Adoption outran governance
More than half of students and teachers are using AI for schoolwork (S15) while only about a third of district leaders say their schools provide any training on it (S16), and fewer than one in three districts have published anything resembling strategic AI governance (S17).
The attack surface moved from the district to the vendor
Vendor related incidents went from four percent of K-12 cybersecurity incidents to 32 percent in two years (S3). One compromised credential at one vendor exposed 62 million student records (S8). The average district touches nearly three thousand tools a year (S1). Districts are being asked to secure a perimeter that no longer sits inside their walls.
Districts know it and cannot act on it
Four in five say AI is increasing their cyber risk (S5), while only 11 percent have any formal process to vet AI use in the tools they already run (S4). Two thirds cite budget as the binding constraint and half cite a shortage of expertise (S13). This is a mechanism problem rather than a will problem.
A governance layer is the mechanism
Every request for student data, from a person or an agent, passes one gate that knows who is asking, what they are entitled to, and what the family consented to, and records the answer.