Microsoft's school AI privacy standard starts November 1

Microsoft's AI privacy standard for schools starts today, November 1. It was negotiated with the American Federation of Teachers and announced in September. It turns a set of AI data promises into contract terms that districts can enforce: no training models on student data, no selling it, no ads, a 72-hour breach clock, and outside audits. Even if you never sell to a school, read it. This is what an AI data clause looks like when the buyer has leverage, and your bigger customers will ask for it next.

What actually happened

Microsoft president Brad Smith announced the National AI Safety & Privacy Standard on September 9 in New York, together with AFT president Randi Weingarten and United Federation of Teachers president Michael Mulgrew. Fortune reported that the document runs about 30 pages and lists 10 enforceable protections. Across Fortune, The Hill and the AP, the terms include:

• No training AI models on student or educator data. Per the AP, there is a narrow exception for data that could help protect students.
• No selling the data and no using it for advertising. The AP adds that it can't be used for product development either.
• Breach notice within 72 hours.
• Human review of AI decisions, plus plain-language guides for families.
• No AI companions and no features built to keep students hooked longer than a lesson needs.
• Audits. The AFT says third-party audits are required, and Smith described annual certification.

Fortune says districts that sign on can cancel contracts and seek damages if Microsoft breaks the rules. Coverage is not consistent on how the standard applies. The AP quotes Smith saying it covers every school Microsoft has contracts with from November 1. The Hill says districts can add it to new or existing contracts starting in November. If you are a district, get it written into your agreement anyway.

The other big vendors haven't signed yet. Per the AP, OpenAI says it looks forward to finalizing its own agreement. Anthropic says it is working with the AFT on a "gold standard." Google didn't respond to the AP.

Why the AI privacy standard matters for your business

This is the template your buyers will copy. Procurement teams borrow language. A school district, a clinic or a franchise group will soon send you a questionnaire that asks the same things: do you train on our data, who audits you, how fast do you report a breach. "We take privacy seriously" won't pass that.

Know what your own AI vendors promise. If your product calls OpenAI, Anthropic or Google, your promise to your customer can't be stronger than their promise to you. Check their API data terms, turn off training where you can, and write down the retention setting you chose.

72 hours is short. You can't meet a 72-hour notice window without logging and someone who is on call. If a breach today would take you a week to scope, fix that before you sign anything with this clause in it.

Sources: Fortune, AP via AJC, The Hill.