California Bans AI Training on Student Data and Microsoft Signs a Union Standard, and Neither Names the District

Framing

This brief has spent the summer documenting a governance chain being assembled one link at a time. Utah measured the gap between signed data privacy agreements and the network traffic of the products they govern and found that breach was the normal case, not the exception. Fulton County wrote a human decision rule and a contract-before-use rule into board policy without waiting for a state to require it. Kentucky told districts the products they already own will become AI products on the vendor's schedule. New York City and Los Angeles answered whether rather than how. Every one of those instruments left the same question open: who, exactly, may enforce anything against a vendor that trains a model on a child's writing. This week produced two answers inside twenty-four hours, and a superintendent needs to notice that neither answer names the district.

Read the mechanisms. AB 1159 is a definitional and remedial statute. It removes the word "primarily" from the trigger for California's pupil privacy acts, so a product used for school purposes and designed or marketed for them is covered whether or not school use is its main business. It also adds a flat prohibition on using covered information to train or develop AI, and it gives a pupil actually harmed a private right of action by filing a complaint with the Attorney General. Enforcement runs through the courts and the state. The Microsoft standard is a private instrument. It is a memorandum between a company and a union-created academy, extended by the company's choice to every district it serves, enforceable when a district writes it into its customer agreement. Enforcement runs through the contract. One instrument travels because it is law in the largest state and vendors build to it nationally. The other travels because it is a vendor's own paper and requires no legislature. That is precisely why competitors will copy it and why its terms will become the reference point in your next renewal, whether you asked for them or not.

The research counterpoint is about capacity, and it arrived in the same week from a different direction. Hur and colleagues gave 36 high school students twelve hours of AI literacy instruction built on an established framework, then measured knowledge with a validated inventory. The mean moved less than one point on a 20-item test, and the difference was not significant. Only 15 of the 36 finished the four-month design project that followed. This is one small study, and I report it here because it is the kind of number a district will never see in a vendor deck or a state guidance document. Every instrument enacted this week, statutory or contractual, assumes an adult in the building who can read a data flow, recognize a new AI feature, and explain both to a parent. The available evidence on producing that adult, or that student, is thinner than the instruments assume.

The timing argument is a date: November 1, 2026. That is when Microsoft says its protections reach every district it serves. The memorandum itself says a district gets them by asking, within 90 days, in a form that can sit inside its existing data privacy agreement. A district that has not inventoried which of its Microsoft-hosted and third-party tools process student data will not know what the standard covers, what it excludes (every general-purpose tool not built for education), or what its own older contracts say that conflicts. Between now and then, your board will be handed AB 1159 by a parent as proof that California solved this, and the Microsoft standard by a vendor as proof that the industry solved it. The cost of waiting is not adopting the wrong clause. It is that you inherit clauses written by a legislature and a union, with enforcement rights you do not hold, and no record of what your own district decided.

Top Research and Policy Signals

1. California Made It Illegal to Train an AI System on a Student's School Data, and Gave the Student the Right to Sue

Source type. Enacted state law. Chaptered September 10, 2026. Not research.

Student personal information, Assembly Bill 1159, Chapter 182, Statutes of 2026 (Cal. 2026). leginfo.legislature.ca.gov [Flagged: rung three. The Legislature's bill text page did not render for this build. Chapter number, approval date, provisions, and vote history were confirmed at CalMatters Digital Democracy and LegiScan, both of which mirror the Legislature's official history record.]

AB 1159, authored by Assemblymember Dawn Addis, amends the K-12 Pupil Online Personal Information Protection Act and the Early Learning Personal Information Protection Act in the Business and Professions Code. Under prior law, those acts reached an operator with actual knowledge that its site, service, or application was used primarily for K-12 or preschool purposes and was designed and marketed for those purposes. The bill applies the acts instead to an operator, or an entity working on the operator's behalf, with actual knowledge that the product is used for the applicable school purposes and was designed or marketed for them. It prohibits an operator from using covered information, including persistent unique identifiers, created or gathered by the product to train a generative artificial intelligence system or service or to develop an artificial intelligence system. It authorizes a pupil actually harmed by noncompliance to bring a civil action against the operator. It requires the person bringing that action to furnish a copy of the complaint to the Attorney General within ten days of filing. It also enacts a Higher Education Student Information Protection Act, operative July 1, 2027. The bill passed the Assembly 65 to 5 on January 26, 2026, cleared the Senate without a no vote on August 30 (the Legislature's history line records 32 ayes; the LegiScan roll call record shows 33), received Assembly concurrence 70 to 4 on August 31, was presented to the Governor on September 9, and was approved and chaptered September 10.

Study context. This is a statute, not a study. The chaptered text was not opened for this build, so it does not state the definition of covered information, any safety and security exceptions, or the operative date for the K-12 provisions. A non-urgency California statute ordinarily takes effect January 1 of the following year; confirm in the chaptered text before relying on a date.

Leadership implication. The word to take to your general counsel is primarily because its removal is the part that reaches products you did not think were education products. Direct your technology and legal leads to pull every agreement for a product that touches student data and answer two questions in writing: does the contract prohibit use of student data to train or develop AI, and if it does, who holds the enforcement right. In California, the statute now supplies the first answer and gives the right to the pupil and the Attorney General. Outside California, your contract is the only instrument that can supply either, and most standard data privacy agreements predate the question. Put a no-training clause with a district termination right into your next three renewals, and hand your board a one-page list of which current contracts lack it.

2. Microsoft Agreed to a Union-Negotiated AI Standard a District Can Demand in Its Contract; It Covers Only Products Built for Education, and the Other Two Academy Partners Have Not Signed

Source type. Labor and vendor agreement announced by press release, with a published memorandum of agreement. Not law, not regulation, not research.

American Federation of Teachers. (2026, September 9). AFT, UFT and Microsoft announce 'National AI Safety and Privacy Standard' for schools to protect students, families and educators [Press release]. aft.org  ·  Companion release: Microsoft. (2026, September 9). AFT, UFT and Microsoft announce 'National AI Safety and Privacy Standard' for schools. Microsoft Source. news.microsoft.com  ·  Agreement text: National Academy for AI Instruction. (2026, September). National AI Safety and Privacy Standard memorandum of agreement. aft.org

AFT President Randi Weingarten, UFT President Michael Mulgrew, and Microsoft Vice Chair and President Brad Smith announced the standard in New York on September 9, 2026. The instrument is a 31-page memorandum of agreement between the National Academy for AI Instruction, the training body the AFT created in 2025 with Microsoft, OpenAI, and Anthropic, and any AI provider the Academy engages. It is not a law, a regulation, or a requirement binding on any company that has not signed it. The memorandum states that every requirement is mandatory for a participating provider and that a provider who cannot meet them is not eligible to serve the Academy. Its reach to districts runs through a clause headed Beyond the Academy: an education customer may request that the provider meet or exceed the standard in the provider's own agreements; the provider agrees to make the substantive protections available within 90 days of the effective date through a clear, simple, and expeditious process, and the protections may be incorporated into the customer's existing data privacy agreement, licensing agreement, or addendum without adopting the identical form. Scope is defined, and it is narrower than the announcement suggests: an AI Provider Educational Product means services or features using generative AI that are primarily designed and marketed for use by students, educators, and administrators under an agreement with the educational entity, and general-purpose productivity, collaboration, communication, search, cloud, development, or workplace-assistance products not primarily designed for educational purposes do not constitute an AI Provider Educational Product, even when a district licenses them. Within scope, the memorandum bars using covered data to train a general-purpose or generative AI model except for a narrow safety and security exception, requires a plain-language annual statement signed by a senior officer confirming no covered data was used for training outside that exception in the preceding twelve months, requires breach notice no later than 72 hours after the provider becomes aware, requires deletion from active systems within 180 days of a request subject to customer retention settings and legal holds, prohibits companion-style or relationship-oriented features designed to foster emotional attachment or dependency, requires current independent third-party certifications with audit reports available to the Academy on request, and preserves damages, injunctive relief, and other remedies under the applicable agreement or law. Smith stated the company will extend the agreement to every school district in the country. Weingarten said the union is still negotiating with OpenAI and Anthropic; Anthropic said it supports the agreement and has not signed.

Study context. A negotiated private agreement, not a public rule. The AFT release, the Microsoft release, and the memorandum text confirmed every provision stated above at the source. [Flagged: rung three for one item only. The November 1, 2026 date on which Microsoft says the protections reach every district it serves does not appear in the memorandum; it was confirmed through two named, dated outlets quoting Brad Smith on the record, Education Week and Fortune, and could not be confirmed in the Microsoft fact sheet, which did not render for this build.] No published material addresses whether the standard supersedes, supplements, or conflicts with a district's existing state-mandated data privacy agreement.

Leadership implication. The operative words are on request and primarily designed for education. Nothing in this standard reaches your district until someone in your district asks for it in writing. When it arrives, it will not cover the general-purpose productivity, search, and cloud tools where most of your student data already lives. Before November 1, direct your chief technology officer and procurement lead to produce one page in three columns: Microsoft products in your environment that are education-designed generative AI and fall inside the standard; Microsoft and other products that fall outside it; and what your existing data privacy agreements say about training, feature changes, and audit for the second column. Then send the written request the memorandum contemplates and calendar the 90-day clock. The next step is to write the same terms, no training, annual signed attestation, 72-hour breach notice, feature notice, and termination trigger, into the contracts of the vendors that did not sign, starting with the two Academy partners that have not.

3. California Barred Districts From Sending School Devices Home With Kindergartners and Told Them to Review Screen-Time Policy With Teachers in the Room

Source type. Enacted state law. Chaptered September 10, 2026. Not research.

Pupils: technology-based materials: school-issued electronic devices, Senate Bill 1128, Chapter 191, Statutes of 2026 (Cal. 2026). leginfo.legislature.ca.gov [Flagged: rung three. The Legislature's page did not render. Chapter number, date, and provisions were confirmed at the CalMatters Digital Democracy chaptered summary and the California School Boards Association's September 2 session wrap-up.]

SB 1128, authored by Senator Henry Stern, was signed as part of the Governor's September 10 child safety package. Commencing with the 2027-28 school year, it prohibits a school district, county office of education, or charter school from requiring a pupil in kindergarten, including transitional kindergarten, to take home a school-issued electronic device, unless necessary under a specified circumstance, while permitting a local educational agency to authorize take-home use. It encourages local educational agencies to review and update their policies on pupil screen time regularly and, in doing so, solicit input from currently employed teachers and school administrators, among others. It requires the State Department of Education, on or before July 1, 2027, to curate and maintain on its website resources for age-appropriate screen time and electronic device use in schools, guidance on transitioning take-home school-issued devices into dedicated classroom-based devices, and guidance on e-waste recycling and buy-back programs, taking into consideration developmentally appropriate screen exposure time at each grade level. The same signing session enacted SB 1119, Adam's Law, authored by Senator Steve Padilla with Assemblymembers Buffy Wicks and Rebecca Bauer-Kahan, which per the author's office, requires companion chatbot operators to perform risk assessments before release, submit to independent child safety audits reported to the Attorney General, use the age-bracket signal established under AB 1043, provide crisis referrals and parental notice, and accept liability for specified harmful outputs; it passed the Senate unanimously and the Assembly 64 to 4. Vote counts for SB 1128 were not confirmed and are not stated.

Study context. A statute, not a study. The summaries confirmed for this bill do not describe the specified circumstance that permits a take-home requirement. The bill summary cites no outcome evidence for the kindergarten line, and this brief found none.

Leadership implication. For a district outside California, the operative sentence is the review clause because it names who must be in the room. Direct your curriculum and technology leads to schedule a screen-time and device policy review before the spring budget cycle, with classroom teachers and building administrators as named participants rather than a survey, and to record the input in the policy file. Then have your operations lead inventory how many take-home devices are assigned in kindergarten through second grade and what it would cost to convert them to classroom-based sets. Kansas is debating the same line through accreditation, New York City drew it for grade 2 and below, and the AFT's standing position is a screen ban through second grade. The line is arriving; the question is whether your district draws it on a record or receives it.

4. Twelve Hours of AI Literacy Instruction Did Not Produce a Significant Gain in AI Knowledge for 36 High School Students, and One in Five Scored Lower Afterward

Source type. Peer-reviewed journal article, mixed-methods study, open access. Published online August 29, 2026, two days before this edition's fourteen-day research window opened; date stated because the window itself produced no qualifying study.

Hur, J. W., Bhuyan, J., Wu, F., Thomas, C., & Koong, K. (2026). Cultivating AI literacy among high school students through generative AI as a collaborative partner. Discover Education, 5, Article 805. doi.org

The study examined 36 African American high school students recruited into a two-phase program approved by the Auburn University and Tuskegee University Institutional Review Boards. Phase 1 was a Summer Academy delivering twelve hours of AI literacy lessons organized around Ng and colleagues' four-part framework, drawing on MIT's DAILy curriculum, AI Unplugged, Google's Teachable Machine, and Code.org lessons, and including hands-on comparison of ChatGPT, Gemini, and Perplexity outputs and prompt refinement practice. Phase 2 was a four-month project in which teams designed AI-enhanced mobile applications with generative AI as a collaborative partner. Of 36 participants, 28 enrolled in Phase 2 and 13 withdrew early, citing schoolwork, extracurricular conflicts, team dynamics, family responsibilities, and part-time employment; 15 completed the project. Conceptual knowledge was measured before and after Phase 1 with 20 items adapted from the AI Literacy Concept Inventory, a validated instrument. The mean rose from 13.14 (SD 3.73) to 14.10 (SD 4.42); a paired-samples t-test returned t = 1.83, p = 0.079, not statistically significant. Approximately 57 percent of students increased, about 20 percent declined, and the rest showed little or no change. Prior exposure was limited: 67 percent had used ChatGPT, 61 percent were unaware of Gemini, and 76.9 percent were unaware of Midjourney. Design artifacts showed students proposing recommendation systems, chatbots, and fact-checking features. Survey results indicated perceived gains in collaboration, communication, and problem-solving. The authors report tensions ranging from overreliance on AI to avoidance of it out of fear of academic penalties.

Study context. A single-site, single-group design with no comparison condition, 36 students, self-selected participation, high attrition in the second phase, and an instrument developed for middle school. It cannot establish whether AI literacy instruction works in general. It establishes that a well-designed twelve-hour program measured with a validated instrument did not move knowledge scores significantly in this sample, which is a null result districts scheduling literacy modules should see.

Leadership implication. This is the citation to place beside any AI literacy schedule your district is about to adopt. Twelve hours of framework-based instruction did not produce a significant knowledge gain; New York City has committed to ninety minutes a year. Direct your curriculum office to select a validated measure before the first module is delivered, administer it before and after, and report the results to the cabinet rather than the completion count. Then write the avoidance finding into your academic integrity communications: students in this study avoided AI because they feared penalties, which means a district that publishes only prohibitions is teaching avoidance, not literacy. Assign the measurement design to the same team that owns the modules, and add a report date to the calendar.

5. Kentucky Told Districts They May Block or Not Block Conversational AI, Split Using AI From Making AI, and Announced That Its Academic Standards Will Be Rewritten to Include AI

Source type. State education agency guidance page, republished September 10, 2026. Informational guidance from the Office of Education Technology, not a regulation and not binding on districts as drafted. Not research.

Kentucky Department of Education, Office of Education Technology. (2026, September 10). AI in Kentucky K-12, September 2026. education.ky.gov

Edition 32 reported the September 3 version of this page. On September 10, 2026, at 3:37 p.m., the Kentucky Department of Education republished it with three additions that change what a district can do with it. First, the page now states that districts can choose to block or not block conversational AI assistant-type products such as ChatGPT when students use the state K-12 internet service or a K-12 computer, which places the filtering decision Los Angeles made administratively last week explicitly in the hands of each Kentucky district. Second, it draws a line the field has mostly blurred. There is a notable difference between the skills needed to use AI and the skills needed to make AI, and using-AI skills should be integrated into all content areas and school operations. In contrast, making-AI skills are directly and explicitly tied to the computer sciences. Third, in the section on the 2024 to 2030 KETS Master Plan, a regulation by reference, the page now states that the department will soon be updating the three technology-related academic standards, the Kentucky Academic Standards for Computer Science, for Technology, and for Library Media, to include AI. The Technology standards are tied to a performance-based technology competency required for high school graduation under 704 KAR 3:305. The page retains its September 3 statements that products students and adults use daily will add AI capability, and that no personal or confidential information should be entered into open, publicly available AI tools. No compliance date attaches to any of the three additions.

Study context. Agency guidance, not a mandate. The standards revision is announced, not published, and no draft, timeline, or public comment window has been found. The block-or-not-block statement describes district discretion; it does not establish what any district has decided.

Leadership implication. Kentucky just gave every district in the country a sentence to put at the top of its AI literacy plan: using AI belongs in every content area, making AI belongs in computer science. Direct your curriculum office to sort every AI literacy activity currently scheduled into those two columns and to assign each column an owner, because a district that assigns all of it to the computer science department has decided that most students will never receive it. Then have your technology director document, in writing, the current filtering posture for conversational AI assistants and who has authority to change it, because Kentucky has now said the choice is the district's and Los Angeles has shown what happens when nobody writes the choice down. If your state has technology or computer science standards tied to graduation, ask your standards office whether an AI revision is on the state board's calendar; Kentucky's will arrive before most districts have a curriculum to meet it.

Emerging Strategic Themes

Theme 1. Two enforcement paths, neither one the district's. AB 1159 gives the enforcement right to the pupil and the Attorney General. The Microsoft standard gives it to whoever holds the customer agreement, only after that customer asks, only for products built for education, and on terms a union negotiated. Both are welcome, and both leave the district as a beneficiary rather than a party. Utah showed in August that signed agreements do not describe what products do; a prohibition nobody in your building can invoke is an assertion, not a control. Write the no-training clause, the audit right, and the termination trigger into your own contracts so the district holds the right directly.

Theme 2. The vendor floor is rising faster than district paper. In four weeks, the sequence has been Utah's network-traffic audit, Fulton County's contract-before-use policy, Kentucky's warning about embedded AI, and now a vendor standard covering third-party processors and requiring notice before new features. Every one of those instruments assumes the district can name the products, the data flows, and the AI features it currently runs. Most cannot. The next instrument will assume the district can name what authority each system may exercise, because vendors are marketing agent features that retrieve records, message families, and execute workflows ahead of any verified district-scale deployment. A district whose inventory is older than its newest vendor feature will be governed by the vendor's floor, not its own.

Theme 3. Literacy is being scheduled in minutes, branded by vendors, and measured in nothing. New York City set ninety minutes a year in Edition 32. DeKalb County will certify middle and high school students in Gemini from September 21. Kentucky said using AI belongs in every content area. This week's peer-reviewed study found that twelve hours did not significantly move a validated knowledge measure. Three different definitions of AI literacy reached districts in one week, and none included an outcome measure. Choose the measure before the module, and report the score alongside the seat time or the certificate count.

Theme 4. The kindergarten line is now being drawn by statute. SB 1128 bars mandatory take-home devices in kindergarten from 2027-28. Kansas board members discussed a ban through second grade at their August meeting and took up a draft framework on September 8 and 9. New York City restricted one-to-one screen time in grade 2 and below. The AFT's standing position is a screen ban through second grade. No outcome study cited by any of these bodies was located. Draw the line in your district on a written rationale, with an evaluation date, before a legislature draws it for you without one.

What Was Not Found

No peer-reviewed K-12 AI outcome study published inside the fourteen-day research window met the selection standard. Searches of academic indexes for August 31 through September 13, 2026 returned meta-analyses and reviews dated February through August, a district governance case study whose publisher page could not be located, and conceptual frameworks with no sample. The one research item run in this edition was published August 29, two days before the window opened, and states that date. Sixteen research candidates were pulled, and fifteen were rejected: five for a verified publication date outside the window, seven because the publisher record or date could not be confirmed, and three as duplicates from prior editions. This is the third consecutive edition in which the window produced no qualifying study.

No evidence establishes that a no-training prohibition changes vendor behavior. AB 1159 creates a prohibition and a lawsuit. The Microsoft standard creates a prohibition and, per reporting, an audit right. Neither includes a technical method a district could use to verify that a model was not trained on its students' data, and Utah's August investigation showed that contract terms and product behavior diverge in the normal case. Districts are about to treat both instruments as protection without any way to test them.

No analysis exists of how the Microsoft standard interacts with a district's existing data privacy agreements. Searches for a legal analysis, a state education agency advisory, or a district counsel memorandum addressing whether the standard supersedes, supplements, or conflicts with state model agreements or national data privacy agreement templates returned nothing. Districts will encounter the standard in their agreements on November 1 without a published reading of what it changes.

No instrument enacted this week separates English learners or students with disabilities. SB 1128 permits a take-home requirement when necessary under a specified circumstance, and the summaries confirmed for this build do not define it. AB 1159 and the Microsoft standard are population-neutral. No study has measured whether a device restriction or a data restriction affects a student who depends on assistive technology differently than a family without a home device.

No elementary literacy evidence appeared. The kindergarten device line was drawn by statute this week, Kansas is debating a line through second grade, and the state guidance SB 1128 commissions is not due until July 1, 2027. Nothing located in the window examines AI or device use in early reading or writing instruction. This gap has now persisted for six months in this brief, and it sits exactly where the youngest children are.

No Georgia board took an AI-specific policy vote inside the window, and the one district program announced has no published board action behind it. Searches across the ten Tier 1 districts and a rotation of Tier 2 districts returned no AI policy adoption, first read, or procurement action dated September 7 through 13. DeKalb County's Gemini AI Certification Program is announced on the district's instructional technology page with a September 21 release date. Still, we found no board agenda item, contract, vendor agreement, or data privacy terms for the program, and the district page did not render on direct fetch. Fulton County's September 10 pre-work session covered Board Policies EF and EFB on data management and data collection, the closest adjacent governance action, and it carried to Watch This Week. Gwinnett's BoardDocs portal could not be retrieved for this build. The Lane 5 counter-evidence sweep also found no verified district-scale deployment of autonomous AI agents inside the window, only vendor marketing; the governance question those products raise, what authority an AI system may exercise, is arriving ahead of the deployments.

The pattern is unchanged, and this week sharpened it. Mandates outran evidence while districts adopted, then while two districts withdrew, and now while a state and a vendor wrote the same protective rule with no measurement behind either. The correct response is not to wait for the measurement. It is to write down what your district decided, inventory what the new rules actually cover in your environment, and build the exit ramp into the contract before November 1 makes the vendor's terms the default.

Novo Executive Summary

In one week, the largest state made it unlawful to train an AI system on a student's school data and gave the student the right to sue; the largest school technology vendor agreed to a union-negotiated standard that any district can demand in its Microsoft agreement, covering only products built for education, with Microsoft promising nationwide reach from November 1. California also drew a statutory kindergarten device line and enacted the first comprehensive companion chatbot regime. The peer-reviewed counterpoint is a study in which twelve hours of AI literacy instruction did not significantly move a validated knowledge measure for 36 students. The governance question has shifted from what the rule should say to who may enforce it. Both new instruments answer that question without naming the district. A district that treats them as protection without inventorying its own agreements, writing the same four terms into its own contracts, measuring the literacy it schedules, and recording the rationale for the lines it draws will be governed by other people's paper. The differentiator is not which vendor signed first. It is whether decision rights are written down, whether procurement specifications require something a vendor cannot self-assert, whether an evaluation cadence survives a change in leadership, and whether literacy pathways are role-based and measured. That architecture is what Novo Innovative Pathways builds with district leaders, and it is what turns a vendor's floor into a district's standard.

Watch This Week

• Wednesday, September 16, 2026. The Florida State Board of Education is scheduled to vote on the artificial intelligence amendment to Internet Safety Policy Rule 6A-1.0957, Notice of Proposed Rule 31301432, the same day the comment period that opened August 26 closes. Carried forward from Editions 27 through 32.
• Thursday, September 17, 2026. The Fulton County Board of Education meets at the South Learning Center in Union City. Watch for approval of the August 20 minutes, which would confirm adoption of Board Policy IFBI, Artificial Intelligence; for any first reading of Board Policies EF, Data Management, and EFB, Data Collection and Retrieval Methods, both taken up at the September 10 pre-work session; and for the announced timeline to fill the District 3 seat vacated by Vice President Katie Gregory effective September 18. Per the district's September 11 Board Bulletin. Carried forward from Editions 31 and 32.
• Wednesday, September 30, 2026. Governor Newsom's deadline to sign or veto remaining bills. Still pending as of September 13: AB 2392, generative AI procurement standards for the community colleges and California State University, presented to the Governor September 3; AB 2656, the 45-day labor notice before a public employer deploys generative AI in represented work, presented August 31; and SB 1159, excluding AI systems and autonomous agents from the definition of a person under the state's open meeting and public records acts. Carried forward from Editions 29 through 32.
• Monday, September 21, 2026. Published release date for the DeKalb County School District Gemini AI Certification Program for middle and high school students. Watch for the enrollment process, the participation instructions the district says will follow, and any board agenda item, vendor agreement, or data privacy terms attached to the program; none were located as of September 13. [Flagged: rung three. The district page did not render on direct fetch; program name, grade span, content list, and release date were confirmed through the search index record of the district's own page.]
• Sunday, November 1, 2026. The date Microsoft states its National AI Safety and Privacy Standard protections reach every school district it serves. The memorandum's own mechanism is a district request with a 90-day fulfillment clock. Watch for the published district-facing contract language, for any state education agency advisory on how the standard interacts with state model data privacy agreements, and for signatures from OpenAI and Anthropic, which the AFT says it is still negotiating. Microsoft separately published a youth Safe Participation Framework on September 10, built on safety by design, age-differentiated experiences, and education and empowerment, with mandatory sign-in for Copilot and restricted access under age 13. [Flagged: rung four. The Microsoft On the Issues post did not render; the three pillars, the Copilot sign-in requirement, the under-13 restriction, and the Windows Age API were confirmed in a syndicated full-text mirror of the Anadolu Agency report dated September 12, 2026.]
• Kansas State Board of Education. The board discussed a draft statewide instructional technology policy at its September 8 and 9 meeting in Topeka; no adopted text, vote, or post-meeting agency release was located. In August, board members set a target to reach consensus by November, ahead of the 2027 Legislature, and discussed enforcement through accreditation standards. Secondary summaries circulating this week state that the board expects further action in October or November while staff develops implementation resources; that statement could not be confirmed in any agency document and is not adopted here. Watch the October monthly meeting. [Flagged: rung three. The agency's September 2 release did not render on direct fetch for the second consecutive week; the August discussion and the November target are confirmed through the Kansas Reflector's August 14, 2026 report.]
• New York. Governor Kathy Hochul has taken no confirmed action on S9051, the kids chatbot safety bill, or A6578, the AI Training Data Transparency Act; her deadline is December 31, 2026. Senate Bill S10685, the FOCUS Act, remains in the Committee on Rules. Carried forward from Editions 30 through 32.
• Still unresolved. The Los Angeles Unified Generative AI Ad Hoc Committee next meets October 21, 2026. Representative Josh Gottheimer's AI LABS Act, announced September 4, has no located bill number. The GAO study of AI in K-12 requested by a Senate letter in June has no confirmed engagement number. North Carolina H301 remains in conference; Michigan SB 760 remains with the House Communications and Technology Committee. SB 1119's risk assessment requirement for companion chatbot operators, according to its authors, begins July 1, 2027, with the Attorney General's first annual audit report in 2028. The October publication of the Nagashima and colleagues CSCW study, first flagged in Edition 26, is still pending.

Sources

Governance and Policy

American Federation of Teachers. (2026, September 9). AFT, UFT and Microsoft announce 'National AI Safety and Privacy Standard' for schools to protect students, families and educators [Press release]. aft.org

California School Boards Association. (2026, September 2). Four CSBA-sponsored bills head to the Governor at the conclusion of the 2025-26 legislative session. CSBA Blog. blog.csba.org

DeKalb County School District, Instructional Technology. (2026). AI for students: Gemini AI Certification Program. its.dekalb.k12.ga.us

Fulton County Schools. (2026, September 11). Board Bulletin for 9/11/2026. news.fultonschools.org

Kentucky Department of Education, Office of Education Technology. (2026, September 10). AI in Kentucky K-12, September 2026. education.ky.gov

Carpenter, T. (2026, August 14). Kansas State Board of Education starts work on technology use policies for public schools. Kansas Reflector. kansasreflector.com

Microsoft. (2026, September 9). AFT, UFT and Microsoft announce 'National AI Safety and Privacy Standard' for schools to protect students, families and educators. Microsoft Source. news.microsoft.com

Microsoft. (2026, September 10). Safe Participation Framework: Opportunity and safety for the next generation in the age of AI. Microsoft On the Issues. blogs.microsoft.com

National Academy for AI Instruction. (2026, September). National AI Safety and Privacy Standard memorandum of agreement. American Federation of Teachers. aft.org

Office of Governor Gavin Newsom. (2026, September 10). Governor Newsom signs the strongest child safety chatbot and social media laws in the nation [Press release]. gov.ca.gov

Office of Senator Steve Padilla. (2026, September 10). Governor Newsom signs Adam's Law [Press release]. sd18.senate.ca.gov

Sparks, S. D. (2026, September 9). Microsoft agrees to new student privacy protections for AI. How ironclad are they? Education Week. edweek.org

Gioino, C. (2026, September 9). Microsoft's move in the AI school debate: Controls over how student data gets used. Fortune. fortune.com

Student personal information, Assembly Bill 1159, Chapter 182, Statutes of 2026 (Cal. 2026). leginfo.legislature.ca.gov [Verification note: rung three. The Legislature's page did not render. Chapter number, approval date, provisions, and vote history confirmed at CalMatters Digital Democracy, calmatters.digitaldemocracy.org, and LegiScan, legiscan.com.]

Pupils: technology-based materials: school-issued electronic devices, Senate Bill 1128, Chapter 191, Statutes of 2026 (Cal. 2026). leginfo.legislature.ca.gov [Verification note: rung three. Confirmed at CalMatters Digital Democracy, calmatters.digitaldemocracy.org.]

Companion chatbots: children's safety, Senate Bill 1119 (Cal. 2026). leginfo.legislature.ca.gov

Barcott, B. (2026, September 11). AI legislative update: September 11, 2026. Transparency Coalition. transparencycoalition.ai

Research, Peer-Reviewed

Hur, J. W., Bhuyan, J., Wu, F., Thomas, C., & Koong, K. (2026). Cultivating AI literacy among high school students through generative AI as a collaborative partner. Discover Education, 5, Article 805. doi.org

Research, Preprint, Not Peer-Reviewed

None qualified this week. Preprint searches for August 31 through September 13, 2026 returned no K-12 empirical study with a sample and an outcome measure within the window.

Institutional Report, Not Peer-Reviewed

None run this week. The IBM and Morning Consult survey circulated again on September 9 through a second Education Week report; it was covered in Edition 32 and is not repeated.

Located and not run, named here rather than omitted: Yu, W., Kim, N., Chang, A., & Huang, W. (2026). The effects of K-12 artificial intelligence education in enhancing AI literacy: A meta-analysis. Journal of Computer Assisted Learning, 42(5), e70308. doi.org