A Teachers’ Union Banned AI Companions in Schools

On September 9, 2026, in New York, Randi Weingarten of the American Federation of Teachers and Michael Mulgrew of the United Federation of Teachers sat down with Brad Smith, Microsoft’s vice chair and president, and announced what they called a National AI Safety & Privacy Standard for schools. The document is thirty-one pages long. It bans training AI models on student data — retroactively, with no de-identification loophole. It prohibits companion-style features designed to make children emotionally attached to a chatbot. It requires that agentic features be off by default for students. And it can be dropped into any U.S. school district’s Microsoft contract and enforced in court.

Here is the part that should make every founder in this industry uncomfortable: the union wrote it. Not the Department of Education. Not a standards body. Not a safety institute. A labor union with 1.875 million members and a president who had spent months publicly demanding that someone — anyone — put guardrails on classroom AI. When nobody did, she went and found a vendor willing to sign her paper.

Every other AI company selling into American classrooms is now standing outside a room that has already been wired.

What Actually Got Banned

The standard is not a press release with principles attached. It is a memorandum of agreement with a defined breach process, a cure period, a revocation mechanism, and a public trust page requirement. Read the actual text, not the summary, because the specifics are where vendors will get caught.

Principle 1 is the one that will cost the most money. No covered data — prompts, responses, uploaded files, behavioral signals, metadata, “or any derivative thereof” — may be used to train, fine-tune, update, benchmark, or otherwise improve any AI model, at any time, for any purpose. The document anticipates the obvious evasion. De-identification is not a loophole, and covered data may not be used as source material for synthetic data generation. The prohibition also applies retroactively: data collected before the agreement cannot be fed to a model afterwards.

Principle 3 goes after surveillance. Prohibited without explicit written approval from the district: precise geolocation tracking or continuous location monitoring; behavioral tracking, keystroke logging, or continuous passive attention monitoring; long-term profiling of students or educators; and biometric data collection of any kind, including facial recognition, voice prints, gaze tracking, and emotional inference.

Principle 4 is where the product teams will feel it hardest. The AI provider may not give district users companion-style or relationship-oriented features “designed to foster emotional attachment or dependency, to keep students engaged for longer than the learning task requires, simulate friendship, or encourage disclosure of sensitive information.” That single sentence outlaws an entire product category — the always-there study buddy, the encouraging tutor that asks how you’re feeling, the assistant engineered for daily return visits.

And the agentic clause is written like someone who has watched an agent run unsupervised. Any capability that sends messages, submits work, changes settings, accesses third-party systems, or makes purchases on behalf of a user must be disableable for students. Externally consequential agentic features are off by default at the tenant level unless a district administrator affirmatively turns them on, with scoped permissions, human oversight, and complete audit logging.

The AFT and Microsoft signed a 31-page national school AI standard on September 9, 2026 — a union-negotiated rule that bans student-data training and AI companions in classrooms.

Why a Union Had to Write It

The AFT’s own framing is blunt. The agreement was reached, in the union’s words, “in the absence of any meaningful federal and state rules governing artificial intelligence in schools.” Weingarten did not pretend this was a partnership story. “We can get angrier and angrier, or we can act decisively,” she said. “Anything less than legally enforceable provisions is simply a wish list.”

That line explains the entire strategy. A union cannot pass a federal statute. It can, however, negotiate a contract — and a contract is enforceable in a way that a voluntary framework is not. The standard was written to be bolted onto a district’s Microsoft customer agreement, which converts a set of principles into a breach claim with remedies attached.

Her escalation ladder had been running for months. In a May 2026 speech titled “Devices Down, Eyes Up, Hands-On,” Weingarten called for a total screen ban from kindergarten through second grade, a ban on student-facing AI in elementary school, and a ban on social companion chatbots for anyone under sixteen. Variants of that framework were then adopted by Los Angeles Unified School District, by New York State United Teachers, and — last week — by New York City Public Schools under Mayor Zohran Mamdani, which banned screens and AI use in the younger years entirely.

So the timeline matters. New York City banned the technology. Then the union negotiated a standard for the technology that survived the ban. Both things are happening at once, in the same city, in the same news cycle — which is exactly the kind of contradiction that gets buried when a story is told as “company does good thing.”

The standard’s third principle bans AI companion chatbots on school devices outright — no emotional-support personas, no ‘friendly tutor’ character, no exception carved out for already-deployed products.

What Microsoft Signed, and What It Gave Away

Brad Smith’s statement was short and unhedged: “This standard sets a high bar for child privacy and AI safety, and we’ll extend this agreement to every school district across the country.”

Read what that pledge means structurally. Microsoft’s education business is not a charity. It sells licensing into districts that run Windows, Entra, and Microsoft 365 — and Copilot, and Microsoft 365 Copilot, and a product called Teach that is purpose-built for lesson planning. It is also, per its own education blog, a company that can point to Miami Dade College reporting a 15% increase in student pass rates after deploying Copilot, and Brisbane Catholic Education reporting a 275% increase in learner agency among at-risk cohorts.

Microsoft just agreed to a set of terms on a product line it is actively trying to grow. That is either an extraordinary act of corporate conscience or a competitive move so obvious it is almost rude — and the honest answer is that it is both, which is why it works.

Because here is the arithmetic the standard creates. A district in Ohio comparing vendors now has a document it can hand to every one of them. Match this, or explain why you won’t. The cost of matching is not a policy update; it is an engineering roadmap. If your model was trained on user prompts, you cannot un-train it. If your product’s retention loop depends on a child feeling a bond with an avatar, you cannot un-design it in a quarter. If you cannot produce the transparency artifacts the standard requires — a plain-language document explaining how outputs are generated, a summary of training data, known failure modes, fairness testing results across diverse education populations, updated whenever the product changes substantially — you cannot sign.

The Side-by-Side: What the Standard Demands vs. What Most Vendors Sell

The gap is not philosophical. It is itemized. Below is the comparison a district procurement officer is now running, whether or not any vendor has noticed.

Two rows in that table decide most of the deals. The design row kills the consumer-social playbook that got imported into education. The enforcement row kills the liability posture that made it possible.

The Teeth Are in the Cure Period

Anyone who has read a vendor agreement knows where accountability usually dies: in a phrase like “commercially reasonable efforts.” This document is built differently, and the mechanism deserves to be quoted rather than summarized.

Once the protections are written into a district’s agreement, the district holds the contractual remedies available under that agreement, “including, without limitation, the right to terminate for an uncured material breach and to seek damages or other remedies available under its agreement or applicable law.” A district can also end agreements and pursue damages against vendors that break the rules — Mulgrew’s phrasing, and he leads a 200,000-member affiliate, so he knows what a contract clause is worth.

For the Academy itself, failure to provide a required transparency artifact or evaluation item is explicitly defined as a material breach and grounds to pause or deny deployment. If a breach is not cured, the Academy and AFT may revoke the vendor’s participation and announce it publicly. The vendor must then immediately stop representing that it participates — and must record the termination on its own trust page.

There is a fairness provision, and it is a real one: if the vendor has begun remediation and is diligently pursuing it, revocation cannot happen solely because the fix isn’t finished. Disputed breaches escalate to senior representatives for good-faith consultation before anything is revoked. That is not a loophole; it is what makes the document survive contact with a law firm. A standard that could be weaponized on day one would never have been signed on day one.

But note the asymmetry that survives all of that. The vendor must defend the Academy and AFT against third-party claims arising from use of the product, and pay damages awarded in a final judgment. The vendor carries the indemnity. The district gets the protection. That is the correct direction of risk transfer, and it is the opposite of how most education software contracts are written.

What This Does to Every Other Vendor in the Room

There are roughly 13,000 school districts in the United States, and almost none of them have a dedicated AI governance function. They have a procurement office, a technology director, and a legal counsel who is already overloaded. Until September, that director’s only option when a vendor pitched an AI tutor was to read a forty-page terms-of-service document or take the sales rep’s word for it.

Now there is a document. Thirty-one pages, ten principles, a defined breach process, and a vendor who already signed it. The district doesn’t need to write a standard. It needs to ask one question: will you meet this one?

That is a genuinely new kind of competitive pressure in education technology, and it is worth being precise about why it works. It doesn’t regulate the industry. It gives the buyer a benchmark and lets the market do the regulating. A vendor that refuses isn’t breaking a law — it is declining a term that a competitor already accepted, in writing, on a public trust page, in front of a union with 1.875 million members and a press operation.

Expect three responses. One group signs and re-engineers, at real cost, because schools are a durable market and the alternative is losing them. One group signs the principles and quietly hopes nobody audits the design row. And one group retreats to consumer and higher-education markets, where the standard doesn’t reach — which is, incidentally, exactly where the least protected users are.

The Honest Counter-Argument

Two objections are worth taking seriously, because both are true.

The first is that this covers Microsoft Education products, not the entire market. The definitions in the document are careful: general-purpose productivity, collaboration, search, cloud, and workplace-assistance products are excluded, even when a school licenses them. A district can adopt the standard for its AI tutor and still run an ungoverned general-purpose chatbot in the same building. The scope is real, and the scope is narrow.

The second is that a voluntary contract is not a regulation. Districts opt in. Vendors who never sell to a district that asks are unaffected. Nothing here stops a company from shipping an emotionally bonding chatbot to children outside a school contract, and nothing here has the force of law over an industry that has spent two years arguing it should be trusted to police itself.

Both objections are correct — and both miss what changed. Weingarten’s own line answers it: “HIPAA and FERPA never envisioned the advent of AI.” Those statutes were written for a world of paper records and medical charts. They do not contemplate a model trained on a nine-year-old’s homework prompts. Into that vacuum, the union put a contract. In American education, the contract is the instrument that actually moves.

What Weingarten Wants Next, and Who Should Be Nervous

Smith’s commitment — “we’ll extend this agreement to every school district across the country” — is the part with the longest shadow. It converts a New York announcement into a national procurement template, and it puts a clock on every competitor’s roadmap in a way that no hearing on Capitol Hill has managed.

The union is not finished either. The AFT has already built the National Academy for AI Instruction, launched to train educators on the use and misuse of these tools, and it published “Commonsense Guardrails for Using Advanced Technology in Schools” in 2024 as the precursor document. The standard is the third step in a sequence: principles, then training infrastructure, then an enforceable contract. That is not an advocacy campaign. That is a campaign that has been running the ball down the field for two years while the industry wrote blog posts about responsible innovation.

For anyone building in this space, the strategic read is uncomfortable but simple. The rules for the education market were written by the customer’s most organized stakeholder, and the largest vendor in the world signed first. The rest of the field is now negotiating from behind, against a document it had no hand in drafting, with a union that has already demonstrated it will go district by district if it has to.

That is what accountability looks like when the people who bear the risk get to write the terms. It happened in schools first. There is no obvious reason it stops there.

The 31-page agreement moves liability back onto the vendor: indemnity clauses, audit rights and a cure period mean a district can enforce the standard contractually, not just morally.

What Operators and Founders Should Do This Quarter

If you sell AI into any institution — schools, clinics, agencies, franchises — the school standard is a preview of the contract language coming your way. Three concrete moves.

First, run the audit nobody wants to run. Pull your model training documentation and answer, in writing, whether any customer data has ever entered a training pipeline, including evaluation runs and synthetic data generation. If the answer is “we’re not sure,” you have a diligence problem and a legal problem, and the second one is worse.

Second, find your engagement mechanic. If retention depends on a user forming a bond with the product, price that dependency now, before a customer’s lawyer does it for you. The standard’s language on companion-style features is broad enough to reach any design that rewards emotional return visits, and every subsequent contract will borrow it.

Third, build the trust page before you need it. Certifications, audit summaries, known incidents, updated quarterly. It reads like a marketing expense until the day a buyer asks for it as a contract condition and you have ninety days to produce artifacts that usually take a year.

The vendors who win the next procurement cycle will not be the ones with the best model. They will be the ones holding the paperwork that lets a nervous district director sleep on a Tuesday night.

The Second Table: Who Carries the Risk

The standard’s real innovation is not any single prohibition. It is the assignment of liability across the parties, which is where most voluntary frameworks quietly fall apart.

That last row is the crack in the structure, and it is a big one. The people with the most at stake — the children whose data is at issue — are the only party with no direct seat at the enforcement table. Their protection is derivative: it exists because a district signed, and it lasts as long as the district keeps caring. That is better than nothing by an enormous margin, and it is not the same thing as a right.

Frequently Asked Questions

What is the National AI Safety & Privacy Standard for schools?

It is a 31-page memorandum of agreement between the National Academy for AI Instruction — an AFT initiative — and AI vendors serving schools. Announced September 9, 2026, with Microsoft as the first signatory, it sets ten binding principles covering training data, surveillance, emotional design, human oversight, transparency, security, and enforcement. Any U.S. school district can request that its own Microsoft agreement incorporate the protections.

Does the standard actually ban training AI on student data?

Yes, absolutely and retroactively. Principle 1 prohibits using any covered data — prompts, responses, uploaded files, behavioral signals, metadata, or derivatives — to train, fine-tune, benchmark, or improve any model. De-identification is explicitly excluded as a workaround, and covered data cannot be used as source material for synthetic data. There is one narrow safety and security exception.

How does a school district adopt it?

Through its existing vendor agreement. Each participating provider must create a clear process for districts to request the protections, and the standard requires that the substantive protections be made available on request within 90 days of the effective date. Districts can incorporate the terms into an existing data privacy agreement or addendum rather than signing the identical document.

Does this apply to every AI company, or only Microsoft?

Only to vendors that sign and to districts that request incorporation. Microsoft Education products are covered by its signature. General-purpose productivity, collaboration, search, cloud, and workplace-assistance products are excluded from the definition even when a school licenses them — which leaves a substantial gap between the protected classroom tool and the unprotected chatbot running beside it.

What happens if a vendor breaks the standard?

The district can enforce the incorporated terms through its own agreement, including terminating for uncured material breach and seeking damages. The Academy may pause or deny deployment for a missing transparency artifact, and can revoke participation for an uncured material breach — after which the vendor must stop claiming participation and must publish the termination on its own trust page.

Does this replace FERPA or COPPA?

No. The standard explicitly requires compliance with FERPA, COPPA, IDEA, and applicable state and local law, and states that where the standard provides stronger protection, the stronger protection applies. The AFT’s position is that existing statutes were written before generative AI existed and do not address the current risk surface.