FERPA protects the privacy of student education records at institutions that receive federal education funding, and it applies to an AI agent that reads, generates, or stores education record data exactly as it applies to any other system an institution operates. The compliance question is not whether FERPA reaches AI agents — it does, without needing new legislation — but whether the institution's use of a given agent fits inside one of FERPA's disclosure exceptions, most commonly the "school official" exception, and whether the resulting data flows are documented the way any other disclosure would be. This post covers the specific mechanics.

For the broader control patterns this post assumes, see PII detection and redaction in AI pipelines and least privilege for AI agents.

What counts as an education record, for an agent

FERPA's definition of an education record is broad: records directly related to a student and maintained by the institution or a party acting on its behalf. For an AI agent architecture, this reaches further than the obvious cases:

  • Grades, transcripts, and enrollment status are education records.
  • Disciplinary records and counseling notes are education records.
  • An agent's own output — a generated summary of a student's academic progress, a flagged-risk note from an early-warning system, a chatbot transcript discussing a specific student's situation — is very likely itself an education record once it is maintained by or on behalf of the institution.

That last point is easy to miss. Institutions often think carefully about what data an agent can read, and less carefully about the fact that what the agent writes becomes a new record subject to the same rules — including the student's or parent's right to inspect and request correction of it.

The school official exception, and its condition

FERPA generally requires consent before disclosing education records to a third party, but it includes an exception for "school officials" with a "legitimate educational interest" — a category that has been extended by regulation and by Department of Education guidance to cover contractors, consultants, and vendors performing an institutional service or function the institution would otherwise perform itself.

This is the exception most AI vendor relationships rely on. It comes with a specific condition that many institutions apply loosely: the institution must maintain direct control over the vendor's use and maintenance of the education records, which typically means a contract specifying the permitted uses, prohibiting redisclosure, and requiring destruction or return of the data when the relationship ends.

For an AI agent specifically, "direct control" is a meaningful design constraint, not just a contract clause:

  • The vendor agreement should specify exactly what education record data the agent can access and for what purpose — not a blanket grant.
  • The vendor should not be able to reuse education record data to train a general-purpose model that benefits other customers, unless the contract explicitly permits it and the institution has made an informed decision to allow that.
  • The institution should be able to audit or demonstrate what the vendor's agent actually did with the data, not just rely on the vendor's assurances.

FERPA requires institutions to record disclosures of education records to third parties under 34 CFR §99.32 — but §99.32(d) exempts several categories from that recordation requirement, including disclosures made under the school official exception at §99.31(a)(1). That is precisely the exception most AI-vendor relationships rely on, which means the disclosure log most teams reach for first is not actually the legal hook for a typical agent-to-model-provider data flow.

What §99.31(a)(1) does require instead is that the institution use reasonable methods to ensure school officials — including a vendor's agent acting under that exception — obtain access only to the education records in which they have a legitimate educational interest. That is an access-scoping and audit obligation, not a recordation one: the institution needs to be able to demonstrate that the agent's access was actually limited to what its specific task justified, not that every individual data flow was logged as a disclosure.

In practice this means two separate things, and conflating them is the mistake to avoid:

  • Disclosures that fall outside a FERPA exception — for example, sharing a student's record with a party that is not acting as a school official under the institution's direction — still need to be logged as disclosures under §99.32.
  • Vendor-agent access under the school official exception does not need disclosure recordation, but it does need a standing access-scoping record: what education record data the agent's contract and configuration entitle it to reach, and evidence that its actual access stayed inside that scope.

An agent-aware audit trail for an education setting should carry both fields: "did this action constitute a disclosure outside a recognized exception" and, separately, "was this school-official-exception agent's access consistent with its defined legitimate interest." Building that distinction into your logging pipeline up front is far cheaper than reconstructing it from generic application logs during a Department of Education inquiry. See audit trails that hold up under regulatory scrutiny.

The correction and inspection right

Parents (for students under 18) and eligible students (18 or older, or in postsecondary education) have the right to inspect their education records and request correction of records they believe are inaccurate or misleading. If an AI agent's output is stored as part of a student's record — a generated risk score, a summarized note, a flagged concern — that output needs to be retrievable and correctable through the same process as any other record content.

This has a direct architectural implication: do not let agent-generated content about a student live only in an ephemeral log or a vendor's opaque system. It needs to be surfaced through whatever record-access process the institution already uses to fulfill inspection and correction requests.

The control checklist

  1. Classify agent outputs, not just inputs, as education records where they describe or concern a specific student.
  2. Confirm each AI vendor relationship fits a FERPA disclosure exception, most commonly school official with legitimate educational interest, and that the institution retains direct control per the contract.
  3. Scope agent access to the minimum education record data the specific task requires. See least privilege for AI agents.
  4. Maintain an access-scoping record for every school-official-exception vendor, showing what data the agent's contract entitles it to reach and that its actual access stayed inside that scope; separately, log any disclosure that falls outside a recognized exception under §99.32.
  5. Prohibit vendor reuse of education record data for purposes beyond the contracted service unless explicitly and knowingly authorized.
  6. Make agent-generated student records inspectable and correctable through the same process as any other education record.
  7. Retain disclosure records consistent with your institution's records retention policy, and be able to produce them on request.
  8. Revoke vendor and agent access promptly when a contract ends or a pilot concludes, following the same offboarding discipline used for departing staff. See secure agent offboarding and deprovisioning.

What good looks like

  • Every AI vendor with access to education records operates under a contract specifying permitted use, no redisclosure, and data destruction terms.
  • Your logging pipeline distinguishes ordinary agent activity, disclosures that fall outside a recognized FERPA exception, and school-official-exception access that needs an access-scoping record instead.
  • Agent-generated content about a specific student is retrievable through the same inspection process as any other record.
  • You can produce an access-scoping record for any vendor agent operating under the school official exception, and a disclosure history for anything outside it, on request.
  • No AI vendor reuses education record data to train models benefiting other customers without explicit, informed institutional consent.

This is not legal advice; confirm current requirements with counsel, particularly around whether a specific vendor arrangement satisfies the school official exception's direct-control condition.

Common questions

Does FERPA apply to a private company that builds education software, or only to schools? FERPA's direct obligations run to institutions receiving federal education funding, not to vendors themselves. A vendor's obligations flow from its contract with the institution, which is why the contract terms matter as much as the vendor's own privacy practices — a well-intentioned vendor without the right contractual constraints does not satisfy FERPA on the institution's behalf.

Can students or parents sue an institution directly for a FERPA violation? No — FERPA does not create a private right of action; enforcement runs through the Department of Education, which can, in serious cases, terminate an institution's eligibility for federal funding. That enforcement mechanism is used rarely, but the institutional risk of a documented pattern of violations is still significant, and reputational and state-law exposure often accompanies a FERPA finding.

Does using an AI chatbot for general student services (not touching grades) still trigger FERPA? It depends on whether the chatbot's interactions become part of a maintained record connected to an identifiable student. A stateless FAQ bot with no persistent per-student record is a different case from a chatbot that logs conversations tied to a student ID for later reference — the latter is much more likely to be creating education records.

How does this compare to protecting health data in a school health office? School health records maintained by an educational institution are typically covered by FERPA rather than HIPAA, which is a common point of confusion. The underlying agent controls — access scoping, disclosure logging, and a correction path — are similar regardless of which regime formally applies, so build one architecture and confirm the applicable regime with counsel rather than assuming HIPAA governs by default just because the data looks clinical.

Do state student-data-privacy laws add anything beyond FERPA? In many states, yes — a number of states have passed student data privacy statutes that impose additional restrictions on vendor data use, particularly around prohibiting behavioral advertising and profiling based on student data, that go beyond FERPA's baseline. Treat FERPA as a floor for an education AI program and check state-specific student privacy statutes for any state where your institution or vendor operates.