If your board asked this month what the district is doing about AI, six tools cover the work that follows. Lightspeed Systems shows you what students are already using. 9ine turns that list into vendor assessments you can hand to counsel. The free K12 AI Policy Generator drafts the policy four states now require. SchoolAI gives students a monitored space instead of a block page. CustomGPT.ai answers staff questions from your own handbook. Acuity AutoRedact clears the records requests that follow.
This is written for the person who has to make all six true at once, and who was probably not in the room when the decision was made: the district technology director, the chief technology officer, the director of technology services.
The timing is not an accident. On September 2, 2026, New York City and Los Angeles Unified, the two largest school systems in the country, closed student access to generative AI on the same day. New York banned it through eighth grade, which its mayor's office called the broadest generative AI moratorium in any US school system. Los Angeles restricted all students while it reviews instructional use and safeguards, and its Generative AI Ad Hoc Committee met the next day. Add Idaho, Maryland, Oklahoma and Virginia, which now require districts to adopt an AI policy, and the pattern is clear enough. Somebody has to convert a board decision into a filter rule, a vendor file and an answer for the parent who calls on Tuesday. That somebody is you.
How I built this list
The pool was the 26 tools in the directory's school administration and safety category. I picked on fit for a district job that actually exists, on what the vendor documents in public, and on whether the tool leaves the decision with a human. Nobody pays to be included and no vendor saw this before it published. Pricing and features were checked on the vendors' own pages on September 13, 2026.
Three exclusions worth naming. I left out every AI detection product, for the reasons set out in do AI detectors work. I left out Class Companion because its directory record is currently contaminated with another vendor's data, and I will not cite a record I know to be wrong. And I left out the school information systems that have bolted an assistant onto a dashboard, because a technology director does not choose a student information system for its AI.
One disclosure, since it matters here more than usual. The K12 AI Policy Generator is built by AI Educator Tools, which also runs the directory this blog belongs to. It earns its place because it is free and because policy drafting is the one job on this list with no good free option, but you should weigh it knowing where it comes from. A second disclosure: 9ine appears below as a tool, and 9ine is also the firm whose independent security assessments the directory flags. Both facts are in the open.
What the directory numbers say about the tools districts buy centrally
Here is the finding that surprised me. Of the 26 tools in the school administration and safety category, five carry an independent 9ine security assessment. That is 19 percent. Across all 126 tools in the directory, 36 carry one, or 29 percent.
The category a district buys centrally, with a contract and a purchase order and a lawyer's signature, is assessed independently less often than the average tool a teacher signs up for on a Sunday night.
Six of the 26 do not state where they host data at all. Seven declare FERPA, the federal student records law; 14 are marked not applicable because they never touch a student record, which is a legitimate answer and a useful one. The declaration in a directory record is the vendor's word, not an audit. The 9ine column is the independent one. That gap is the whole reason a vetting step exists.
The six at a glance
| Tool | Best for | Price checked Sept 2026 | Student data | Independent assessment |
|---|---|---|---|---|
| Lightspeed Systems | Seeing what is already in use | No public pricing | Yes, device and web activity | No |
| 9ine | Vendor files and an AI inventory | No public pricing | No, district records only | Yes, its own |
| K12 AI Policy Generator | Drafting the policy | Free | No | No |
| SchoolAI | A monitored student space | Free trial, then no public pricing | Yes, declares FERPA and COPPA | No |
| CustomGPT.ai | Staff answers from your own documents | $99 per month | Yes, per vendor record | No |
| Acuity AutoRedact | Records requests and redaction | Free tier, then £370 per year | No | No |
Prices come from each vendor's own pricing page, checked September 13, 2026. The student data and assessment columns come from the directory record.
Best for seeing what is already in use: Lightspeed Systems
Lightspeed Systems is the best fit for the first job, taking inventory, because it publishes a free AI Usage Audit that reports which AI services are being reached from district networks before you commit to anything (lightspeedsystems.com).
You cannot write a policy about tools you have not counted. Lightspeed runs eight products across filtering, classroom screen monitoring, device management, safety alerting and app analytics, and the vendor says it covers 23 million students across 31,000 schools in 43 countries, including 28 of the 50 largest US districts. Its AI-specific layer is branded AI Guardrails, under a framework the company calls SMART AI.
What sets it apart from a plain web filter is the audit that comes before the block. A filter tells you what you stopped. The audit tells you what was there.
Watch out for: the same power that makes this useful makes it uncomfortable. Screen monitoring and activity alerting are surveillance, and students and families should be told plainly what is watched and when. A district that turns on alerting without a communication plan will spend the spring explaining itself.
Pricing: no public pricing. The site offers a quote and a demo only, checked September 13, 2026 (lightspeedsystems.com).
Safety: the directory record does not state where Lightspeed hosts data, its minimum age, or its FERPA and COPPA positions, and it carries no independent 9ine assessment. The vendor publishes a privacy policy and terms of use. Because this product does collect student device and web activity, the FERPA question here is not whether the vendor is compliant but whether your written agreement puts the vendor under your direct control and bars re-disclosure. That is your contract to get right, not the vendor's badge to display.
Best for vendor files and an AI inventory: 9ine
9ine is the best fit for turning a list of tools into defensible paperwork, because its vendor module includes an AI risk identifier that, in the company's words, "flags which vendors incorporate AI features, identifies the type and categorises the risk" (9ine.com).
The practical value is the library. Rather than starting every assessment from a blank form, a district imports an existing assessment for a tool it already uses and builds its own log around it, with notes, status and approval history. Traffic-light ratings across six dimensions give a board something to look at. Processing operation records capture data transfer locations, personal data categories, sub-processors and security measures, and feed a data protection impact assessment.
Watch out for: the benchmark. 9ine assesses against the UK Department for Education's Generative AI Product Safety Standards. For a US district that is a reasonable proxy and a genuinely rigorous one, but it is not FERPA and it is not your state's student privacy statute. Treat the rating as evidence for your file, not as a substitute for your own legal review.
Pricing: no public pricing. The site invites schools to request assessments already held for the tools they use, checked September 13, 2026 (9ine.com).
Safety: 9ine handles district and vendor records rather than student work. Its directory record leaves hosting location and minimum age unstated. The vendor publishes a privacy policy and terms. Since this is a system of record for compliance evidence, ask where the evidence itself lives before you load three years of assessments into it.
Best for drafting the policy: K12 AI Policy Generator
The K12 AI Policy Generator is the best fit for producing a first policy draft, because it is free and it covers the four areas a state law usually names: permitted and prohibited use, academic integrity, data protection and safeguarding (tool page).
Four states now require a district policy, and each one asks for something slightly different. Maryland makes districts name a coordinator to work with the state. Oklahoma goes furthest: it bars AI tools from being "primarily used for grading, discipline or other high-stakes educational decisions," requires districts to disclose annually to families every AI tool in use and what student data it collects, and lets parents opt a child out with no academic penalty (K-12 Dive). A generic template will not satisfy that. A draft you can argue with in an hour is worth more than a blank page.
Watch out for: a generated policy is a starting point, not a filing. Take it to counsel, to your director of special education, and to the union before it goes near a board packet. And read the Oklahoma-style provisions closely if you are in a disclosure state, because an annual inventory of every AI tool and every data category is an operational commitment, not a paragraph.
Pricing: free, with no paid tier, checked September 13, 2026.
Safety: the tool is built for adults, minimum age 18 and over, collects no student data, and hosts in the United States per its directory record. It carries no independent 9ine assessment. As noted above, it is made by the company behind this directory.
Best for a monitored student space: SchoolAI
SchoolAI is the best fit for districts that want an alternative to a blanket block, because teachers launch a bounded activity, called a Space, and watch student conversations in real time rather than finding out later (schoolai.com). It holds a 4.92 rating from 13 reviews in the directory, the highest review count of any tool in this list.
The distinction matters for the policy you are about to write. A ban removes the risk and the learning together. A monitored space keeps the teacher in the loop, which is what most state guidance actually asks for. Its Scale tier adds student portals, district-level controls and an embedded Canvas integration.
Watch out for: the free tier is a trial, not a free plan. It allows five Space launches per year, which is enough to evaluate and not enough to teach with (schoolai.com). Budget accordingly rather than piloting into a wall in October.
Pricing: free trial with five Space launches per year. Pro and Scale carry no public pricing; the site routes district pricing through a demo. Checked September 13, 2026 (schoolai.com).
Safety: this is the one tool here that holds student conversations, so read it closely. The directory record declares FERPA and COPPA, lists United States hosting, marks GDPR in progress, records that it does collect student data, and states no minimum age. It carries no independent 9ine assessment. The vendor publishes a privacy policy and terms. "No minimum age" is a claim about the product, not permission under COPPA: for students under 13 your district still provides the parental consent, and you still need the written agreement that puts the vendor under your direct control.
Best for staff answers from your own documents: CustomGPT.ai
CustomGPT.ai is the best fit for a staff-facing assistant that will not invent an answer about your own policies, because each agent is trained only on documents you upload, up to 5,000 per agent on the entry plan (customgpt.ai).
Point it at the employee handbook, the technology acceptable use policy, the special education procedures manual and the benefits guide, and the questions that currently reach your help desk get answered at source. This is the unglamorous win on the list. It does not touch instruction, and it takes real work off three offices at once.
Watch out for: the query cap and the missing free tier. The entry plan allows 1,000 queries a month across the whole account, which a district of any size will pass quickly, and the next step up is five times the price. There is no permanent free plan: the seven day trial requires a card and rolls into a paid plan automatically (customgpt.ai).
Pricing: Standard $99 per month, or $89 per month billed annually. Premium $499 per month, or $449 billed annually. Enterprise by quote. Checked September 13, 2026 (customgpt.ai).
Safety: minimum age 18 and over, United States hosting, GDPR declared, FERPA and COPPA marked not applicable because the intended use is adult and document-based. The directory record does record that it collects student data, which sits oddly with an adult-only tool, so scope your agents to staff documents and confirm the position with the vendor before any student-facing pilot. The vendor publishes a privacy policy and terms. It carries no independent 9ine assessment.
Best for records requests and redaction: Acuity AutoRedact
Acuity AutoRedact is the best fit for the paperwork that follows an AI policy, because it redacts documents and blurs faces in video and produces an audit report for each job, and it publishes a free tier of 200 pages so you can test it on a real request (acuityautoredact.com).
Districts underestimate this job. Publish an AI policy, disclose an AI tool inventory, and you generate records requests. Somewhere a person is redacting names from a 400-page export by hand. The vendor says the platform is used by over 150 schools along with local authorities and data protection service providers.
Watch out for: this is a British and European product, built for subject access requests under UK data protection law, and all processing stays inside the United Kingdom and the European Union. For a US district that cuts both ways. The redaction works on any document, but the workflow is shaped around a legal regime that is not yours, and routing student records through EU infrastructure is a conversation to have with counsel first, not after.
Pricing: free for 200 pages with no video. Small £370 per year for 10,000 pages and five videos a month. Large £870 per year. Enterprise £2,250 per year. Checked September 13, 2026 (acuityautoredact.com).
Safety: minimum age 18 and over, European Union hosting, GDPR declared, FERPA and COPPA marked not applicable, and the directory record states it does not collect student data of its own. It carries no independent 9ine assessment. The vendor publishes a privacy policy. Note the obvious tension: a redaction tool processes the very records you are protecting, so the written agreement matters more here than almost anywhere.
The brands your board will ask about
These are not in the directory's administration category, and a technology director still gets asked about them by name.
ChatGPT and Claude both ship education editions with admin consoles and data controls. If your district is choosing a general assistant for staff, this is the real decision, and I compared the free tiers in ChatGPT for Teachers vs Claude for Teachers. Personal accounts on district devices are the thing to shut down first.
MagicSchool and Diffit are teacher-facing content tools. Useful, widely adopted, and not your vetting problem until a teacher uploads a student's work into one. That is a training issue more than a procurement one.
NotebookLM grounds answers in documents you supply, which makes it the closest free substitute for a staff knowledge assistant. Google's data terms differ by account type, so check which edition your staff are actually signed into.
Khanmigo and Quizlet are student-facing study tools. Under a New York or Los Angeles style restriction they are squarely in scope, whatever their educational merit, and any block list that misses them is not doing its job.
Four questions that pick the tool
Work down them in order. The order is the point: each one closes off options, so you stop comparing features that do not matter yet.
1. Does this tool touch a student record? If yes, the tool is a procurement decision and needs a written agreement before a pilot, not after. The US Department of Education's Privacy Technical Assistance Center is blunt about what FERPA's school official exception requires: the vendor must perform a service you would otherwise do with employees, must be under your "direct control with respect to the use and maintenance of education records," and may not re-disclose student information to anyone else without your specific authorization (PTAC vendor guidance). If no, it is a software purchase and you can move faster.
2. Who is the user, and how old are they? A tool with an 18 and over minimum is a staff tool, full stop, whatever a teacher wants to do with it. Under 13 brings COPPA and district-provided parental consent into play. "No minimum age" in a vendor record means the vendor has not set one, not that the law has not.
3. Can you see where the data lives, and did anyone independent check? If a vendor will not state a hosting location in a sales call, that answer is your answer. Only five of the 26 tools in this category carry an independent assessment, so expect to do this work yourself; the directory's security assessments page shows which ones have been through it.
4. Does the tool leave the judgment with a person? Oklahoma has already written this into law for grading, discipline and other high-stakes decisions. Even where your state has not, a tool that recommends and a tool that decides are different purchases and should be treated that way. Outsource the doing. Keep the thinking.
If a tool fails question one, nothing it does in questions two through four rescues it.
What the first thirty days look like
Here is a sequence I would run in a mid-size district, roughly 12,000 students, whose board has just asked for an AI plan. It assumes one technology director, no new budget, and a superintendent who wants something to say in November.
Week one. Count. Run the Lightspeed AI Usage Audit and pull a list of every AI service reached from district networks over the last month. Do not act on it. Just count. Most districts find between 20 and 60 services, and most of that list is teachers solving real problems with tools nobody vetted.
Week two. Sort. Split the list three ways: touches student records, adult use only, and unknown. The unknowns are the work. Open a 9ine vendor file for the ten most used, import any assessment that already exists, and note what is missing. You now have a defensible document instead of a spreadsheet of names.
Week three. Draft. Run the K12 AI Policy Generator against your state's requirement and your own list from week two, so the draft names real tools rather than categories. Send it to counsel, the director of special education, and the union on the same day. Book thirty minutes with the chief academic officer, because the academic integrity section is theirs, not yours.
Week four. Give people somewhere to go. Turn on one approved staff tool and one approved student option, and say so publicly. A CustomGPT.ai agent trained on the employee handbook takes pressure off the help desk immediately. A small SchoolAI pilot in two classrooms gives the board something more useful than a block page when a principal asks what students are allowed to do.
Then tell everyone what you did. A policy nobody has read is a policy nobody follows.
The bottom line
Start with the count, not the policy. Lightspeed Systems tells you what is already happening, 9ine turns that into files you can defend, the K12 AI Policy Generator gets a draft in front of counsel this month, and SchoolAI, CustomGPT.ai and Acuity AutoRedact cover the student, staff and records work that follows. Full records for all six sit in the school administration and safety category, and the rest of the directory is searchable by hosting location, minimum age and whether anyone independent has looked.
The uncomfortable number is still the one above. The tools districts buy centrally are checked independently less often than the ones teachers pick up on their own. Whether that ratio improves depends less on vendors than on how many technology directors, in England as well as in the United States, decline to sign until it does.
CoSN's US State of EdTech 2026 report found that 79 percent of districts now have AI guidelines, up from 57 percent a year earlier, but only 34 percent of those policies address data privacy and personally identifiable information (CoSN). Most districts have written something. Far fewer have written the part that protects them.
Two on this site worth reading next: which AI tools are actually safe for schools for the compliance detail, and how to write an AI policy for schools for the drafting. If you sit in the district office rather than the server room, AI tools for superintendents covers the same season from the other chair.
Dan Fitzpatrick is The AI Educator. He has trained more than 150,000 educators and advises schools, districts and government bodies on AI strategy.
