How to build FERPA compliant AI on student records

Most AI projects in a registrar's office or financial aid shop die in legal review, not in engineering. The reason is usually that nobody read the regulation before they built. FERPA is short, specific, and mostly not about the things vendors talk about. Here is what it says, what it does not say, and the design decisions that follow from that difference.

What FERPA actually requires

FERPA is 20 U.S.C. § 1232g, implemented at 34 CFR Part 99. It does three things. It gives students the right to inspect their education records within 45 days of a request (§99.10). It gives them a process to seek amendment of records they believe are inaccurate (§99.20). And it bars the institution from disclosing personally identifiable information from education records without written consent unless a listed exception applies (§99.30, §99.31).

Notice what is absent. FERPA sets no encryption standard. It names no cloud region. It says nothing about model training, retention windows, or key management. It is a disclosure statute, not a security framework. Anyone selling you "FERPA certified AI" is selling you a thing that does not exist: there is no certification body, no audit scheme, and no registry. Ask a vendor that question and the correct answer is "no such certification exists, here is what we do instead."

Enforcement is also weaker than people assume. There is no private right of action (Gonzaga University v. Doe, 2002), and the Department of Education's ultimate remedy is withdrawal of federal funding, which has never been imposed. The consequences that actually land are different: under §99.33(e), a third party that improperly rediscloses can be barred from your records for at least five years, and separately you have state privacy law, your contract, and a student newspaper. If your agent touches FAFSA or ISIR data, the binding technical control set is not FERPA at all. It is the FTC Safeguards Rule (16 CFR Part 314), which does mandate MFA, encryption in transit and at rest, a written program, and a designated qualified individual. Title IV participation makes you a financial institution under GLBA. Most teams building on university back-office workflows discover this in week three of legal review rather than week one.

The school official exception is your entire legal footing

An AI vendor processing student records almost always operates under §99.31(a)(1)(i)(B), the outsourced school official provision. Three conditions must all hold. The outside party performs an institutional service or function for which the institution would otherwise use employees. It is under the direct control of the institution with respect to the use and maintenance of education records. And it is subject to the redisclosure limits in §99.33(a).

Two things routinely break this in practice.

• The annual notification. §99.7 requires that if you disclose under the school official exception, your annual FERPA notice must specify the criteria for who counts as a school official and what counts as a legitimate educational interest. Many institutions still publish a notice that says "employees." A contractor does not fit that text. Fixing it is a one-line edit, but it publishes on an annual cycle, so a missed cycle costs you a semester. Check the current notice before the pilot, not after.
• Direct control. Any clause that lets the vendor use your data for its own purposes defeats direct control. That includes the friendly-sounding ones about product improvement and model quality. Training a vendor's model on your students' records is not covered by the school official exception. The studies exception in §99.31(a)(6) is narrower than people hope: it covers studies conducted for or on behalf of the institution to develop or validate predictive tests, administer student aid, or improve instruction, and it requires a written agreement fixing purpose, scope, duration, and destruction of the PII when it is no longer needed.

One more thing teams get wrong: shadow mode is not a legal exemption. Running the agent on real cases beside the human team, producing output nobody acts on, is still use and disclosure of education records. It needs the same contract, the same access controls, the same notification language. What shadow mode buys you is accuracy evidence before cutover, not paperwork relief.

Least privilege, residency, and what the model provider sees

§99.31(a)(1)(ii) requires the institution to use reasonable methods so that school officials reach only the records in which they have a legitimate educational interest. The Department has been explicit that technological access controls satisfy this, and that if you cannot restrict access technically you must fall back on policy plus audit. Design to the first option.

Scope the agent to a case, not to a corpus. The failure pattern is a single vector index containing every transcript on campus, with a filter applied after retrieval. Filter at query time, keyed to the specific record the agent is working, so the retrieval layer physically cannot return another student's data. Give the agent its own service identity in the SIS with its own role and its own expiring credentials. Do not let it borrow a registrar's admin account, because then every log line says the registrar did it. Put every outbound action behind a human approval step: sending a letter, posting a decision, writing to the record. That boundary is what separates a drafting tool from an autonomous decision, and it is the boundary your general counsel cares about. Same principle we apply across vertical agent design generally.

On residency: FERPA does not require US data storage. Your institution's policy might, your state might (Texas public institutions have TX-RAMP), and international applicants can pull GDPR into scope. Pin the inference region explicitly rather than accepting a provider default, and enumerate every subprocessor, including OCR and embedding services, which teams consistently forget. Then get retention in writing. Enterprise API tiers from the major model providers generally offer no-training-by-default and bounded or zero retention; consumer tiers usually do not. Redaction helps where the identifier is incidental, such as an SSN in a denial letter. It does not help on a transcript, where the record is the point. There, contract terms do the work redaction cannot.

Logging and retention: assume the output is an education record

Log the retrieval, not just the answer. For each run: record IDs touched, fields read, prompt version, model version and snapshot, the output, the reviewer, and the timestamp. Append-only. This is the only way to answer "what did the agent see" during a grade dispute eighteen months later.

Here is the precise point most compliance memos get backwards. §99.32 requires a record of disclosures, but §99.32(d) exempts disclosures to school officials under §99.31(a)(1). So your agent's access log is not what makes you FERPA compliant. You are keeping it for institutional audit and for your own defense. Keep it anyway, and say clearly in the review that it exceeds the regulation rather than implying it is mandated. That distinction is part of how we document controls in our delivery methodology.

Then decide, before go-live, what happens when agent output lands in the SIS attached to a student. If it does, it is an education record: inspectable under §99.10 and amendable under §99.20. That has a design consequence. Do not write raw model reasoning into the record. Store the determination and the citation to the source document; keep the reasoning trace in the audit log under a separate retention rule. Write every field as though the student will read it, because they can. Finally, map the logs themselves to your existing records retention schedule. A 30-day rolling delete looks tidy and becomes indefensible the moment a dispute surfaces at month nine.

The questions your procurement office will ask

• HECVAT. Full or Lite, EDUCAUSE's standard vendor assessment. Expect AI-specific supplemental questions about training data and model provenance.
• SOC 2 Type II, subprocessor list, and regions. Named entities, not "industry-leading cloud infrastructure."
• Contract language quoted, not paraphrased. The DPA should reproduce the §99.33(a) redisclosure limit and the §99.31(a)(1)(i)(B) direct control condition verbatim.
• Accessibility. A VPAT and WCAG 2.1 AA conformance if any interface is student-facing. Section 504 and ADA obligations do not pause for pilots.
• Breach notification in hours, not "promptly." Plus which state breach statutes the vendor tracks.
• Exit terms. Export format, timeline, and a certificate of destruction.
• Model change control. Who notifies you when the underlying model version changes, and what revalidation runs before that version touches student data. This one is new, most templates lack it, and it is where quiet accuracy regressions enter.

Have these answered before the first meeting rather than during it. Our security and data handling posture is written to be pasted into these forms.

Where we tell universities not to use an agent

Do not automate adverse determinations. Aid denials, conduct outcomes, Title IX matters, disability accommodations, admission denials. The agent drafts and cites; a named human decides and signs. This is not only ethics, it is what keeps the output defensible when the student appeals.

Do not build at low volume. Run the arithmetic yourself: 1,200 transcript evaluations a year at 18 minutes each is 360 hours, about 0.2 FTE. An agent that removes 60% of that saves roughly 0.1 FTE. That does not justify a twelve-week build and an ongoing operations retainer. The math turns favorable in the tens of thousands of documents, or when a hard seasonal peak forces overtime and temp hiring every spring.

Do not start on a system without an API. Scraping a legacy SIS screen creates an access path your security office cannot audit and your logs cannot explain. Replace the integration first or pick a different workflow. IDC put the share of AI proofs-of-concept that never reach production at 88% in 2025, and in higher education the usual cause is not model quality. It is that the pilot was built on an access path or a contract that could never survive review. That is what the two-week readiness map is for: find the blocker while it still costs two weeks instead of two quarters.