FERPA and AI: What Universities Must Know Before Building AI Systems on Student Data

FERPA Requirements for AI Systems: A Practical Framework

Requirement 1: School Official Designation Under 34 CFR 99.31(a)(1)(i)(B), an institution may disclose student records without consent to a "school official" who has a legitimate educational interest. AI vendors processing student data on behalf of the institution can qualify as school officials — but only if the institution's annual FERPA notification describes the criteria for school official designation and includes AI vendors within that scope.

Requirement 2: Data Processing Agreement The DPA must specify: the purpose of processing (enrollment management, academic advising, student retention), the categories of student data accessed (contact information, enrollment status, academic standing — but not unnecessary data like financial account numbers), data retention limits, and prohibition on training AI models on student PII.

Requirement 3: No Model Training on Student PII Student personally identifiable information cannot be used to improve, train, or refine the AI vendor's models. This must be explicitly stated in the DPA. Govistudio's standard DPA includes this prohibition.

Requirement 4: Student Rights Preservation The AI system's processing of student records must not impair students' FERPA rights: the right to inspect their records, the right to request amendment, and the right to restrict disclosure. The institution must be able to respond to FERPA access requests for any student data that was processed by the AI system.

What Data University AI Systems Typically Process (and FERPA Applicability)

Practical guidance: Build your AI enrollment system around engagement behaviour (email opens, portal visits, event attendance) and enrollment status data — the most useful signals for yield prediction — rather than academic performance data, which is both sensitive and less predictive of enrollment decisions.