclosure

Vendors must identify the specific foundation model powering every generative feature (e.g., GPT-4o, Claude 3.5 Sonnet, Llama 3.1 405B, or a proprietary architecture). “Proprietary LLM” is not an acceptable answer without a corresponding System and Organization Controls (SOC) 2 Type II report detailing the training corpus provenance. Require a Software Bill of Materials (SBOM) for the AI stack.

• Model ID & Version: Exact model name, version number, and provider (OpenAI, Anthropic, Meta, Mistral, or self-hosted).
• Fine-Tuning Datasets: Itemize every dataset used to adapt the base model for K-12 contexts. Disclose whether synthetic data was generated from student interactions in prior contracts.
• Knowledge Cutoff & Grounding: State the training cutoff date and describe the Retrieval-Augmented Generation (RAG) architecture used to ground responses in district-curated curriculum assets.
• Sub-Processor Chain: List every third-party API involved in the inference pipeline (embedding providers, vector databases, moderation APIs) with their respective Data Processing Agreements (DPAs).

Section B: Algorithmic Bias Audit Cadence & Disparate Impact Thresholds

Annual audits are insufficient for models that receive weekly weight updates or prompt-engineering patches. The contract must mandate a per-major-release audit (defined as any change to model weights, system prompts, or RAG retrieval logic) conducted by an independent third party accredited under ISO/IEC 17065. Results must be delivered to the district within 30 calendar days of release deployment.

• Protected Class Analysis: Disparate impact testing across race, ethnicity, gender, disability status (IDEA/Section 504), English Learner status, and socioeconomic proxy variables.
• Thresholds: Adopt the “Four-Fifths Rule” (80% parity) as the minimum pass rate for automated essay scoring, early-warning dropout flags, and content filtering false positives.
• Remediation SLA: If a release fails the threshold, the vendor must roll back the model version within 48 hours and provide a root-cause analysis within 10 business days.
• Public Summary: A redacted executive summary of every audit must be posted to the vendor’s trust center portal, accessible to parents and board members.

Section C: Zero-Retention & No-Training Contractual Clauses

Standard “data ownership” clauses are toothless against model weight updates. You need explicit, legally binding language in the Master Services Agreement (MSA) and DPA that survives termination.

• Zero-Retention Inference: Vendor warrants that no student PII, prompts, completions, or metadata are logged to persistent storage beyond the transient memory required for the active API call (typically < 30 days for abuse monitoring only, with automated purge).
• No-Training Guarantee: “District Data shall not be used to train, fine-tune, distill, or improve any foundation model, embedding model, or classifier—whether owned by Vendor or Vendor’s sub-processors—now or in the future.”
• Proprietary Content Firewall: District-created curriculum, IEPs, and assessment items are classified as “Confidential Information” and excluded from any aggregate analytics or product improvement pipelines.
• Cryptographic Verification: Vendor must support customer-managed keys (CMK) for encryption at rest and in transit, and provide API endpoints allowing the district to audit data egress logs quarterly.

Attach this questionnaire as Exhibit G: GenAI Transparency & Data Sovereignty Addendum. Score it pass/fail. If the legal team redlines the “No-Training” clause, walk away—the architectural risk to FERPA and COPPA compliance is uninsurable.

RFP & MSA Negotiation Playbook: Indemnification, SLAs & Exit Strategies

You have the privacy framework alignment; now you need the contractual teeth. In 2026, a Master Services Agreement (MSA) without specific Generative AI guardrails is a blank check drawn on the district’s general fund. Your redlines must address three distinct threat vectors: silent model degradation, uncapped regulatory exposure, and vendor lock-in when the underlying foundation model gets deprecated.

Drafting ‘Algorithmic Drift’ SLAs

Standard uptime SLAs are table stakes. For adaptive learning engines, you need an Accuracy Degradation SLA. Redline the contract to define “Algorithmic Drift” as a statistically significant deviation (e.g., >5% drop in F1 score or BLEU metric) against a frozen benchmark dataset curated by the district—not the vendor. Mandate quarterly “Model Cards” delivered to the CTO office showing performance against this benchmark. If drift exceeds the threshold, the SLA triggers a mandatory root-cause analysis within 10 business days and a remediation timeline capped at 30 days. Failure to remediate activates service credits at 2x the standard rate and, critically, unlocks the termination-for-cause clause without penalty.

Unlimited Liability Carve-Outs for FERPA, COPPA & IP

Vendors will cap liability at 12 months of fees ($50k–$200k typical). That is unacceptable for student data. Your MSA must carve out unlimited liability for three specific buckets:

• FERPA/COPPA Violations: Any unauthorized disclosure or mining of Personally Identifiable Information (PII) for model training.
• IP Infringement by Generative Outputs: If the LLM outputs copyrighted text or code ingested into student work, the vendor indemnifies the district for statutory damages (up to $150,000 per work under 17 U.S.C. § 504).
• Gross Negligence/Willful Misconduct: Standard, but explicitly include “failure to honor opt-out flags for human review.”

Pair this with a requirement for the vendor to maintain a $5M Cyber Liability / Tech E&O policy naming the district as an additional insured. Verify the certificate of insurance (COI) annually; a lapsed policy is an automatic material breach.

Data Portability & the 30-Day Exit Ramp

Model deprecation cycles have shrunk to 12–18 months. If a vendor sunsets the model powering your adaptive math platform, you cannot wait 90 days for a CSV dump. Negotiate a 30-Day Exit Migration Clause requiring:

• Interoperable Export: Full student history, embeddings, and fine-tuning weights delivered via OneRoster 1.2 (rostering/enrollment) and Ed-Fi API 5.x (assessment/analytics) standards—no proprietary formats.
• Model Artifact Handoff: If the district fine-tuned a LoRA adapter on the vendor’s base model, the contract must grant a perpetual, royalty-free license to export those weights for inference on a district-hosted or alternative cloud environment (AWS Bedrock, Azure AI, GCP Vertex).
• Transition Assistance: Vendor provides 40 hours of engineering support at no cost during the 30-day window to map schema to the successor platform.

Final pro tip: Insert a “Most Favored Nation” (MFN) pricing clause for AI compute costs. If the vendor drops token pricing for a larger state contract (e.g., Texas or California statewide adoption), your district auto-inherits that rate. In a market where inference costs drop 30% YoY, this single clause protects seven-figure budgets over a five-year term.

Implementation Readiness: Pilot Design, Teacher PD & Continuous Monitoring Protocols

Signing the contract is the easy part. In 2026, the districts actually moving the needle on student outcomes treat procurement as the starting line, not the finish line. If you cannot measure the tool’s impact on learning within a single semester, you have bought a liability, not an asset. Operationalizing your compliance checklist means building a 90-day proof-of-concept that satisfies both the curriculum team and the general counsel.

Designing the 90-Day Controlled Pilot

Forget year-long rollouts. The 2026 standard is a tight, 90-day controlled pilot using NWEA MAP Growth or equivalent interim assessments as the north star. You need a statistically valid design: at minimum, two matched cohorts—one treatment, one business-as-usual control—stratified by prior achievement, IEP status, and English learner designation. Target a minimum detectable effect size of 0.20 standard deviations; anything smaller rarely justifies the recurring license cost, which now averages $18–$25 per student annually for tier-one GenAI suites. Pre-test in week one, mid-pilot checkpoint at day 45, and post-test at day 85. If the treatment group does not show statistically significant growth (p < 0.05) on the specific domains the vendor claims to boost—say, informational text comprehension or algebraic reasoning—kill the contract. Most vendors include a 90-day opt-out clause; enforce it ruthlessly.

Mandating Vendor-Funded Professional Development

Teacher capacity is the single biggest implementation risk. Do not accept generic “onboarding webinars.” Your RFP and subsequent Master Service Agreement (MSA) must mandate vendor-funded, job-embedded professional development focused on two 2026-specific competencies: prompt engineering for pedagogical intent and hallucination detection. Budget for a minimum of 12 hours of synchronous PD per participating teacher, delivered in three phases: pre-pilot bootcamp, mid-pilot calibration, and post-pilot debrief. Crucially, the vendor’s PD lead must co-teach model lessons in your classrooms during the first two weeks. If the vendor pushes back on funding this—typical cost $3,500–$5,000 per school site—walk away. Teachers who cannot reliably identify a confident-sounding fabrication in a large language model (LLM) output will inadvertently teach misinformation, creating downstream remediation costs that dwarf the PD investment.

Quarterly Model Card Review Boards

Governance does not end at launch. Aligning with the 2026 CoSN Trusted Learning Environment (TLE) Seal v2.0 and emerging state AI transparency laws (e.g., CA AB 2026 enforcement, CO SB 205 rules), you must establish a quarterly Model Card Review Board. This is not an IT ticket review; it is a governance body. Membership must include: the Chief Academic Officer, Director of Special Education, Data Privacy Officer, two rotating classroom teachers, and critically, one parent and one student representative per FERPA/COPPA best practices for algorithmic accountability. The board reviews the vendor’s updated Model Card—documenting model version changes, drift metrics, bias audit results, and data retention policy shifts. Any change triggering a “High Risk” flag (e.g., new training data ingestion, modified guardrails for PII) requires a formal re-assessment against your original pilot rubric before the update hits production. Document every meeting; this paper trail is your defense against OCR complaints and state auditor inquiries.

• Pilot KPI: NWEA MAP conditional growth percentile ≥ 55th for treatment vs. control.
• PD Non-Negotiable: Vendor covers 100% of substitute costs for teacher release time.
• Governance Cadence: Quarterly Model Card reviews; emergency session within 10 business days of vendor model version bump.
• Exit Ramp: Contractual right to export all student interaction logs in IMS Global CALIPER format within 30 days of termination.

faqs [{