FERPA and the Generative AI Question Every University CIO Has Now

FERPA and the Generative AI Question Every University CIO Has Now

If you are a CIO at a research university or a mid-size college right now, you are fielding some version of this question from faculty, provosts, and student affairs teams simultaneously: "Can we use this AI tool with student data?" The answer is not straightforward, and the Department of Education's recent guidance has made it both clearer and more complicated.

The core tension is simple enough to state. Generative AI tools are extraordinarily useful for advising, retention analytics, tutoring, and administrative workflow. They also, by design, ingest data to function. And FERPA, 20 U.S.C. Section 1232g, has governed the privacy of student education records since 1974. The statute was not written with large language models in mind. So everyone is now doing the interpretive work of mapping a 50-year-old privacy framework onto technology that did not exist two years ago.

What the Department of Education Has Actually Said

In May 2023, the Department of Education's Privacy Technical Assistance Center (PTAC) released updated guidance addressing the use of AI and automated decision-making systems in the context of student data. The guidance did not create new rules. It restated existing FERPA principles and applied them to AI use cases. The key points worth internalizing:

• Education records are education records regardless of the technology processing them. If a generative AI tool ingests data that is directly related to a student and maintained by the institution (or a party acting for the institution), that data is an education record under FERPA. The format and the processing method do not change the classification.
• AI vendors are subject to the same FERPA constraints as any other third party. The guidance explicitly states that institutions cannot sidestep FERPA requirements by routing student data through an AI platform.
• Model training on student data is a disclosure. This is the one that catches people off guard. If an institution sends student records to a vendor and that vendor uses the data to train or fine-tune a model, that constitutes a disclosure of education records under FERPA. Full stop.

The Department also reiterated in its October 2023 Executive Order 14110 implementation guidance that institutions bear responsibility for understanding how their vendors process data, including whether data is used for model improvement. "We didn't know the vendor was training on it" is not a defense under FERPA.

The School Official Exception, and Why Everyone Is Leaning on It

FERPA generally requires written consent from the student (or parent, for minors) before disclosing education records. But there is a well-known exception under 34 CFR 99.31(a)(1)(i)(B): the school official exception. An institution can disclose education records without consent to a contractor, consultant, or other party to whom the institution has outsourced institutional services or functions, provided that party meets certain conditions.

Those conditions, per the regulation:

• The party performs an institutional service or function for which the institution would otherwise use employees.
• The party is under the direct control of the institution with respect to the use and maintenance of education records.
• The party uses education records only for the purposes for which the disclosure was made.
• The party complies with the re-disclosure requirements of 34 CFR 99.33.

This is the exception that virtually every university is relying on when it contracts with an AI vendor. And it works, in theory. The problem is the "direct control" requirement and the purpose limitation. When you send student data to a generative AI platform, particularly a cloud-hosted one, how do you demonstrate direct control over what happens to that data inside the model? If the vendor's terms of service reserve the right to use input data for model improvement, you have already violated the purpose limitation.

This is not hypothetical. In early 2024, several institutions paused their rollouts of AI-powered advising tools after discovering that their vendor agreements did not explicitly prohibit model training on student inputs. The contracts referenced FERPA compliance in general terms but did not address the specific mechanics of how the AI processed and retained data.

The Metadata Problem

There is a secondary issue that gets less attention but matters a great deal. Even when institutions de-identify student data before sending it to an AI tool, FERPA's de-identification standard under 34 CFR 99.31(b) requires that the institution make a reasonable determination that the student's identity is not personally identifiable. With generative AI, the risk of re-identification through inference is materially higher than with traditional analytics. A model that knows a student's major, GPA range, course load, and extracurricular involvement at a small liberal arts college may not need a name or ID number to effectively identify that student. The PTAC guidance flags this risk explicitly.

What Institutions Should Be Doing Right Now

Based on the current regulatory posture, there are a few concrete steps that reduce FERPA exposure when deploying generative AI:

• Audit your vendor agreements for model training clauses. If the agreement does not explicitly prohibit the vendor from using education records (including prompts, queries, and outputs) for model training or improvement, you have a gap. Negotiate a data processing addendum that addresses this specifically.
• Map your data flows before deployment. Understand exactly which data elements are being sent to the AI tool, where they are processed, whether they are stored, and for how long. This sounds basic, but a surprising number of institutions have deployed AI tools through departmental purchases without centralized data flow mapping.
• Revisit your annual FERPA notification. Under 34 CFR 99.7, institutions must notify students annually of their FERPA rights, including the criteria for designating school officials. If you are expanding the school official exception to cover AI vendors, your notification should reflect that. The Department has indicated it views outdated notifications as a compliance deficiency.
• Establish a review process for AI tools that is separate from general IT procurement. FERPA compliance review for an AI tool requires different questions than a standard SaaS security review. You need to evaluate not just where data goes, but what the model does with it computationally.

It is also worth noting that FERPA enforcement, while historically light, is shifting. The Student Privacy Policy Office (SPPO) has increased its investigative activity in recent years. A 2023 complaint resolution involving the University of California system addressed data sharing with a third-party analytics provider and resulted in a detailed corrective action plan. The financial risk under FERPA is the potential loss of all federal funding, which for most institutions means billions of dollars. No fine schedule exists because the penalty structure is existential by design.

How FirmAdapt Addresses This

FirmAdapt's architecture was built for exactly this kind of problem: deploying AI capabilities within a regulated environment where data governance is non-negotiable. The platform processes data within compliance boundaries that can be configured to enforce FERPA's purpose limitation and direct control requirements. Student education records processed through FirmAdapt are not used for model training, are not retained beyond the defined processing purpose, and are subject to auditable data flow controls that map to the specific requirements of 34 CFR 99.31(a)(1)(i)(B).

For institutions that need generative AI functionality but cannot accept the compliance uncertainty of general-purpose AI platforms, FirmAdapt provides a deployment model where the FERPA analysis has already been built into the infrastructure. The data flow documentation, retention controls, and re-disclosure restrictions are architectural features, not contractual afterthoughts.