IRB and Ethical Review Requirements for AI Pilots in Schools

School AI pilots are being reviewed like a new printer purchase rather than like research conducted on children. A vendor arrives with an AI tutoring tool, the district approves it, teachers begin logging in, and no one in the building ever considers whether an Institutional Review Board should have evaluated the system first. The review structures built for human-subjects research, structures developed over decades specifically to protect vulnerable populations from undisclosed data collection, unvalidated interventions, and algorithmic bias, do not apply to most of these pilots, even though the pilots generate exactly the kind of data and risk those structures were designed to catch.

Meanwhile, the AI systems being deployed in classrooms are not passive tools. They log student keystrokes, build individual learning profiles, adjust curriculum in real time based on inferred ability, and feed interaction data back into commercial models, all without the structured oversight that would be mandatory if a university researcher were running an equivalent study.

This post examines why that gap exists in federal and state law, what the classification challenges look like once a school AI study does reach an IRB, how FERPA and COPPA create compounding legal exposure that consent forms routinely miss, and what a peer-reviewed alternative framework for IRB review of AI projects proposes as a more structured path forward.

Why School AI Pilots Escape Review

Nobody files anything with an IRB, because nobody thinks they need to. The tool is treated as a purchase, like new textbooks or a new scheduling system, not as a study on how children learn.

But the tool is quietly doing something textbooks never did: logging every keystroke, grading every response, building a profile of each student's strengths and gaps, and feeding all of that back into a model that keeps adjusting what the student sees next. That is data collection, data analysis, and iterative evaluation of a new intervention on minors, done at scale. If a university researcher wanted to run the same kind of study, an IRB application would be mandatory. A school district running the identical process under a vendor contract faces no such requirement.

The result is a significant mismatch. Stanford's SCALE AI Hub reviewed the evidence base on AI in K-12 and found that high-quality causal studies remain scarce. Part of the reason traces directly back to this gap: without IRB discipline forcing structured study design, pilots generate plenty of data but rarely generate evidence anyone can trust.

Federal Rules That Don't Cover AI Pilots

Federal rules on human-subjects research, found in 45 CFR 46, only apply when two conditions are both true: the activity must constitute research, defined as a systematic investigation designed to produce generalizable knowledge, and it must involve human subjects. A school district that frames its AI rollout as internal program improvement rather than research sidesteps both conditions. It is not trying to produce generalizable knowledge, at least on paper, so no IRB ever needs to open the file.

There is no single federal law written specifically for AI in schools. Existing statutes such as FERPA, COPPA, and IDEA regulate what happens to student data and how students get treated, but none of them require anything resembling IRB-style ethical review before a pilot launches.

That is why "program evaluation" has become the standard exit from oversight requirements. Even in the rare case where a school AI project does clear the research threshold and lands in front of an IRB, a second problem emerges on the other side: figuring out what level of scrutiny the project actually warrants.

How IRBs Struggle to Classify AI Studies

Suppose a school-based AI study actually reaches an IRB. The next question, whether the study qualifies for exempt, expedited, or full board review, turns out to be genuinely difficult to answer, because AI systems distribute risk differently than a traditional study does. A conventional study puts risk on the individual subject. An AI system can put risk on an entire population of students affected by how the system makes decisions, long after the original study concludes.

Traditional review checklists were built for drug trials and survey research. They were never designed to evaluate algorithmic bias, data interpretability, or the feedback loops an AI system creates. Those concerns become sharper, not softer, when the subjects are minors.

A concrete example shows how this plays out even when the system functions as intended. Harvard's Faculty of Medicine IRB reviewed an AI-driven student learning study under protocol IRB24-1600. The study received an exempt determination, which sounds like the straightforward outcome. However, exempt determinations still require a consent infrastructure to be constructed and verified before data collection begins.

Eto, Miller, Vidal, and Lifson published a paper in 2026 identifying this specific failure mode: the consent and disclosure obligations that attach even to exempt determinations are routinely underestimated or skipped entirely in school AI deployments.

FERPA and COPPA Create Compounding Legal Exposure

An AI tutoring tool used with a classroom of students under 13 does not trigger one privacy law. It triggers two simultaneously: FERPA and COPPA. Each answers to a different enforcement authority. The consent mechanisms differ between them. Different definitions determine what counts as protected data. Different penalties follow a violation. The two regimes operate in parallel without coordination, and a district can satisfy one while failing the other entirely.

FERPA's school official exception permits a vendor to handle student records, but only for the authorized educational purpose the school approved. Feeding that same student data into training a commercial AI model exceeds that purpose. It becomes an unauthorized disclosure, even if the original data handoff was legally compliant.

IRB protocols almost never account for both obligations simultaneously. A consent form built to satisfy an IRB can appear thorough and still fall short of COPPA's verifiable parental consent requirement for sharing data with third parties. A teacher using an AI tool to draft lesson plans might include student writing samples without realizing the platform retains or redistributes that content through its data pipeline.

The enforcement exposure here is not theoretical. The FTC has set COPPA violation penalties at up to $53,088 per violation. Districts operating in this regulatory gap face live enforcement risk with a specific financial cost attached.

Federal AI Fairness Guidance Has Been Scaled Back

School AI pilots are multiplying at the same time that federal guidance intended to help institutions evaluate bias and fairness risk has been reduced. The voluntary frameworks that previously helped schools and IRBs conduct self-assessment before a complaint was ever filed have become less available, at precisely the moment when the number of pilots requiring that kind of self-assessment has increased.

This matters directly for school AI. A biased system can determine who gets flagged for additional academic support, who gets recommended for an advanced track, or who gets filtered away from an opportunity. Those harms affect a population of students, not a single individual. That is precisely the kind of population-level harm that traditional IRB review was not designed to detect, because it was built around individual-subject risk rather than algorithmic drift across a demographic group.

The Office for Civil Rights retains enforcement authority over civil-rights violations connected to AI use in schools. What has diminished is the voluntary guidance layer that previously helped institutions identify problems before a federal civil-rights investigation had to begin. With that federal layer reduced and a growing collection of state-level rules attempting to fill part of the space, the case for building structured review capacity at the institutional level becomes more compelling each month.

State Pilots Follow the Same Oversight Gap

Connecticut ran a state-funded AI Pilot Program beginning in January 2025, covering seven districts and students in grades 7 through 12. The program introduced state-approved AI tools into classrooms and provided teachers with professional development on how to use them. No IRB review was publicly documented at any stage. The program was structured as a state education initiative, not as a human-subjects research project, which kept it outside any research review framework.

Connecticut is not an outlier; it reflects a consistent pattern. State AI pilots are typically structured in ways that keep them outside the research classification. A state's endorsement of a pilot program says nothing about whether the underlying AI tool received any ethical review. State approval and IRB review are distinct processes addressing distinct questions, and treating official program status as a substitute for ethical review allows a significant oversight gap to persist behind an authoritative-sounding program name.

For an administrator trying to determine which rules actually apply, the answer depends on a set of variables stacked on top of each other: which state the district is in, how the pilot was characterized in its governing documents, which vendor operates the platform, how old the students are, and whether federal funding touches any part of the project. No single compliance checklist covers every combination of those variables, and the legislative process is not moving quickly enough to produce one.

A Three-Stage Framework for AI IRB Review

Eto, Miller, Vidal, and Lifson published the Three-Stage Framework in Frontiers in Systems Biology in March 2026. It is the first peer-reviewed framework built specifically to address IRB review of AI human-subjects research across biomedical, social, behavioral, and educational settings, with school pilots included by name.

Rather than applying a single review threshold to every AI project regardless of actual risk, the framework ties the level and timing of IRB review to how mature the AI project is and how directly it affects real people.

Stage one covers AI systems built on retrospective data that already exists, with no live contact with subjects. Lower risk levels correspond to lighter documentation requirements. Stage two covers systems collecting data prospectively or operating in a silent deployment mode where the system functions but does not yet drive visible decisions. Stage three covers systems making real-time decisions that directly affect an individual student, the highest-risk category, requiring the most rigorous review a board can apply.

Applied to a school context: an AI model trained on a set of historical, de-identified student essays falls into stage one, because no current student's outcome depends on it. An adaptive learning system that monitors a student's responses and adjusts the curriculum in real time based on inferences about that student's ability sits at stage three and should receive full-board scrutiny under this framework, the same level of attention applied to a clinical drug trial.

The University of Washington developed a parallel mechanism independently. A new AI supplement form now accompanies IRB applications involving AI, for projects led by School of Medicine principal investigators using UW Medicine data or targeting UW Medicine patients. The form draws a distinction between studies that build a new AI system and studies that use an existing AI tool as part of how the study is administered. That distinction maps directly onto school pilots that rely on a commercial AI platform rather than developing their own model, which describes the large majority of current deployments.

What AI Consent Forms Must Actually Cover

Consent for a study involving AI must cover more ground than a standard human-subjects consent form. Participants, or their parents, need to understand what data gets collected, how the AI processes it, where the model's limitations are, how bias risk is managed, and whether the data will be used to train a commercial product at any point in the future.

Rutgers University's Office for Research published a document in January 2026 titled AI in Human Subjects Research: Rutgers Consent Guide. It provides researchers with participant-centered language for explaining how AI is used in a study, what data the AI can access, and what risks, safeguards, and limitations apply to that access. The guide functions as a translation layer, converting technical descriptions of AI behavior into language that a parent reading a consent form can understand and evaluate.

The sections on commercial use and data retention are most directly relevant to school pilots. If a vendor's platform retains student interaction data to train its own model at a later date, the consent materials provided to parents must disclose that fact explicitly. Under COPPA, that disclosure must meet the standard of verifiable parental consent. A signature from a district administrator authorizing the pilot does not substitute for individual parental consent under that standard.

The Harvard IRB24-1600 case adds a practical data point here. Even with an exempt determination, the study still required an informational consent page for students and a disclosed data agreement covering the relationship with OpenAI. Disclosure obligations do not disappear because a study qualifies for exempt status.

Speed Pressure Is Real but Not Sufficient

The most common argument against applying IRB-style review to school AI pilots is that the process is too slow. IRB procedures were built around the pace of biomedical research, not the update cycle of a classroom application that may receive new versions every few weeks. Asking a district to wait months for a review board to evaluate a tool that will have been updated multiple times before the review concludes is a legitimate operational concern.

Sebastian Porsdam Mann, a bioethicist at the University of Copenhagen, has pointed to the growing backlog of IRB applications and argued that exploring alternatives to traditional review may be "ethically mandatory."

A second objection is also worth naming: incorporating AI into IRB review risks making reviewers overly deferential to the technology, treating a model's output as more authoritative than it deserves, and potentially encoding the same biases already present in the training data.

Both objections carry real weight. But the alternative is no structured review at all for AI systems designed to interact with children. An imperfect review process that occasionally moves slowly still provides more protection than a system with no checkpoints, where a model trains on student data, shapes the content a student encounters daily, and no structured evaluation of the risks ever took place before launch. Active COPPA enforcement began April 22, 2026, which means a consent failure now carries a specific civil penalty rather than only reputational consequences. Speed is a legitimate constraint. It does not outweigh the obligation to conduct structured ethical review before deploying AI systems that make consequential decisions about students who had no role in choosing the technology applied to them.