Shadow AI in Schools

Shadow AI in Schools

TCEA title card, "Shadow AI in Schools", over a circuit-board image with the letters AI. A five-stage cascade lists Stage 1 Discover AI's Potential, Stage 2 Plan for AI Integration, Stage 3 Master AI Basics, Stage 4 Activate AI in Education and Stage 5 Sustain and Scale AI. Caption: Shadow AI, the unauthorized use of GenAI tools in classrooms, poses significant risks as educators bypass traditional IT protocols.

“I’ve been using my personal account with students. That’s okay, right?” What was not allowed before is now acceptable with GenAI’s rampage into classrooms and schools. With the multiple data breach scenarios occurring weekly in US schools, it’s enough to make your stomach drop. As a school administrator, this scenario has become all too familiar. What do you say to teachers embracing GenAI for student use, but without the traditional restraints? In today’s schools, dark shadows are creeping into hallways and spaces, unknowable by design and concerning. Are you ready for shadow AI?

Why Shadow AI is Scary

You’ve probably seen all the same horror movies. Scary stuff is that because:

  • Lack of transparency
  • Unknowns about new players in the classroom, including motivation
  • A lack of trust

Trust is a social lubricant, and is integral to teaching, learning, and leading. One definition I heard is that “Trust is the residue of promises kept.” If that’s the case, there has to be a track record of transparency, openness, full knowledge of conversations, and their effectiveness to improve learning. New GenAI solutions being forced into classrooms lack this residue of promises kept. Trust has to be established at every level. Until that happens, shadow AI will haunt our use of GenAI in our classrooms.

The Shadow AI Phenomenon

“What are GenAI tool are you using in your classroom?” I asked a group of teachers in an affluent school district. For them, a more apt question might have been, “What GenAI tools are you NOT using?” In their efforts to learn more about GenAI, they had tried every AI tool they could get their hands on. “Which GenAI tool works best for me?” In that process of exploration, they threw every problem, every potential use case they could at the AI tools. They got their answers, but free GenAI tools got their data. Was it a fair trade? Potentially sensitive student/staff/organization data for GenAI benefits?

Shadow IT has evolved in schools through artificial intelligence. Many educators nationwide rely on AI tools, unaware of the compliance implications. Why they are unaware varies from place to place.

“Our non-negotiable commitment to data privacy and safety.”

Shadow AI Scenarios

Here are some examples of AI scenarios:

  • Mrs. Johnson discovers ChatGPT provides instant essay feedback. She creates a personal account and inputs student work. The essay scores perfectly, but if Mrs. Johnson relied on free ChatGPT, she introduced student data to the pool of knowledge ChatGPT has access to.
  • Mr. Rodriguez finds Gemini Pro helps generate differentiated math problems. He uploads his class roster to create personalized worksheets, overlooking privacy considerations.
  • The special education team utilizes Perplexity to draft IEP goals. They input sensitive student information, focused on improving services rather than potential FERPA violations.

These educators aren’t trying to break the rules. Rather, they are overcoming old roadblocks put in place by time constraints, short deadlines, a multitude of tasks. In spite of relying on detours that make their work easier, those actions could expose districts to legal and financial repercussions. Do schools have deep pockets like Big Tech to deal with the consequences of data breaches?

“Instead of asking ‘Is it new?’,
we ask ‘Is it wise?”

The AI Risk Spectrum

Here are some ways to identify various AI uses.

Green Light: Low-Risk Applications Yellow Light: Proceed with Caution Red Light: High-Risk Territory
These AI uses typically pass compliance reviews with minimal concerns and represent a “safe zone” where innovation can flourish without significant compliance issues. These applications require thoughtful implementation and proper safeguards, such as appropriate data protection, anonymized queries, and secure systems. These applications demand rigorous scrutiny and comprehensive agreements, as they often involve direct handling of sensitive student data or create permanent records.
Examples:
– Developing lesson plans without student information
– Creating general educational content
– Supporting professional development
– Automating administrative tasks using anonymized data
Examples:
– Content generation tools with appropriate data protection
– Research assistants with anonymized queries
– Professional development platforms with secure login systems
– Administrative automation with proper data governance
Examples:
– Writing feedback systems storing student submissions
– Grade book assistants creating permanent academic records
– Assessment tools influencing student pathways
– Special education generators processing IEP/504 information
– Direct student use of consumer AI tools
– Uploading any student work for analysis

What category does your use of GenAI in schools fall into? If you’re honest, you may have examples for every category. Consider putting in a four-part framework to evaluate potential tools:

  • First, the Problem Test: what is this actually for?
  • Second, the Student Test: does this deepen learning or is it just a gimmick?
  • Third, the Sustainability Test: can a teacher realistically use this without burning out?
  • And finally, the most important one for us, the Alignment Test: does this fit our unique mission and culture? If a tool can’t pass these four tests, we simply say ‘no, not for us.

“Good pedagogy first. Technology second.”

Your Comprehensive Compliance Framework

Before integrating any AI tool into your educational ecosystem, it must navigate several critical checkpoints. Consider this your roadmap through the compliance landscape.

Poster, "GenAI Compliance Framework", by Miguel Guhlin for TCEA. Four panels: 1 Data Privacy Agreements, noting consumer AI accounts lack educational safeguards and listing what to look for. 2 FERPA Compliance, requiring contractual protections, educational-only data use, deletion procedures, audit trails and parental access. 3 COPPA Considerations for elementary schools, covering verifiable parental consent and minimal data collection. 4 State-Specific Rules, covering opt-in and opt-out mechanisms, contract language, local storage mandates, breach notification and audits. A Critical Red Flags panel warns about "free for teachers" offerings without education-specific agreements, no mention of FERPA, requiring student email addresses, data stored outside the United States, vague deletion policies, terms allowing AI training on student data, no privacy officer contact, missing third-party sharing transparency and unclear breach response.

There are several steps your steering committee needs to follow. This isn’t simply true for Gen AI adoption, but for any technology or big purchase. You have to take these first steps. Below, please find a brief outline. In future blog entries, I will explore the details of each of the following:

  • Build a comprehensive AI implementation strategy. Anytime something is new, you want to include stakeholders, build policies, get professional development, allow for safe experimentation, and involve the community. Sure, it’s a lot and there are more specific suggestions, but those are each a blog entry of their own. Or, reach out to TCEA for AI in Education Journey support.
  • Establish an implementation roadmap. This will involve establish a benchline assessment, engaging in strategic communications, and a phased implementation.
  • Establishing a new culture. This can be the hardest thing to do and top leadership is essential. But so are veteran teachers who serve as influencers on the campus.

“Wisdom over overwhelm. Depth over breadth. Humanity over hype.”

Transforming Shadow AI into Strategic Innovation

Educators embracing GenAI are trying to find a way forward. As education leaders, our responsibility is to create structured pathways for responsible innovation. At the same time, we all play a part in safeguarding students and schools amidst an onslaught of hype and hallucinations. Consider these steps when launching GenAI tools:

Four-stage roadmap rising along a curved arrow. 1 Exploration: small controlled phases guided by a stakeholder committee. 2 Pilot Programs: start pilot programs based on what we learn. 3 Unification: focus on a few tools that work best with high-effect size instructional strategies. 4 Integration: blend digital tools into curriculum.

Of course, if you need something a little more comprehensive, the TCEA SHINE Framework may work better for you. The shadow AI in your schools requires thoughtful implementation and management. Take a strategic approach to enhance educational outcomes and protecting those we care about.

“Success happens slowly and thoughtfully.”

student data privacy