AI governance for edtech
Edtech AI serves children and affects learning records, so the governance bar is higher than most sectors. We design to the strictest regime that applies to each learner cohort.
COPPA (US under 13)
FERPA (US institutions)
GDPR-K and UK GDPR
UK Age Appropriate Design Code
DfE generative AI product safety expectations
EU AI Act (education high risk)
WCAG 2.2 AA
CCPA and CPRA
Children's data is not training data. Learner content goes only to model endpoints with retention disabled and no training on your data, or to self hosted open weight models. Identifiers are stripped before prompts where possible, consent and deletion flow through every sub-processor, and child accounts follow the parental consent rules of COPPA, GDPR-K and the Children's Code.
Learner facing AI is filtered, logged and escalated. The UK Department for Education's generative AI product safety expectations cover filtering harmful content, monitoring and reporting, security, privacy and governance. We build input and output filters tuned to the age group, safeguarding detection that alerts a designated lead, and activity logs schools can review.
Assessment keeps a human accountable. The EU AI Act lists AI used to evaluate learning outcomes, steer learning or monitor students during tests as high risk, and prohibits emotion recognition in education settings. We keep a human marker accountable for grades, document how each mark was reached, and do not build emotion inference into learning tools.