# FERPA and AI: The School-Official Exception, Vendor Contracts and Agent Access to Student Records

> Higher Education · ibl.ai
> Source: https://ibl.ai/courses/higher-education/ferpa-and-ai-school-official-exception
> Last updated: 2026-11-14

*The School-Official Exception, Vendor Contracts and Agent Access to Student Records*

**A higher education course from ibl.ai (self-paced, 9 to 11 hours, free).** FERPA and AI for privacy officers and registrars: the three school-official conditions in 34 CFR 99.31, the 99.33 use limit, vendor terms and agent access.

- **Price:** Free
- **Format:** Self-paced, online
- **Time:** 9 to 11 hours
- **Pace:** 3 hours per week
- **Level:** Intermediate
- **Language:** English
- **Subject:** Compliance

[Enroll](https://lms.ibl.ai/platform/highereducation/courses/course-v1:highereducation+ferpa-and-ai-school-official-exception+self-paced)

## Course description

FERPA and AI meet at one clause: the school-official exception in 34 CFR 99.31(a)(1)(i)(B), which is the only way an AI vendor can read education records without each student's written consent. This course reads that clause and its companions (the 99.3 definitions, the 99.33 use limit, the 99.7 annual notice) in their own words and applies each to grading assistants, meeting note-takers, advising agents and general chat products. You will decide when a chatbot conversation becomes an education record, test a "de-identified" prompt against the reasonable-person standard, turn the three school-official conditions into contract questions, use 99.33 as the legal hook for a no-training clause, read a vendor's privacy terms against the Department's own checklist, and scope an agent's access to a caller's legitimate educational interest. Why now: the regulation has not changed since 2016, the Department has declined to add federal AI privacy requirements, and in May 2026 its Student Privacy Policy Office asked a major learning-platform vendor for its "AI Usage Policies" by name. The contract and the access design carry the load, and this course teaches both.

### About this course

FERPA and AI meet at one clause: the school-official exception in 34 CFR 99.31(a)(1)(i)(B), which is the only way an AI vendor can read education records without each student's written consent. This course reads that clause and its companions (the 99.3 definitions, the 99.33 use limit, the 99.7 annual notice) in their own words and applies each to grading assistants, meeting note-takers, advising agents and general chat products. You will decide when a chatbot conversation becomes an education record, test a "de-identified" prompt against the reasonable-person standard, turn the three school-official conditions into contract questions, use 99.33 as the legal hook for a no-training clause, read a vendor's privacy terms against the Department's own checklist, and scope an agent's access to a caller's legitimate educational interest. Why now: the regulation has not changed since 2016, the Department has declined to add federal AI privacy requirements, and in May 2026 its Student Privacy Policy Office asked a major learning-platform vendor for its "AI Usage Policies" by name. The contract and the access design carry the load, and this course teaches both.

### What you will be able to do

- Apply the 34 CFR 99.3 definitions of education record and personally identifiable information to an AI interaction and state, with the clause cited, whether a given prompt, transcript or generated note is protected.
- Recite the three conditions of 34 CFR 99.31(a)(1)(i)(B) and, for a named AI tool, identify the contract term or operating fact that makes each condition true or false.
- Use 34 CFR 99.33(a)(2) to draft a use-limitation clause that bars model training, product improvement and any purpose beyond the one for which records were disclosed.
- Review a vendor's terms of service and privacy policy against the Department's Model Terms of Service checklist and classify each finding as acceptable, conditional or disqualifying.
- Design role-scoped access for an AI agent that satisfies the "reasonable methods" requirement of 34 CFR 99.31(a)(1)(ii), and verify it on a sample deployment by reading the audit log.
- Write an institutional AI usage policy for student records organized around the document categories the Department requested from a vendor in May 2026.

### Who this course is for

**Roles:** privacy officers and FERPA compliance officers, registrars and associate registrars, CIOs and information security staff who review AI tools, general counsel and contracts staff, and the functional owners (advising, teaching and learning centers, student affairs) who sponsor an AI tool that will see student records.

**Institutions:** any institution that receives federal education funds and is therefore subject to FERPA: public and private four-year institutions, community colleges, graduate and professional schools, and system offices that sign vendor agreements on behalf of campuses.

**Before you start:** basic familiarity with FERPA (the Department's free "FERPA 101: For Colleges & Universities" module is enough) and with how AI tools are being requested on your campus. No legal or technical training is required. Labs use sample rosters and sample vendor terms, so no live student data is needed.

### Format

- Estimated time: 9 to 11 hours.
- Level: intermediate; practitioner, not a substitute for legal advice.
- Hands-on: two labs (a terms-of-service review agent on a sample AI note-taker's terms; a role-scoped advising agent on a sample roster with an audit-log read) plus four templates you keep: the education-record decision tree, the annual-notice and role matrix, the use-limitation clause set, and the AI usage policy skeleton.
- Structure: 4 sections, each ending in an AI conversation assessment, then a capstone assessment.

Self-paced. Every lesson is taught by an AI tutor that opens with a short story and works through one idea and one question at a time. Each section ends with an AI conversation assessment, and the course closes with a capstone assessment. Section assessments count for 60% and the capstone for 40%; 70% passes. There are no multiple-choice quizzes.

### Currency of this course

Last verified 2026-09-28 (34 CFR Part 99 text checked against the eCFR API as current through 2026-09-24; sections 99.3, 99.31 and 99.33 were last amended 2016-12-08 and no proposed or final change has been published since January 2017; the enforcement picture is moving, so re-check the Student Privacy Policy Office's resources page before each term)

## Outline

### Section 0 · Start here

- 0.1 Orientation

### Section 1 · What FERPA actually says, read for AI

- 1.1 Records, PII and the reasonable-person test
- 1.2 Where the law stands in 2026, and why the contract carries the load
- 1.3 Section 1 assessment

### Section 2 · The school-official exception, clause by clause

- 2.1 The three conditions of 34 CFR 99.31(a)(1)(i)(B)
- 2.2 Legitimate educational interest and the annual notice
- 2.3 Section 2 assessment

### Section 3 · The use limit, the no-training clause and vendor terms

- 3.1 34 CFR 99.33 as the legal hook for no training on student data
- 3.2 Reading vendor terms, and the click-wrap risk
- 3.3 Section 3 assessment

### Section 4 · Agent access to student records: roles, logs and the 2026 enforcement signal

- 4.1 Legitimate educational interest as role-based access for agents
- 4.2 The 2026 enforcement signal, and the documentation it asks for
- 4.3 Section 4 assessment

### Section 5 · Capstone & wrap-up

- 5.1 Capstone
- 5.2 Capstone assessment
- 5.3 Wrap-up

## Instructors

- ibl.ai Higher Education, Course team (ibl.ai)

## More higher education courses

- [ADA Title II Digital Accessibility for Course Content: The 2027 Deadline](https://ibl.ai/courses/higher-education/ada-title-ii-course-accessibility)
- [FERPA Basics for Faculty and Staff](https://ibl.ai/courses/higher-education/ferpa-basics)
- [AI Academic Advising at Scale: Caseload Triage, Proactive Outreach and Human Handoffs](https://ibl.ai/courses/higher-education/ai-academic-advising-caseload-management)
- [AI Agents Inside the Trusted Research Environment: Sandboxed Code Execution on NIH, CUI and DUA-Governed Data](https://ibl.ai/courses/higher-education/ai-agents-trusted-research-environment)