The right AI tools for a school are the ones that pass a data check and appear on a short approved list in the school's AI policy. That list is the part of a school AI policy guide that staff reach for most, because it turns "do not put pupil data into unapproved tools" into a name they can look up. This post gives the five-question check, then shows what six tools say publicly against it: Google Gemini, Microsoft Copilot, ChatGPT, MagicSchool, SchoolAI and Khanmigo. None of them is a recommendation to buy. The point is what to ask.
| Tool | Where the data terms are stated | What it says about training | What it leaves open |
|---|---|---|---|
| Google Gemini | Google's May 2024 announcement for Workspace for Education | Data "not reviewed by anyone" and "not used to train" models, for users 18 and over | Dated 2024; the announcement does not repeat this for paid add-ons |
| Microsoft Copilot | Microsoft's Copilot overview | Prompts and responses covered by Enterprise Data Protection when users sign in with Entra accounts | Your district's tenant has to be set up to use it |
| ChatGPT | OpenAI's Record help article | Business, Enterprise and Edu content excluded from training by default; Free, Plus and Pro may be used if a setting is on | Applies to Record content; confirm it for the features you use |
| MagicSchool | MagicSchool's trust page | Does not permit any third-party AI provider to use student data for training | Does not say whether MagicSchool itself trains models |
| SchoolAI | SchoolAI's Notetaker page | Says it runs under the district's data processing agreement | Statement is about Notetaker, not the whole product |
| Khanmigo | Khan Academy's Districts support article | Large language models are not allowed to train on student data | Does not mention data processing agreements |
Facts above were checked on October 15 and 16, 2026 against the pages named. They are vendor statements, not audits.
What is the data check for approving an AI tool?
Five questions settle most approvals. This is our editorial view, not a legal standard, and your data protection lead or district technology team should own the final answer.
- Is there a signed data agreement? A vendor page is a claim. A signed agreement your district holds is something you can rely on.
- Does the vendor train on your data? Ask about staff prompts and about anything that names a child, and ask whether the answer changes between personal and school accounts.
- What is the age limit? Some tools are for adults only on school accounts. A tool that is fine for staff may be wrong for pupils.
- How is data kept and deleted? Look for a period, not a promise to keep data "as long as needed."
- What can the school see? Administrators who can review activity can catch problems. Administrators who cannot are trusting the tool.
If a tool fails the first or second question for the use you have in mind, it does not go on the list for that use.
What do six tools say publicly against the check?
Google Gemini. Google's announcement, dated May 16, 2024, said that with the added protection "your data is not reviewed by anyone, it's not used to train artificial intelligence models," and that Gemini was not available to people under 18 on Workspace for Education accounts. That is a 2024 statement and the add-on terms were not repeated in it, so confirm both points with your Google administrator before you write them into a policy.
Microsoft Copilot. Microsoft's Copilot overview says prompts and responses are covered by Enterprise Data Protection when users sign in with Entra accounts. The protection depends on how your district's tenant is configured, so the question for your IT team is whether staff are actually signing in that way.
ChatGPT. OpenAI's help article on Record mode says content from Business, Enterprise and Edu workspaces is not used for training by default, while content from Free, Plus and Pro accounts may be if "Improve the model for everyone" is on. The practical lesson for a policy is that the account matters as much as the tool: a personal login and a district workspace carry different terms for the same button.
MagicSchool. MagicSchool's trust page says it does not permit any third-party AI provider to use student data to train, fine-tune or improve models, and that it acts as a school official under FERPA. It also says custom data privacy agreements are available and lists a SOC 2 Type II audit. The page does not say whether MagicSchool itself trains models on student data, and it does not give specific retention periods, so those are questions to put in writing.
SchoolAI. SchoolAI's Notetaker page says the feature is held to the same FERPA, COPPA and SOC 2 standards as the rest of its product, runs under the district's data processing agreement and deletes original audio after 48 hours. That is specific to Notetaker. Ask whether the same agreement covers every feature staff will use.
Khanmigo. Khan Academy's Districts article says it does not allow large language models to train on student data and that names and personal information are not shared with model providers. It says administrators can view student progress, usage and Khanmigo chat summaries. The article does not mention data processing agreements, so ask whether your district's partnership includes one.
What belongs on the approved list besides the tool name?
Keep it to one page. For each tool, write the name, the approved use (staff planning, pupil practice, admin), the date it was reviewed, the person who reviewed it, and the condition that applies, such as "managed account only" or "no pupil names." A tool with no approved use is not approved.
Then add the route for a new request. Our safe AI tools for schools guide and the directory's security assessments can feed that review. The approved list is only one part of the policy. If you are writing the rest, the outline, sample clauses and 90-day plan are in our school AI policy guide.
What should a school do this week?
List every AI tool you know staff use. Run the five questions on the three most common. Put the results on one page with a date and a name. Send it to staff with the rule that personal or sensitive pupil data goes only into tools on the list. Review it each term, because vendors change their terms, and a statement from 2024 is not evidence about today.
None of this is legal advice. Data protection law and procurement rules vary by country and district, and your counsel or data protection lead has the final word.
