The commitments prohibit training models on student and educator data, apart from a narrow security exception. They bar data sales and advertising uses, prohibit AI companions and require human review of high-risk decisions.
Schools retain control over data retention, export and deletion. The framework also provides for audits and breach reporting within 72 hours. These protections are contractually enforceable once incorporated; they are not a general law binding other suppliers. The number of districts that have already adopted them has not been established.