Check an AI tool against the rules before students use it.

What the checklist covers.

Eight areas, in the order a review usually runs. Every check names the law, regulator or guidance it comes from.

Which privacy law applies.

The first check, and the one the rest depend on. These are the regulators’ own statements of who each law covers.

• Ontario school boards are institutions under MFIPPA, and personal information under it includes a person’s education history.¹
• The Information and Privacy Commissioner of Ontario’s schools guide says private schools are not subject to MFIPPA or FIPPA, and that some private schools are covered by the federal PIPEDA.¹³
• PIPEDA applies to an organization’s collection, use and disclosure of personal information in the course of commercial activities.⁶
• The Office of the Privacy Commissioner of Canada’s general view is that PIPEDA does not apply to the core activities of schools, but it recommends that private educational institutions operate on the assumption that PIPEDA applies to them, unless a substantially similar provincial law does.⁷
• In a 2006 finding about a non-profit charitable private school, the OPC presumed a school’s core educational activities are non-commercial, a presumption rebutted when the school aims to earn a profit for its owners.⁸
• In the United States, FERPA applies to schools that receive funds under a program administered by the Secretary of Education, and COPPA covers operators of online services directed to children under 13, or that knowingly collect personal information from them.^19,22

Minimum ages in the vendors’ own terms.

From each vendor’s consumer terms or help pages, as read on 5 October 2026. School and education accounts can carry different terms.

UNESCO’s 2023 guidance, from an intergovernmental body rather than a regulator, proposes 13 as the minimum age for independent conversations with generative AI.

What changed recently.

• The amended COPPA Rule took effect on June 23, 2025, with compliance by April 22, 2026: separate parental consent for disclosures to third parties, a written data retention policy with a deletion timeframe, and a written information security program.^23,22
• From January 1, 2027, MFIPPA requires a written privacy impact assessment before an institution collects personal information, unless the regulations provide otherwise, and requires institutions to report to the IPC any theft, loss or unauthorized use or disclosure of personal information with a real risk of significant harm, and to tell the people affected.^1,3
• Since July 1, 2026, O. Reg. 52/26 requires every Ontario school board to give written notice before a student’s personal digital information is disclosed to a software application’s owner or operator, and O. Reg. 51/26 requires school boards, among others, to run a cyber security program.^4,5
• On January 21, 2026, Ontario’s Information and Privacy Commissioner and Human Rights Commission released joint principles for the responsible use of AI.¹⁷
• On October 8, 2025, Canada’s federal, provincial and territorial privacy regulators called for children’s information to be treated as sensitive in ed tech, with the best interests of the child paramount.¹²
• On April 20, 2026, the US Department of Justice moved the web accessibility compliance dates for state and local governments, public schools included, to April 26, 2027 for those with a population of 50,000 or more, and to April 26, 2028 for smaller ones and special district governments.^36,37

How to use it.

• Fill in the tool, the vendor, the plan or version, who reviewed it and when, and who will use it.
• Answer each check Pass, Fail or Not applicable from the vendor’s terms, privacy policy and documentation, and note where you found the answer.
• Read the Summary sheet: it counts the answers in each area. A Fail is a question to put to the vendor before the tool reaches students.
• Keep the workbook with the decision, and review it again when the vendor changes its terms.