Research Brief · K–12 AI Governance

AI in Schools: Incidents,
Mandates & Solutions

A compiled evidence base covering real-world incidents, state-level policy mandates, and emerging best-practice frameworks — 2024 to 2026.

28+
States with Guidelines
2
Legal Mandates
12%
Students Exposed to Deepfakes
50%
Teachers Got AI PD in 2025
90%
Faculty Use AI Personally
🔴 Key Incidents — Case Studies
Critical
"Pippigate" — AI Sexualized Imagery in Elementary Classroom
California Elementary School · February 2026 · Ages 9–10
▾

What Happened

Fourth graders at Delevan Drive Elementary (Los Angeles) used Adobe Express for Education to create a book cover for Pippi Longstocking. When students prompted the AI to generate "long stockings a red headed girl with braids," the tool produced sexualized imagery of women in lingerie and bikinis.

Impact

  • Parent group "Schools Beyond Screens" urged LA school board to ban the Adobe tool
  • Adobe rolled out fixes within 24 hours but declined to explain pre-deployment vetting
  • California Department of Education accelerated release of revised "Learning with AI" guidelines
  • Catalyst for statewide policy reform

Lessons

Commercial AI tools deployed without age-appropriate safety testing
Majority of CA K-12 students are people of color — bias and safety risks disproportionately affect marginalized groups
Parents lacked clear opt-out mechanisms in district policies
↗ CalMatters — Full Report
Critical
"Einstein" — Academic Dishonesty Tool Marketed to Students
National (US) · February 2026 · K-12 & Higher Ed
▾

What Happened

A startup launched "Einstein," an AI tool explicitly marketed to students as a means of bypassing studying and completing coursework. The site operated for 4 days before receiving cease-and-desist orders from CMG Worldwide (Einstein name/licensing) and Instructure (Canvas LMS owner).

Impact

  • Highlighted commercial incentive to build tools optimized for task completion vs. learning
  • Exposed inadequacy of app store vetting and LMS integration safeguards
  • Universities (including University of Sussex) began monitoring similar tools

Lessons

A market exists for academic dishonesty tools — policy must address vendor accountability explicitly
Platform-level restrictions (LMS, app stores) are reactive, not preventive
Need for explicit prohibition of tools designed to undermine academic integrity
↗ University of Sussex — Spotlight on AI in Education
High
LA Unified AI Tutor — High-Profile Launch, Rapid Failure
Los Angeles Unified School District · June 2024
▾

What Happened

LAUSD superintendent promised "the best AI tutor in the world" then pulled the tool from use weeks later due to performance and safety issues.

Impact

  • Underscored risks of high-profile AI deployments without pilot testing
  • Damaged trust in district technology leadership
  • Became cautionary example for other large districts nationally

Lessons

Pilot testing and phased rollout must precede any public commitment or large-scale deployment
Vendor promises require independent verification before procurement
↗ CalMatters — Botched AI Education Deals
High
San Diego Unified — Board Signs Contract Without Knowing It Included AI Grading
San Diego Unified School District · 2024
▾

What Happened

Majority of San Diego Unified board members signed a curriculum contract without knowing it included an AI grading tool.

Impact

  • Raised governance and transparency concerns at board level
  • Parents and staff were unaware AI was being used in student assessment
  • Highlighted need for procurement vetting processes

Lessons

AI tool disclosure must be explicit in all procurement contracts — not buried in feature lists
Board and staff training on AI implications is critical before any adoption vote
↗ CalMatters — Botched AI Education Deals
Critical
Deepfake NCII — 12% of Students Report Exposure at Their School
National (US) · 2024–25 School Year · All grade levels
▾

What Happened

Center for Democracy & Technology research found:

  • 12% of students reported hearing of deepfake non-consensual intimate imagery (NCII) depicting someone at their school
  • 8% of teachers reported the same

Impact

  • States (California, Ohio, Florida) advancing legislation targeting deepfake creation/distribution by minors
  • Schools updating anti-bullying and harassment policies to address AI-generated content
  • Growing need for student digital literacy on deepfake detection

Lessons

AI-generated harmful content requires explicit policy language — existing harassment policies do not cover it
Student training on deepfake detection and responsible use must be part of the curriculum
Incident classification (P1/P2) must explicitly include NCII scenarios
↗ Center for Democracy & Technology
Critical · 🇪🇸 Spain
Almendralejo — First Deepfake NCII Case Against Minors in Spain
Almendralejo, Badajoz, Extremadura · October 2023 · Ages 11–17
▾

What Happened

26 male students aged 12–14 used the ClothOff app — a freely available "undressing" AI tool — to generate nude deepfake images of 21 female classmates aged 11–17. Students paid €10 for 25 hyper-realistic images. Source photos were taken from victims' public Instagram accounts without consent, then distributed via WhatsApp groups.

Impact

  • 22 criminal complaints filed — the AEPD opened an ex officio investigation
  • First case of AI-generated NCII involving minors in Spain — triggered national legislative debate
  • Exposed a legal gap: generating/sharing deepfake NCII was not yet a specific criminal offence in Spain's Penal Code at the time
  • The case accelerated Spain's development of a legal framework for AI-generated sexual content
  • Question raised at the European Parliament (E-002788/2023)

Lessons

AI "undressing" apps are commercially available, cheap, and require no technical skill — school policy must name them explicitly
Existing harassment and privacy laws did not clearly cover AI-generated NCII — policy must not rely on gaps in national law
Images sourced from students' own social media — digital footprint and privacy education must start early
↗ El Diario — Almendralejo Case Analysis ↗ Euronews Tech Talks — Full Report
Critical · 🇪🇸 Spain
Colegio La Salle (Tenerife) — AI Deepfakes Shared via WhatsApp
Santa Cruz de Tenerife, Canary Islands · February 2024 · Secondary school
▾

What Happened

Two secondary school students at Colegio La Salle San Ildefonso in Tenerife were investigated by the National Police's Minor Crimes Unit (GRUME) for creating and distributing AI-generated nude images of female classmates via WhatsApp groups. Images were discovered on one student's phone on February 21, 2024. At least three students at the school were directly affected, plus additional minors outside the school.

What Made It Worse

  • The mother of one victim publicly denounced the school's failure to activate child protection protocols with adequate diligence
  • The school did not inform affected families promptly — trust breakdown between institution and parents
  • First case in the Canary Islands requiring activation of the regional AI image-manipulation protocol
  • Both students were classified as not criminally liable (inimputables) due to age

Lessons

Institutional response speed matters as much as the incident itself — delayed action becomes a second crisis
Schools must have a clear, written protocol for AI-generated NCII — including who notifies parents, police, and inspectors
WhatsApp group distribution is fast and irreversible — containment response must be immediate
↗ El Diario — La Salle Tenerife Investigation ↗ Diario de Avisos — School Response Criticism
High · 🇪🇸 Spain · GDPR
Universidad Internacional de Valencia — €650,000 AEPD Fine for Mandatory Facial Recognition in Exams
Valencia, Spain · February 2026 · GDPR Art. 9 violation
▾

What Happened

The AEPD (Spain's data protection authority) fined Universidad Internacional de Valencia (VIU) €650,000 for requiring students to use a biometric facial recognition and dual-camera monitoring system to take online exams — with no alternative offered. Students who refused could not sit their exams.

The Fine Breakdown

  • €300,000 — Unlawful processing of biometric data (GDPR Art. 9 — special category data) without a valid legal basis
  • €350,000 — Processing deemed disproportionate and unnecessary under GDPR's data minimization principle

Key Ruling

The AEPD ruled that student "consent" was invalid because refusing meant losing the right to be evaluated — a coerced consent is not freely given under GDPR. No national law in Spain currently authorizes biometric processing for academic exam purposes.

Lessons

AI monitoring tools that process biometric data require explicit legal basis — not just a signed consent form
If a student cannot opt out without losing an educational right, consent is legally invalid under GDPR
Any AI proctoring, attendance, or monitoring tool in a school must be reviewed under GDPR Art. 9 before deployment
EU AI Act (2026) will classify AI systems used for student identity verification as high-risk — DPIA mandatory
↗ AEPD — Official Ruling ↗ Infobae — Full Report
Critical · 🌎 LatAm Regional
Quito School — 700 AI-Generated Sexual Images of 24 Female Students
Private school, Quito, Ecuador · October 2023 · High school
▾

What Happened

Two first-year high school students at a private school in Quito used AI tools to create approximately 700 sexual images and videos of 24 female classmates by manipulating photos taken from school without consent. The material was circulated within the school before victims became aware. Ecuador's Attorney General (Fiscalía General del Estado) opened an investigation for alleged child pornography.

Impact

  • Both students were voluntarily withdrawn from school by their parents before disciplinary action
  • Ecuador's Ministry of Education issued a public statement and opened proceedings
  • The Fiscalía opened a formal criminal investigation for dissemination of child sexual material
  • Prompted academic and media analysis of deepfake culture in Latin American schools

Relevance for Colombia

Colombia enacted Law 2502/2025 — AI-assisted identity manipulation is now a criminal offence under Art. 296 of the Penal Code
The SIC handles personal data violations; schools must have a Data Treatment Policy (Política de Tratamiento de Datos) published online
The Quito pattern is documented in Colombia too — schools need written protocols for AI-generated NCII before an incident, not after
↗ Infobae — Quito School Case ↗ Ecuavisa — Fiscalía Investigation
📋 State Policy Mandates & Deadlines
State Type Deadline Key Requirements
Ohio Legal Mandate July 1, 2026 HB 96: all K-12 public schools must adopt AI policy; model policy provided by DEW
Tennessee Legal Mandate Immediate (2024) Local school boards must implement AI policies for students, faculty, and staff
California Guidance Ongoing "Learning with AI" guidelines; AI working group recommendations by July 2026
Florida Pending July 1, 2026 (if passed) SB 1194: statewide AI standards, monitoring safeguards, proctored assessments, digital literacy Gr 6–12
Virginia Pending TBD Competing bills (SB 394 / HB 1186): pilot program vs. prohibition approach
Washington Guidance Ongoing Human-centered guidance: academic integrity, privacy, safety; AI advisory board + task force
Utah Guidance Ongoing Pre-K–12 framework; AI steering committee; educator summits; AI toolkit with courses
Colorado Guidance Ongoing 2024 Roadmap; 2025 K-12 AI Skills Progression Guide aligned with CS standards
National context: 28+ states have issued AI guidelines as of July 2025. Only Ohio and Tennessee have passed legal mandates. Most policies focus on risk mitigation (privacy, plagiarism) rather than strategic transformation (workforce readiness, pedagogy redesign).
View Full Program Timeline View Risk Register
🟢 Emerging Solutions & Best Practices
Best Practice
Greenville County Schools (SC) — "Traffic Light" AI Policy
Greenville County Schools · South Carolina · February 2026
▾
Green — Encouraged: Research assistance, grammar checking, accessibility tools
Yellow — Conditional: Translation support, accessibility aids — with teacher approval
Red — Prohibited: Assignment completion, exam assistance, undisclosed use

Why It Works

Specificity over blanket prohibitions — teachers and students have clear boundaries
Aligns directly with assessment integrity goals
Easily communicated and enforced at classroom level
↗ Greenville Journal — Full Article
See Governance Template
Best Practice
Washington State University — "AI-Positive" Three-Tier Syllabus Policy
Washington State University · February 2026 · Higher Ed
▾

Three Tiers

AI-Required: Assignments must use AI tools
AI-Assisted: Permitted with disclosure
No-AI: Traditional assessment

Why It Works

Reduces student anxiety by removing ambiguity on a per-assignment basis
Promotes transparent collaboration between students and AI tools
Acknowledges AI as a permanent workforce fixture — prepares students honestly
↗ WSU Insider
State Mandate
Ohio Model Policy — Three-Guardrail Framework (HB 96)
State of Ohio · December 2025 · Deadline: July 1, 2026
▾

Three Guardrails

  • Academic Integrity: Clear boundary between AI-assisted learning and plagiarism
  • Procurement & Privacy: Vetting standards for third-party tools; federal privacy alignment
  • Anti-Bullying: Updated harassment policies for deepfakes and AI-generated harassment

Why It Works

Turnkey solution for resource-constrained districts — no need to build from scratch
Public-private partnership (OhioX, Ohio Chamber, Nationwide, KeyBank, Kroger)
Briefed White House AI Education Task Force — national visibility
↗ Ohio Tech News
See Governance Template See Risk Register
Best Practice
Structural Learning — Six-Component AI Policy Framework
Structural Learning · 2025–2026 · K-12 Implementation
▾

Six Components

  • Define AI in practical terms: learning aids, teaching supports, assessment risks
  • Governance structures: strategic oversight, operational management, subject-specific guidance
  • Assessment integrity: traffic light system, process-focused assessment
  • Data privacy: GDPR/FERPA compliance, vetting protocols
  • Staff training: AI literacy, hands-on experience, peer mentoring
  • Student education: digital citizenship, critical evaluation, integrated across subjects

Implementation Timeline

  • Months 1–2: Senior leadership + department head training
  • Months 3–4: Student guidelines + workshops
  • Month 5: Feedback + refinements
  • Month 6: Full implementation
↗ Structural Learning — Full Article
See Program Phases
Best Practice
ETS Futurenav Adapt — First Standardized AI Assessment for Teachers
Educational Testing Service · February 2026
▾

Structure

Three modules (<30 minutes total):

  • Module 1: Recognize generative AI in educational context
  • Module 2: Navigate technology ethically
  • Module 3: Evaluate AI-based tools; apply in classroom

Why It Matters

46 states use Praxis for teacher certification — ETS sets a national baseline for educator AI fluency
Addresses the professional development gap: only 50% of teachers received AI PD in 2025
Positions AI literacy as a credentialed, verifiable skill — not informal
↗ Education Week
Global
Philippines DepEd — Formal AI Guidelines at National Scale
Philippines Department of Education · March 2026 · 1.05M students
▾

Approach

  • High-risk: Grading, admissions, disciplinary actions → strict human oversight required
  • Low-risk: Grammar correction, IT automation → permitted
  • Student disclosure: Required for responsible, graduated adoption

Scale: Project AGAP.AI

  • 1.05M students · 300K educators · 150K parents
  • 83% of Filipino students already using AI tools before policy

Why It Matters

Southeast Asia early-adopter model — balances open access with safeguards at massive scale
High-risk / low-risk classification is transferable to any K-12 context
↗ CoinGeek
🇺🇸 USA — Country Context

🇺🇸 United States at a Glance

Mandate StatusState-by-state (OH, TN mandated)
Privacy RegimeFERPA · COPPA · State laws
Teacher AI PD (2025)50% (up from 29% in 2024)
InfrastructureHigh — 95%+ connectivity
InvestmentPrivate + state grants
Equity FocusTitle I schools
Key DeadlineOhio HB 96 → July 1, 2026

Policy Adaptation Checklist — USA

  • Reference Ohio HB 96 and Tennessee 2024 mandates
  • FERPA-compliant DPA required for every AI vendor
  • COPPA: no data collection from under-13 without parental consent
  • Title I equity considerations for tool access
  • Parent opt-out mechanism explicitly defined
  • State-specific breach notification timelines (typically 30–60 days)

Key Gaps in US Policy Landscape

  • No federal AI-in-education mandate (state-led only)
  • Inconsistent breach notification timelines across states
  • No standardized pre-deployment vetting framework
  • Parent opt-out absent from most district policies
  • Post-adoption governance undefined in most guidance
GovTech critique (Sari Factor, Imagine Learning): "Most AI guidelines focus on privacy and plagiarism, but not on deeper demands for teaching, learning, and future workforce. Schools are not built to change."
View AI Policy (US Framework)
🇪🇸 Spain — Country Context

🇪🇸 Spain at a Glance

Mandate StatusNational framework (#CompDigEdu)
Privacy RegimeGDPR · LOPDGDD · EU AI Act
Teacher TrainingAmong 7 global framework leaders
Investment€6.5B national (2026–2029)
AI Consent Age14 years (LOPDGDD Art. 7.2)
Breach Notification72 hours → AEPD (GDPR Art. 33)
EU AI ActHigh-risk AI in education → full compliance Aug 2026

Spain-Specific Recommendations

  • Align with #CompDigEdu national competence framework
  • GDPR consent workflows — stricter than FERPA
  • Multilingual support: Spanish + Catalan/Basque/Galician
  • EU AI Act conformity assessment for high-risk tools
  • DPIA required for large-scale student data processing
  • VET (Formación Profesional) inclusion in policy scope

Key Policy Initiatives

  • #CompDigEdu — National educator digital competence framework (2025–)
  • Law 3/2023 — Multiannual AI/algorithm training funding 2026–2029
  • Royal Decree 69/2025 — VET reform + 376K new places with AI integration
  • Aulas ATECA — Applied technology classrooms in secondary schools
  • Ministry Guide on AI — Aligns with EU ethical AI framework (2025)
Regional variation: Autonomous communities (Catalonia, Basque Country, Andalusia) may implement at different speeds. Any policy must account for co-official languages and regional educational authority.
View AI Policy (Spain/EU Framework)
🇨🇴 Colombia — Country Context

🇨🇴 Colombia at a Glance

Mandate StatusDeveloping — MEN guidelines expected 2026
Privacy RegimeLey 1581/2012 · Decreto 1377/2013
Connectivity~70% schools; rural gap significant
AI Consent Age14 years (guardian consent under 14)
Breach Notification15 business days → SIC via RNBD portal
Gini Coefficient~0.52 — equity considerations essential
Private vs. PublicPrivate schools moving faster

Colombia-Specific Recommendations

  • Phased rollout: urban private/charter first, public/rural phase 2
  • Offline-capable tools — account for connectivity gaps
  • Spanish-first: English-dominant AI tools are inadequate
  • SENA alignment for vocational training pathways
  • Data sovereignty: Colombian hosting preferred (Law 1581)
  • Conflict-sensitive content — 8M+ displaced students
  • In-person parent orientation — lower digital literacy

Pilot Readiness by Institution Type

  • 🟢 Private Bilingual (e.g., Gimnasio Moderno) — High readiness
  • 🟢 International Schools (e.g., Andes IS) — High readiness
  • 🟡 Public Charter (Bogotá pilots) — Medium readiness
  • 🟡 Vocational / SENA — Medium-High readiness
  • 🔴 Rural Schools — Low (infrastructure first)
Market opportunity: Colombia is among the top 3 LatAm EdTech markets (with Brazil and Mexico). US time-zone alignment and nearshore growth create demand for AI-prepared graduates.
View AI Policy (Colombia Framework)
🟡 Critical Gaps in Current School AI Policy

1. Risk Mitigation vs. Transformation

Policies address immediate harms but fail to reimagine education for an AI-era workforce. Privacy and plagiarism dominate; workforce readiness is largely absent.

2. Teacher Training Gap

Only 50% of teachers received AI PD in 2025. Policy without funding and training creates informal champions but inconsistent implementation.

3. Parent Opt-Out Absence

Most district policies don't address parental right to refuse AI tools for their children. Trust erodes when agency is absent.

4. Vendor Accountability

No standardized pre-deployment vetting framework. Pippigate, LA Unified, and San Diego all stem from absent procurement safeguards.

5. Post-Adoption Governance

Schools adopt policies but lack infrastructure for ongoing governance: no annual review cycles, no tool re-evaluation cadence, no incident register.

6. OECD Warning — "Mirage of Mastery"

AI can boost short-term task performance while undermining genuine learning. Gains disappear when AI access is removed. Schools need purpose-built, pedagogically grounded tools.

📚 Key References
SourceTopic
CalMatters (Feb 2026)Pippigate — CA Elementary AI Imagery Incident
CalMatters (Aug 2024)Botched AI Education Deals — LAUSD, San Diego
Center for Democracy & TechnologyDeepfakes & State AI Legislation
Ohio Tech NewsOhio HB 96 — Model AI Policy
GovTechAre State Policies Thinking Too Small?
Education WeekETS Futurenav — Teacher AI Readiness Assessment
OECD (Jan 2026)Digital Education Outlook 2026 — Mirage of Mastery
Structural LearningSix-Component AI Policy Framework
Greenville JournalTraffic Light AI Policy
RAND (2024)Teacher & Student AI Usage Polls
Ellucian Survey (Mar 2026)Institutional vs. Individual AI Use — Higher Ed
CoinGeek (Mar 2026)Philippines DepEd AI Guidelines

Research compiled: 2026-03-20 · Owner: EdTech Research Lead · Next update: Quarterly or upon major incident

Research Foundation — 18 Core Papers
New Research Alert — March 2026: Purdue University documents metacognitive laziness — students disengage from deep reasoning when AI does their cognitive work, leading to reading comprehension decline, writing skill atrophy, and critical thinking erosion. Read latest research →
Latest — Sept 2025–Mar 2026

Ultra-Recent AI Literacy Research

7 papers including BREAKING metacognitive laziness findings (Purdue, March 2026), K-12 progression mapping, and large-scale PD validation.

View Latest Research (7 papers) →
GenAI Era — 2024–2025

Post-ChatGPT AI Education Research

6 papers reflecting generative AI realities: GenAI systematic reviews, K-12 ethics education, teacher AI-TPACK PD needs, and AI literacy audit frameworks.

View GenAI Research (6 papers) →
Foundational — 2020–2024

Core Frameworks & Standards

5 foundational papers: Long & Magerko AI competencies, UNESCO teacher framework, EU AI Literacy, ISTE educator standards, and ETS assessment model.

View Foundational Papers (5 papers) →
Togno · K–12 AI Governance Research Brief · Compiled 2026-03-23 · Research Foundation: 18 core papers (5 foundational + 6 GenAI + 7 ultra-recent) · © Togno 2026