Are states actually regulating AI in classrooms, or just talking about it? Both, at different speeds. Per the National Conference of State Legislatures' 2025 legislative summary, all fifty states, Puerto Rico, the Virgin Islands, and Washington, D.C., introduced AI legislation during the 2025 session — but the Education Commission of the States counted, as of April 1, 2025, just one enacted AI-in-education bill: Mississippi's S.B. 2426, creating a state AI task force. The regulatory center of gravity for schools is not statute but guidance: state education agencies have published AI guidance covering dozens of states, and those documents — not law — are where disclosure rules for classrooms are currently being written.
What does 'disclosure' mean in these rules?
Two different obligations share the word. The first is student-facing academic integrity: telling students when and how AI use is permitted in assignments and requiring acknowledgment of AI-assisted work, the way citation norms already function. The second is institutional: telling families when AI tools process student work or data, which plugs into existing state student-privacy statutes that already govern operators of school applications. The guidance documents states have published since 2023 mostly address the first and defer the second to privacy offices. That split is why a district can be compliant with its state's AI guidance while still having no answer for a parent who asks whether her child's essays are read by a machine.
What changes for districts in practice?
The operational reality for 2025–2026 is that districts are writing the disclosure rules themselves, from templates. State guidance documents — and the policy frameworks districts build on them — increasingly expect three artifacts: a board-approved AI use policy distinguishing permitted classroom uses from prohibited ones, a syllabus- or handbook-level statement students can actually read, and a procurement review that treats AI features as a data question, not only a curriculum one. Districts without these documents are not yet breaking any state law in most of the country, which is precisely the trap: the obligation arrives through guidance now and through legislation later, on foundations districts were expected to have already poured.
What is the detail most districts are missing?
Task forces are the leading indicator, and almost no one reads them as such. Mississippi's enacted bill created a task force; similar bodies have produced the guidance documents that later became mandatory policy expectations in other states, and legislatures that study AI in education in one session tend to regulate it in the next. The practical move for a technology director is unglamorous: track the state task force's meeting schedule the way procurement tracks a bond calendar, comment when draft guidance opens for public input — states have run those comment windows — and write the district policy before the state writes it for them. The districts that treated 2025's guidance as optional homework are the ones that will experience the next enacted bill as an unfunded mandate with a compliance deadline attached.
For more context, read State student-privacy laws are changing what apps may collect.
For more context, read What FERPA actually lets edtech vendors do with student data.
For more context, read How app privacy evaluations work, and where they stop.