--- title: "FERPA Governs Data, Not Which Model Reasons About It" slug: "ferpa-model-provenance-k12-gap" author: "Mikel Amigot" date: "2026-08-17 16:00:00" category: "Premium" topics: "ferpa, k-12 ai, student data privacy, open source models, model provenance, edtech procurement, self-hosted ai, school district ai" summary: "Alibaba's Qwen crossed 3 billion downloads to become the most-downloaded open model family, and open weights now sit under products of every origin. FERPA regulates who may access an education record — it says nothing about which model processes it or where inference runs, and that gap has to be closed in the contract." banner: "" thumbnail: "" linkedin: | Alibaba's Qwen just crossed 3 billion downloads in six months — passing Meta and Google to become the world's most-downloaded open model family. Over 460 open models released, 300,000+ derivatives in the ecosystem. That is a genuine achievement in open research, and it is also a procurement fact most K-12 districts have not absorbed. Open weights mean any vendor can build on any model family. The AI tutor a district licensed last spring may be running an open model fine-tuned by a third party, served from a cloud region nobody specified in the contract. There is often no product surface that tells you. Here is the gap worth understanding. FERPA governs education records: who may access them, what counts as disclosure, when consent is required, and the school-official exception that lets a vendor process them. It is a strong law and it is doing its job. It says nothing about model provenance. Nothing about which country's research lab produced the weights, nothing about which jurisdiction the inference runs in, nothing about what a model's training data contained. That is not a flaw in FERPA. It was written for records, and a model is not a record. But it means "we're FERPA compliant" answers a narrower question than most boards think they asked. Districts that want the answer have to write it into the contract themselves: name the model and version, name the inference location, require notice before either changes. Or remove the question — run the model inside district infrastructure, where the answer is whatever you deployed. #iblai #K12 #FERPA #StudentDataPrivacy #EdTech #AIGovernance --- ## The Short Answer **FERPA regulates who may access a student education record and under what conditions. It says nothing about which model processes that record, who trained it, or which jurisdiction the inference runs in — so "FERPA compliant" does not answer the model-provenance question at all. Districts close that gap in the contract, or by removing it: on ibl.ai you own all the code and the data, self-hosted, model-agnostic.** The compliance answer and the architecture answer are different answers to different questions. ## What does Qwen passing 3 billion downloads mean for schools? That open weights are now the substrate under a large share of products, including ones that never mention it. [Alibaba's Qwen family crossed 3 billion downloads in six months](https://fortune.com/2026/08/15/alibaba-qwen-open-ai-models-3-billion-downloads-meta-google/), overtaking Meta and Google to become the most-downloaded open model family. The scale of the surrounding ecosystem is the operative detail: Alibaba has released more than 460 open models, and the ecosystem has produced over 300,000 derivative models. By comparison, Google recorded roughly 418 million downloads across 2026 and Meta 227 million. A derivative model is where provenance gets genuinely hard to trace. A vendor can fine-tune an open model, rename it, and ship it inside a tutoring product with no obligation to disclose the base. This is not an argument against open models. Open weights are the reason a district can self-host at all — the alternative is renting a closed API, which is worse on every axis discussed here. It is an argument that "which model is under this product" has become a question a district must ask explicitly, because the market will not volunteer it. ## Does FERPA say anything about which model processes student data? No. FERPA governs education records — who may access personally identifiable information from them, what constitutes disclosure, when written consent is required, and the school-official exception under which a vendor may process records on the district's behalf. Under that exception the vendor must be under the district's direct control with respect to the records, use them only for the authorized purpose, and not redisclose them. Those are real obligations and they do useful work. None of them is a statement about model provenance. FERPA does not require disclosure of which model performs the processing, which organization produced its weights, what its training corpus contained, or which country the inference executes in. That is not a defect in the statute. FERPA was written for records and access to them, and a model is not a record. But it means a vendor can answer "yes, we are FERPA compliant" truthfully while every provenance question remains open. State student-privacy laws and district data-governance policies can go further, and some do. The point is that the federal floor does not, so a district relying on FERPA alone has not asked the question it thinks it asked. ## How can a district find out which model powers its AI tutor? By requiring it in writing, because there is usually no product surface that reveals it. Ask for four specifics, and treat vagueness on any of them as the answer: 1. **Named model and version.** "A leading large language model" is not an answer. "Qwen 3, version X, fine-tuned by us" is. 2. **Inference location.** The cloud region and legal jurisdiction where student prompts are processed, not the vendor's headquarters. 3. **Subprocessor list with change notice.** Every party that touches student data, and a contractual commitment to notify before it changes. 4. **Retention and training use.** Whether prompts or outputs are retained, and whether they are used to improve any model. The reason this matters operationally is that models change under products silently. A vendor that switches its base model mid-year has changed what processes student records without triggering any FERPA event. ## What should a K-12 district require in an AI contract? Contract terms that survive the vendor changing their mind: - **Model pinning with notice.** The named model and version may not change without advance written notice and a district right to review. - **Data residency, stated as a location.** Not "in compliance with applicable law" but a named region, with a prohibition on processing elsewhere. - **No training on student data**, stated as an affirmative prohibition rather than a policy link that the vendor can revise. - **Audit access.** The district can obtain records of what the system did with a given student's data, on district timelines. - **Exit terms.** Data returned in a usable format, and deletion certified, within a fixed window. The cost question runs alongside these, because per-seat licensing prices the student roster rather than the usage — the arithmetic is in [AI cost math for K-12 districts](/blog/ai-cost-math-for-k12-districts-per-seat-vs-usage). ## Can a district remove the provenance question entirely? Yes, by changing where inference happens rather than by asking better questions about someone else's infrastructure. When the platform runs inside district-controlled infrastructure, the model in use is whichever model the district deployed. Provenance is not a disclosure to request; it is a configuration to read. Student data does not leave the district's perimeter, so the subprocessor chain that FERPA's school-official exception is designed to constrain has one fewer link in it — or none. Model-agnostic routing then means the district can run an open model, a commercial model through a private deployment, or swap between them, without renegotiating who processes student records. ## Where ibl.ai fits ibl.ai is the agentic AI platform where **you own all the code and the data**. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with **no per-seat pricing** — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped. For a district that means student records stay inside district infrastructure, the model in use is the one you chose, and cost tracks actual usage rather than enrollment. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on. *Related: [Open-Source AI Models and K-12 Data Privacy](/blog/open-source-ai-models-k12-data-privacy-2026) · [The Student Data Problem With AI Vendors in K-12](/blog/student-data-problem-ai-vendors-k12) · [AI Cost Math for K-12 Districts](/blog/ai-cost-math-for-k12-districts-per-seat-vs-usage)* ## Why does owning the AI stack matter? **ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.** - **You own all the code and the data.** Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours. - **Model-agnostic.** Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform. - **No per-seat pricing.** Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ. - **Deploy anywhere.** Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.