# FERPA-Compliant AI: Deploying Agents on Student Data

> Higher Education · ibl.ai
> Source: https://ibl.ai/courses/higher-education/he1
> Last updated: 2026-11-14

*Run AI agents against your SIS and LMS without a vendor ever seeing a student record - the school official exception, vendor DPAs, and the architecture FERPA implies.*

**A higher education course from ibl.ai (free).** FERPA does not ban AI on student records - it governs who may see them. ibl.ai runs advising and enrollment agents against your SIS and LMS under the school official exception, self-hosted inside your own perimeter, where you own all the code and the data. No third-party vendor ever receives an education record, so the disclosure question never arises.

- **Price:** Free
- **Format:** Online
- **Language:** English
- **Subject:** Higher Education

[Enroll](https://lms.ibl.ai/platform/highereducation/courses/course-v1:highereducation+HE1+2026)

## Course description

FERPA is the first question every campus AI project runs into and the one most vendors answer badly. This course works through what the statute actually regulates, why ‘the vendor is SOC 2 certified’ answers a different question entirely, and how the deployment architecture you choose either creates a disclosure problem or removes it. It ends with a working advising agent that answers from the SIS without exporting a single record.

### About This Course

  
FERPA is the first question every campus AI project runs into and the one most vendors answer badly. This course works through what the statute actually regulates, why ‘the vendor is SOC 2 certified’ answers a different question entirely, and how the deployment architecture you choose either creates a disclosure problem or removes it. It ends with a working advising agent that answers from the SIS without exporting a single record.

**Level:** Foundational. **Duration:** 6 hours across 8 modules. **Format:** cohort workshop or self-paced, with a hands-on lab. **Frameworks covered:** FERPA, 34 CFR Part 99, NIST AI RMF.

**Who it is for:** registrars and student records staff; CIOs, CTOs and IT directors evaluating AI vendors; general counsel and privacy officers; provosts and deans sponsoring an AI initiative.

**By the end you will be able to:** classify any campus data set as an education record, directory information, or out of scope; apply the school official exception to a specific vendor arrangement and defend the reasoning; read an AI vendor DPA and identify the four clauses that decide FERPA exposure; trace where student data physically travels in a hosted, VPC and on-premise deployment; and assemble the audit evidence a regional accreditor or OCR complaint would require.

**Capstone:** a FERPA readiness review for one live AI use case at your own institution - a document a general counsel could sign and an accreditor could inspect.

This course frames legal analysis; it is not legal advice. Every module names the point at which institutional counsel must decide.

  
### Requirements

  

- Working familiarity with your institution’s SIS and LMS
- No legal or technical background required

  
### Course Staff

  
    
      
    

    
#### Staff Member #1

    
Biography of instructor/staff member #1

  

  
    
### Frequently Asked Questions

    
      
#### What web browser should I use?

      
The Open edX platform works best with current versions of Chrome, Edge, Firefox, or Safari.

## Outline

### Course Introduction

- Course Introduction

### Unit 1: What FERPA Actually Governs

- Module 1.1: What actually counts as an education record?
- Module 1.2: How does the school official exception decide your architecture?

### Unit 2: Evaluating the Vendor

- Module 2.1: Why doesn't a SOC 2 certificate answer the FERPA question?
- Module 2.2: How do you read an AI vendor's data processing agreement?

### Unit 3: Where the Data Goes

- Module 3.1: Where does student data physically go in each deployment model?

### Unit 4: Proving It, and Surviving Failure

- Module 4.1: What audit evidence proves compliance to an accreditor?
- Module 4.2: What do you do when an agent surfaces the wrong student's record?

### Unit 5: Building the Agent

- Module 5.1: Building an advising agent that never exports a record

### Unit 6: The Capstone

- Module 6.1: FERPA Readiness Review for One Live AI Use Case

### Unit 7: Course Conclusion

- Conclusion

## More higher education courses

- [ADA Title II Digital Accessibility for Course Content: The 2027 Deadline](https://ibl.ai/courses/higher-education/ada-title-ii-course-accessibility)
- [AI Academic Advising at Scale: Caseload Triage, Proactive Outreach and Human Handoffs](https://ibl.ai/courses/higher-education/ai-academic-advising-caseload-management)
- [AI Agents Inside the Trusted Research Environment: Sandboxed Code Execution on NIH, CUI and DUA-Governed Data](https://ibl.ai/courses/higher-education/ai-agents-trusted-research-environment)
- [AI for the Accreditation Self-Study: Evidence Inventories, Assurance Arguments and Compliance Certifications](https://ibl.ai/courses/higher-education/ai-accreditation-self-study)