Risk Managers & Insurers

Districts often track formally approved tools, not necessarily what students can actually reach. That includes approved tools, technically accessible tools, embedded generative features, browser-based access, productivity-suite features, search assistants, extensions, and vendor feature rollouts.

Risk exposure attaches to what students can actually reach, not only to what the district has formally approved. A review limited to the approved-tool list has not evaluated that exposure.

Acceptable use policies generally assume that the student independently authored the input or output in question. Generative systems complicate that assumption. They may suggest prompts, complete inputs, frame questions, continue prior context, or shape a student's reasoning across extended exchanges.

If the district cannot distinguish independently authored student inputs from system-shaped inputs through multi-turn interactions, disciplinary determinations and responsibility assignments may lack the evidentiary foundation they require.

A district may have usage records, access records, or partial logs. That does not necessarily mean it can reconstruct a disputed interaction. Whether records independently available to the district can show the full interaction sequence is the actual test of whether logging supports governance, not whether logs exist.

If a record is sufficient for reconstruction, it shows student prompts, system outputs, system suggestions, auto-completions, and where relevant, retained context, access conditions, and supervision context, such as whether the interaction occurred at home, at school, or under teacher observation. Where the institution cannot reconstruct those conditions from records it can retrieve, attribution cannot be demonstrated, and accountability, conformance review, and correction are undermined in turn.

Whether student use is remaining within the boundary the district authorized — school policy, instructional purpose, age-appropriate instructional value, supervision conditions, and approved use cases — is a question the district can either answer from its own records or cannot. There is no third option.

This is the Conformance State.

The question is not only whether a specific reported incident violated policy. The threshold question is whether the district can determine, on an ongoing basis and independent of any specific report, whether the deployment is operating within the boundary the district defined.

Without a determinable Conformance State, the district learns whether the system operated within bounds only when an outside party surfaces a problem, if at all.

A reporting tool, complaint process, or vendor feedback channel does not by itself establish correctability. Correctability requires a binding pathway from identified student harm to verified correction.

Whether the vendor or another accountable entity is contractually required to correct an identified condition, whether correction is verified before comparable student exposure continues, and whether correction applies across the deployment rather than only to the affected student, is what distinguishes a binding pathway from a reporting channel.

Vendor terms may disclaim outputs, limit liability, reserve unilateral change rights, or decline responsibility for student-facing effects. Those provisions may define what the vendor has not accepted, but they do not, by themselves, establish who remains responsible for the student-facing deployment.

Where the vendor controls output behavior and the district controls access, procurement, device issuance, account provisioning, filtering, logging requirements, and continued availability, the assertion that outputs are outside district control does not resolve the governance obligation.

Student-facing generative AI use should be presented to the district's insurer for specific review. General liability, educators legal liability, cyber, E&O, and other standard coverage forms were not written with AI-generated student harm, disciplinary disputes, privacy issues, civil-rights concerns, or correlated exposure across a student population in mind. Whether any of them apply to a specific deployment is a question for the insurer to answer, not an assumption to carry forward.

Coverage confirmation, as distinct from coverage assumed, addresses policy language, exclusions, endorsements, indemnity, vendor responsibility, liability limits, self-insured retentions, and whether the insurer has evaluated the specific deployment conditions.