Learning Management Systems With AI and the Vendor Due Diligence Update

Learning Management Systems With AI and the Vendor Due Diligence Update

Every major LMS vendor shipped AI features in 2023 and 2024. Canvas added AI-assisted rubric generation and a student-facing chatbot. Blackboard (now under Anthology) rolled out AI-powered course design tools and predictive analytics. Moodle integrated an AI subsystem that supports content generation, question creation, and text summarization. These features are genuinely useful. They also create FERPA problems that most institutional due diligence questionnaires haven't caught up with yet.

The core issue is straightforward: AI features in LMS platforms process student education records. Under FERPA (20 U.S.C. 1232g), education records include virtually any information directly related to a student that is maintained by the institution or a party acting for the institution. When a student interacts with an AI chatbot inside Canvas, that interaction likely constitutes an education record. When Blackboard's predictive analytics engine ingests grades, assignment submissions, login frequency, and engagement metrics to flag at-risk students, it is processing education records at scale. The question for your IT and compliance teams is whether your existing vendor agreements and due diligence processes actually account for this.

What Changed With AI Features

Traditional LMS deployments were relatively clean from a FERPA perspective. The institution controlled the data. The vendor hosted it. You had a standard school official exception under 34 CFR 99.31(a)(1)(i)(B), documented in your contract, and the vendor agreed to use the data only for the purposes for which it was disclosed. Simple enough.

AI features complicate this in a few specific ways:

• Training data flows. Does the vendor use student interaction data to train or fine-tune its AI models? If so, that data is flowing beyond the scope of the original disclosure purpose. Instructure (Canvas's parent company) has stated that customer data is not used to train its AI models, but the specifics of what counts as "customer data" versus "usage telemetry" versus "anonymized interaction logs" matter enormously. You need contractual language that is precise about this, not just a FAQ answer.
• Third-party AI subprocessors. Several LMS vendors are integrating AI capabilities through partnerships with OpenAI, Anthropic, or other foundation model providers. When a student's essay gets sent to an external API for AI-powered feedback, that student's education record just left your vendor's environment and entered a subprocessor's environment. Your FERPA compliance chain now extends one more link. The Department of Education's 2011 guidance on outsourcing institutional functions (the "school official" guidance) requires that the party receiving the data be under the direct control of the institution with respect to the use and maintenance of education records. Can you demonstrate that control over a foundation model API?
• Predictive analytics and profiling. Blackboard's retention and engagement analytics create derived data about students. Is a "risk score" an education record? Almost certainly yes, if it is maintained by the institution or its agent and is directly related to a student. Parents and eligible students have a right to inspect and review education records under FERPA. Can a student request to see their AI-generated risk profile? Can they challenge it? Your vendor agreement should address this.

The Due Diligence Questions You Should Be Asking

If your institution last updated its LMS vendor due diligence questionnaire before 2023, it probably doesn't cover AI-specific data flows. Here is what should be on the list now:

• Model training: Does any student data, including interaction logs, prompt/response pairs, or behavioral data, get used to train, fine-tune, or improve AI models? If the vendor claims anonymization, what specific technique is used, and has it been validated against re-identification risk?
• Subprocessor disclosure: Which third-party AI providers receive student data? What are the contractual terms between your LMS vendor and those subprocessors regarding data retention, use limitations, and deletion?
• Data residency: Where is AI processing happening? This matters for institutions subject to state-level student privacy laws (like California's SOPIPA or Illinois's ISSPA) in addition to FERPA.
• Record access and correction: Can the institution access, export, and correct AI-generated records about students? If the system generates a predictive score or behavioral profile, is it surfaced in a way that satisfies FERPA's inspection and review requirements?
• Opt-out mechanisms: Can students or the institution disable AI features selectively? What happens to data already processed by AI features if the institution later decides to turn them off?
• Incident response: If an AI subprocessor experiences a breach involving student data, what is the notification timeline? The vendor's breach notification obligations should explicitly cover AI subprocessor incidents.
• Audit rights: Does your agreement give you the right to audit or obtain audit reports (SOC 2, for example) covering the AI components specifically, not just the legacy LMS infrastructure?

Vendor-Specific Notes

A few things worth flagging on the major platforms as of early 2025:

Canvas (Instructure): Instructure was acquired by Thoma Bravo in 2020 for $2 billion and has been investing heavily in AI. Their AI assistant features are increasingly integrated rather than optional add-ons. Instructure published an AI data use policy, but institutions should push for contractual commitments rather than relying on published policies that can change with a website update.

Blackboard/Anthology: The 2022 merger of Blackboard and Anthology created a combined entity with a large product surface area. Their Illuminate Analytics and Predict tools are AI-heavy. The challenge here is that the merger consolidated multiple legacy platforms with different data handling architectures. Ask specifically about which backend systems process data for AI features and whether the data governance framework is unified across the combined product suite.

Moodle: Moodle's open-source model creates a different risk profile. The AI subsystem (introduced in Moodle 4.x) allows institutions to plug in different AI providers. This is flexible but puts more responsibility on the institution to vet each AI provider connection. If your Moodle instance is self-hosted, you have more control. If you are using a Moodle partner for hosting, the due diligence questions above apply to both the hosting partner and whatever AI backends are configured.

The Enforcement Landscape

The Department of Education's Student Privacy Policy Office (SPPO) has not yet brought a high-profile enforcement action specifically targeting AI features in LMS platforms. But the groundwork is there. The SPPO issued notes in 2023 reinforcing that technology vendors operating as school officials must comply with FERPA's use and redisclosure limitations. The FTC has also been active on AI and data practices more broadly; its 2023 enforcement actions against companies like Rite Aid (for AI-powered facial recognition with inadequate safeguards) signal a willingness to go after AI systems that process sensitive data without appropriate controls. The $650,000 settlement with Edmodo in 2023 by the FTC, while focused on COPPA rather than FERPA, involved an ed-tech platform and should be read as a warning about the regulatory direction.

State attorneys general are also increasingly active. New York's Education Law 2-d and its implementing regulations impose vendor requirements that go beyond FERPA, including data security and privacy plans that must be publicly available. If your institution operates in multiple states, the patchwork of state student privacy laws adds another layer to vendor due diligence.

How FirmAdapt Addresses This

FirmAdapt's platform is built to map vendor data flows against specific regulatory requirements, including FERPA, state student privacy laws, and institutional policies. For institutions evaluating AI features in LMS platforms, FirmAdapt can model the data processing chain from student interaction through AI subprocessors and flag gaps between your contractual commitments and the actual data flows described in vendor documentation.

Because FirmAdapt's own AI architecture is compliance-first, it processes institutional data within defined boundaries and does not use customer data for model training. This means you can use FirmAdapt to assess your LMS vendor's AI practices without creating the same category of risk you are trying to evaluate. The platform supports ongoing monitoring, so when vendors update their AI features or subprocessor relationships, your due diligence stays current rather than becoming a point-in-time snapshot that ages out within a quarter.