Rule 6A-1.0957, F.A.C., Internet Safety Policy, approved by the State Board on September 16, 2026 (not yet in effect)
§§ 1002.22, 1003.02(1)(g), and 1006.1494, Florida Statutes
Policy adopted and implemented by July 1, 2027
Every district school board and every charter school governing board
October 4, 2026
The short version
Florida's internet safety policy rule dates to 2023. What the State Board did on September 16 was attach AI to that existing instrument instead of creating a new one. The policy a board already adopted under § 1003.02(1)(g) now has to say which AI tools students may use, who approved them, what parents were told, and what the vendor may do with the data.
The operational weight sits in two places. The first is the list. A district can't notify parents about a tool, publish it, or report its frequency and duration of use until it knows the tool exists, and AI now arrives inside products the district approved years ago. The second is the clock. The rule says adopt and implement by July 1, 2027, and most of the contracts that will be in force on that date get renewed this spring.
The amendment adds three definitions and then a list of things each district's policy must do.
The definition that sets the scope. An "artificial intelligence instructional tool" is a software application or service that uses generative AI, including machine learning, made available to a student by an educational entity for educational purposes: instruction, tutoring, practice, feedback, or completing educator-directed assignments. The rule then excludes AI systems that don't interact with students, and AI used for analyzing, classifying, predicting, detecting, or optimizing decision making based on existing data. An early-warning analytics platform, a content filter, and a cybersecurity tool are outside the definition. A writing assistant inside the learning management system is inside it.
What each district and charter policy must do.
What approved tools may not do with data. Tools approved for student use may not sell, monetize, profile, or commercially exploit student data to train commercial AI models. They must keep records of student interactions for at least 30 days to allow parental access to education records under FERPA and § 1002.22(2), F.S. Districts and charter boards may also review those interactions for instructional accuracy, alignment to state standards, and developmentally appropriate feedback. Districts must prioritize vendors that store and process student data in the United States.
The reach question for a Florida district is narrower than "where is AI in our stack," and more demanding than it looks.
Narrower, because the definition only covers generative AI that students interact with. Most of the AI a district runs on the business side (finance, HR, help desk, threat detection) and much of the analytics side (early warning, assessment reporting) sits outside the rule's tool definition. That doesn't make those tools ungoverned: Florida's student online privacy statute, § 1006.1494, still bars operators from building student profiles outside K-12 purposes and from selling student information. Those tools stay off the AI list.
More demanding, because as we read the definition, a platform can become an AI instructional tool when its vendor adds a generative feature students can reach. The rule doesn't address this directly, so it's a question for district counsel. Take a platform the district approved in 2022 for reading practice, whose vendor then turns on a generative tutor students can talk to. Nothing in that sequence passes through procurement. On our reading, that platform would then need a place on the list, a parent notice, and opt-ins.
That's the finding we'd put in front of any Florida cabinet first. In one EdTech audit we ran, the district's own records listed roughly 60 tools. Just under 500 were reachable through its single sign-on. The rule asks for a list of approved AI instructional tools. Building it means first knowing which of those 500 now carry a generative feature a student can reach, and the district's records only show the 60.
Charters. The rule names district school boards and charter school governing boards as co-equal. Every charter in Florida carries the same deadline, list, notice, and reporting duties.
The rule names no penalty and creates no private right of action.
For school districts, the greatest risk is rarely the statutory penalty itself. It's the combination of regulatory scrutiny, operational disruption, vendor remediation, legal expenses, incident response, reputational damage, and the erosion of community trust that can result from inadequate technology governance.
In Florida, that exposure runs through three documents the rule itself creates.
The public list. Once a district publishes it, any parent can compare it to what their child uses in class. A tool in daily use that isn't on the list is visible to anyone who looks.
The parent notice. A notice that names the wrong grades, misdescribes how students interact with the tool, or arrives after use began is a written record of the gap.
The report to the Department. Frequency of use and duration of student interaction are figures most districts don't hold today. They come from the vendor. A district that can't get them in its contract will struggle to report them accurately.
By July 1, 2027, every district and charter board adopts and implements an internet safety policy amendment governing generative AI tools made available to students. Each approved tool is reviewed (twice for VPK-5), noticed to parents with an opt-in choice and a non-AI alternative, published on a public list, and reported to the Department with grade levels, subjects, frequency, and duration of use. Approved tools may not exploit student data to train commercial AI models, must keep interaction records for at least 30 days, and should come from vendors that keep student data in the United States. Three companion-style designs are barred.
The policy language is the smaller job. The chair of Florida's K-12 AI Education Task Force has said most Florida districts already have an AI policy that needs updating. The larger job is the inventory underneath it: every tool, every generative feature inside it, every grade and subject it touches, and a vendor that can report usage. The practical calendar runs backward from July 1, 2027. Contracts for 2027-28 renew in spring 2027, which is the last point a district can write the data terms and usage reporting into the agreement instead of asking for them afterward. A district that starts with the inventory this fall can draft the policy against tools it knows about.
Florida districts will ask four things at renewal: whether a product contains a generative feature students can reach, whether student data trains any commercial model, where data is stored and processed, and whether the vendor can report frequency and duration of use by grade and subject. Vendors that answer all four in writing will be easy to approve. A product whose AI feature relies on engagement design that reads as companionship is at risk of falling inside the barred category regardless of its instructional purpose.
We run an EdTech audit that inventories every tool reachable through a district's single sign-on, not only the ones in its records, and flags which of them expose students to a generative feature under the rule's definition. For each flagged tool, we run DPA review against the rule's data terms: training use, 30-day interaction records, U.S. storage and processing, and usage reporting. The district receives the inventory in the shape the public list and the Department report need, with every tool sorted by the action it requires before July 1, 2027.
Florida's rule puts AI use on a parent-consent footing, and it goes further than the closest comparison we've reviewed. Oklahoma's SB 1734, effective July 1, 2026, requires an annual parent disclosure with an opt-out. Florida's rule text frames the parent choice as an opt-in, per tool: a Florida student doesn't directly use an approved AI tool until a parent says yes.
The data terms point the same direction as California. California's AB 1159, signed September 10, 2026, bars covered operators from training generative AI on student information, effective January 1, 2027. Florida reaches a similar result through a different mechanism: it binds the district's approval decision, not the operator directly, and its language targets commercial models. A vendor serving both states will be answering two differently worded versions of the same question in the same renewal cycle.
The barred designs are the national signal. Florida has written companion-style AI out of the classroom by rule, the same month California signed companion-chatbot bills for the consumer market. Expect the "simulate friendship" language to appear in other states' guidance before it appears in their statutes.
Against Florida's own statute. § 1006.1494, Florida's student online personal information protection law (2023), already bars operators from targeted advertising, from amassing a student profile outside K-12 purposes, and from selling student information, and requires deletion within 90 days of disenrollment. The approved amendment cites it as authority and adds the AI-specific layer on top: the training-use bar, the 30-day interaction records, and U.S. storage priority.
Against FERPA. The rule requires AI instructional tools to keep records of student interactions for at least 30 days "to allow parental access to education records, pursuant to FERPA, Section 1002.22(2), F.S., and Rule 6A-1.0955, F.A.C." Districts and charter boards may also review those interactions to monitor for instructional accuracy, alignment to state standards, and developmentally appropriate feedback.
Against Oklahoma SB 1734. Both attach parent rights to AI use. Oklahoma: annual disclosure, opt-out, no enforcement mechanism. Florida: per-tool notice, opt-in, public list, state reporting.
Two things we're watching.
The first is the Department's reporting format. The rule requires frequency of use and duration of student interaction but doesn't say how they're measured or when the first report is due. The format will decide whether districts can meet it from vendor dashboards or need contract changes.
The second is the line between a tool and a feature. As generative features spread into platforms districts already own, the question of when an approved product becomes a new AI instructional tool will come up in every Florida district this year. Guidance from the Department or the K-12 AI Education Task Force would settle it faster than district-by-district counsel opinions.
Florida districts and charter networks: book a scoping call to inventory every tool reachable through your single sign-on and identify which ones fall inside the rule's AI instructional tool definition. You'll leave with a plan sequenced against your spring 2027 renewals and the July 1, 2027 deadline.
Vendors serving Florida K-12: book a scoping call to prepare written answers on generative features, training use, data location, and usage reporting before your Florida customers send the questions.
Read against the proposed rule text the Board approved on September 16, 2026. Last verified October 4, 2026.
Statute tags for update tracking: FL.FAC.6A-1.0957 · FL.FS.1003.02 · FL.FS.1006.1494 · FL.FS.1002.22 · FL.SBE.2026-09-16
This piece is provided for informational and educational purposes only and isn't legal, regulatory, or compliance advice. References to Rule 6A-1.0957, F.A.C., the Florida Statutes it implements, FERPA, and the Florida Department of Education are general context on an evolving governance landscape, not a definitive statement of any district's, charter school's, or vendor's obligations. Every organization's technology environment, contracts, and governance practices are different. Leaders should consult legal counsel and their own technology leadership on how state and federal law applies to their circumstances. Loop + Ledger is an independent technology governance advisory firm. We don't provide legal services, legal opinions, or compliance determinations.