For Schools
Schools are responsible for the environments in which students learn and interact. When a school issues or requires a device, whether used on campus or at home, the digital environments that device enables fall within the school's scope of responsibility.
Generative AI systems present a governance condition that differs structurally from prior educational technology. The Institutional Accountability Framework (IAF) identifies that condition and describes what accountability requires in response.
Governance Clarifications for Generative AI in Schools
The following distinctions are drawn directly from the IAF. Each describes a gap between a governance mechanism schools commonly rely on and what that mechanism can actually do.
AUP ≠ Control
Student Acceptable Use Policies govern student behavior, specifically, what students may submit as inputs. They do not govern what the system generates in response.
This limitation is structural, and it becomes clearer when the nature of a generative AI interaction is examined directly.
What AUP assumes: a stateless model
AUPs are written on an implicit assumption that each prompt is independent, entered by the student, evaluable on its own terms, and attributable solely to the student. Under this model, compliance can be assessed prompt by prompt.
What actually occurs: a stateful model
Generative AI interactions are stateful. Outputs accumulate context. System outputs influence subsequent inputs. The IAF's Input Classification Framework identifies the observable input types that result:
I — independently entered prompt (student-originated)
S — prompt derived from a system suggestion
M — mixed-origin prompt (combining independent and system-derived content)
A — auto-populated prompt (inserted by the system into the input field)
A representative interaction sequence is:
I1 → O1 → S2 → O2 → M3 → O3 ...
↘ G1 ↘ G2
Where: G events introduce system-generated suggestions; S and M prompts incorporate system-derived content; the interaction evolves as a continuous, stateful sequence.
The interaction remains independently attributable only while inputs are classified as I. Once the first system output occurs, subsequent inputs may be S, M, or A — conditions under which the student is no longer the sole originating source.
The governance consequence
An AUP written to govern student inputs can only reliably reach I-type inputs. Once S, M, or A conditions are present, two problems follow. First, compliance cannot be determined from isolated inputs alone, it depends on the prior sequence and accumulated context. Second, attribution cannot rely solely on the student as the originating source, because system-derived structure is present in the input itself.
This framework does not eliminate student agency. It identifies the point at which inputs can no longer be attributed solely to the student and at which AUP-based governance loses its analytical foundation.
Supervision ≠ Authority Over Output
Three distinct functions are often conflated when schools consider supervision as a governance mechanism.
Equipment custodianship: parents can reasonably be asked to ensure issued devices come home safely and undamaged. This is a property responsibility, not a supervisory one, and carries no implication of authority over the content those devices access.
Custodial supervision (in loco parentis): the school's duty of care over students attaches to the school's own deployment decisions. It cannot be transferred to parents or to students. When a school requires use of an AI system, the duty of care that flows from that decision remains with the school regardless of where or when use occurs.
Content supervision: authority over what the student actually receives. For traditional tools, this operated alongside custodial supervision. Generative AI breaks that alignment: content formation occurs inside the system, outside any institutional review mechanism, before delivery.
Supervision only functions as a governance rationale under one narrow condition: a teacher is present, has accepted active responsibility, and can intervene in real time. Outside that circumstance - independent use, homework, take-home access, no supervisory condition exists.
A student cannot govern on behalf of the school. Granting access is not transferring supervisory authority.
When a school grants access, it represents that the use is acceptable under the conditions of that access. A school that grants unsupervised access while relying on supervision as its governance rationale holds two incompatible positions. Schools that have extended access beyond supervised classroom use have implicitly represented that supervision is not required and should ensure the remaining accountability conditions are addressed.
The IAF examines what those conditions require.
Monitoring ≠ Constraint
Logging and monitoring identify issues after outputs have already been delivered. They do not prevent the generation of similar outputs in future interactions. Post-hoc review is a record-keeping function, not a control mechanism.
Absence of Exclusion ≠ Confirmed Coverage
The absence of an insurance exclusion does not mean coverage applies to a specific use. Coverage exists only where an insurer has affirmatively evaluated and confirmed the applicable use case.
Schools relying on existing policies for generative AI exposure should obtain explicit written confirmation that student-facing deployments are covered.
The structural condition
Schools may bear responsibility for outcomes arising from systems they do not fully control, cannot meaningfully constrain at the point of content formation, and may not be able to reconstruct after the fact.
The IAF identifies this as a governance gap between institutional responsibility and institutional authority. The framework examines whether existing mechanisms of supervision, AUPs, content filters, monitoring, resolve that gap. Its finding is that they do not: each operates on a variable other than content formation itself.
Generative AI functions like an instructional actor but is being governed like a tool.
What the Framework Asks
The IAF identifies multiple conditions a school should be able to confirm before deploying a student-facing generative AI system, some are below:
Attribution Can the institution reconstruct interaction sequences and distinguish between student-originated and system-generated inputs for purposes of attribution?
Authority at Generation Does the institution have the ability to review, approve, or prevent system-generated outputs before they are delivered to students in real time?
Constraint Does the institution maintain enforceable technical controls that meaningfully limit what the system can generate during student interactions, rather than relying on post-hoc monitoring or policy enforcement?
Liability / Binding Has the institution obtained affirmative written confirmation that liability for student-facing system outputs — arising during normal, policy-compliant use — is covered by an identifiable and bound entity (insurer, vendor, or the institution itself)?
Coverage Clarity (Insurance Specific) Have applicable policy terms and exclusions, including ISO CG 40 47 and CG 40 48 or functional equivalents, been reviewed for their application to student-facing generative AI use, and has the resulting coverage position been confirmed in writing?