[ TEMPLATE ]
IT review checklist for student AI tools (template)
The questions school IT should send every AI vendor before students use the tool, in nine groups, with a rule for scoring unclear answers.
How to use this checklist
Send these questions to every AI vendor you review, ask for written answers, and keep them with the date. Score unclear answers as "no" until they are clarified.
Identity and access
- How do students and staff sign in? Which methods are not supported yet?
- How does a person join our school: by invitation, roster or email domain?
- Which roles exist, and what can each see?
- Are school, class and role checked on every read?
Data
- What do you store about a student?
- Will you put no sale, no ads and no training on student data in the contract?
- What is the retention schedule for chats, records, logs and backups?
- How does deletion work, and which copies can it not reach?
- Can students and the school export data?
- Where is data hosted, and how is it encrypted?
AI providers
- Which models do students get, from which providers?
- How do you meet each provider's terms for users under 18?
- Who holds the provider account?
- Which retention and routing settings apply to student traffic?
Visibility
- Who can read student chats?
- What are students told, and when?
- Is every staff read logged? Who can see the log?
Safety
- What happens when a student writes about self-harm, abuse or danger?
- Who receives a flag, in which hours, with what backup?
- Does a person review each flag before outreach?
Network and devices
- Which domains must our filter allow?
- Has it been tested on our devices and our Wi-Fi?
- Which of our filter's AI categories will it fall under?
Integrations
- Which LMS and SIS connections are live, and which are planned?
- Which scopes do connections request, and how are tokens stored?
Security program
- How quickly will you tell us about a breach?
- Which security testing have you done, and when?
- How do you handle dependency vulnerabilities?
- Who are your subprocessors, and how will you notify us of changes?
Agreements
- Will you sign our data privacy agreement or the SDPC National Data Privacy Agreement?
- Will you act as a school official under our direct control where FERPA applies?
- How will you handle parents' requests to inspect records?
See how Nexus answers
Our answers to these questions are on Nexus for IT directors, with the status of each integration on integrations.
[ FAQ ]
Questions and answers
What should IT ask an AI vendor before approving it for students?
Sign-in and access, data stored and retention, deletion, training on student data, AI providers and their terms for minors, who can read chats, safety routing, filter domains, integrations, breach notice and agreements.
Which AI vendor answers should count as red flags?
Treat unclear answers on training, retention, deletion, provider terms for minors and safety routing as "no" until clarified in writing.
Do we need a data privacy agreement for an AI pilot?
Yes. Sign it before any student data is used, even for a pilot.
[ SOURCES ]
Sources
Facts checked Oct 18, 2026.
- 1Student Data Privacy Consortium, National Data Privacy AgreementRead Oct 18, 2026 · privacy.a4l.org
- 234 CFR 99.31, FERPA disclosure without consentRead Oct 18, 2026 · law.cornell.edu
[ AI FOR SCHOOLS ]
The AI your school can approve.