Before you can audit for AI features, you need to know what tools are actually in use. This is harder than it sounds. The CoSN 2025 State of EdTech District Leadership report found that only 59% of districts use a formal approved apps list, up from 42% the year before, meaning roughly 41% still lack a systematic tool inventory.3
Start by pulling three lists: tools covered under district contracts or site licenses, tools on any existing approved apps list, and critical tools being used by teachers and students that are not on either of those lists. That third category is what the CoSN report calls shadow AI: tools adopted informally, without IT review, often through personal accounts or free browser extensions.
The fastest way to surface shadow AI is a short, no-fault teacher survey asking what tools they are currently using for lesson planning, grading, communication, and student instruction. Frame it as an inventory, not an investigation. Teachers who feel they will be disciplined for honest answers will not give them.
Once you have your inventory, go through each platform and check for AI features that may have been added since your original review or agreement. This step requires a current review of each vendor's feature documentation, not your original DPA or purchase agreement, which predates most of these additions.
For each platform, specifically look for generative AI capabilities: content generation, AI-assisted feedback, AI-powered search, chatbot interfaces, automated grading or scoring, and behavioral or engagement analytics. All of the major platforms listed above have added features in at least one of these categories, and most of them are enabled by default.
Pay particular attention to features that interact with student-generated content. A reading platform that added an AI writing coach in a recent update is now processing student writing in a way that was not contemplated in your original vendor agreement. That requires a fresh review, not just a notification.
A standard edtech vetting checklist was built for tools that collect structured data. AI features introduce questions that standard checklists do not ask. For each tool with AI capabilities, the Future of Privacy Forum's guidance on AI in schools identifies three questions that most district reviews miss.4
First: does the AI feature use student inputs to train or improve the underlying model? Some vendors explicitly prohibit this. Others are vague or silent. If you cannot get a clear written answer, that is itself information.
Second: was the existing Data Processing Agreement updated to cover AI feature use? Many DPAs were signed before the platform added AI capabilities and do not address how AI-generated outputs, behavioral inferences, or student interaction data will be handled. A DPA that does not mention AI is not sufficient coverage for AI features.
Third: is the AI feature enabled by default for students, or does it require teacher activation? Default-on features are the highest-risk scenario because they are the ones most likely to be in use before the district has reviewed them.
Once you have worked through your inventory, you will likely have four categories of tools. Some have no AI features, or features that are clearly off and not accessible to students. Some have AI features that are enabled and covered by adequate agreements. Some have AI features that are enabled but not covered. And some are shadow tools with no review of any kind.
The second category needs no immediate action beyond documentation. The third category needs a vendor conversation and DPA update before continued student use. The fourth category should be addressed promptly, either by formalizing the tool through a review process or by communicating to staff that the tool has not been approved for student-facing use.
Assign a named staff member as the owner of the approved tools list and give that person the authority and process to add or remove tools as the audit identifies gaps. A list without an owner tends not to get updated.
AI features are being added to existing platforms on a rolling basis. A one-time audit becomes stale within months. The districts managing this well treat AI feature review as a standing agenda item in vendor check-ins and build a lightweight update into their approved tools process: any time a vendor notifies the district of a major platform update, someone is responsible for checking whether AI capabilities were added or changed.
The audit gets more complex when it surfaces tools that require legal review of new vendor agreements, tools with AI decision-making features that affect student records or placement, or situations where a widely-used shadow tool needs to be either formally approved with protections in place or removed. Those situations are worth getting outside expertise to work through properly.
