School districts are further into AI than almost any other kind of public organization, and further from having decided anything about it.
That is not a criticism. Teachers found generative AI tools useful immediately, students found them faster than that, and the technology arrived in classrooms well ahead of any policy about it. Most districts we speak to are not deciding whether to adopt AI. They are discovering how much of it is already in use, and working out what to do about that while the school year continues.
What follows is what a readiness assessment looks at in a district specifically, and where district answers differ from those of a county or a hospital.
Start with what is already happening
The first finding in almost every district assessment is the size of current usage. Staff are using generative AI to draft communications to families, produce first versions of lesson material, summarize meetings, and get through administrative writing. Students are using it for schoolwork. Neither group is being reckless; both are using tools that are genuinely useful and freely available.
The right response to that discovery is not enforcement. It is to establish what information has been going where, then provide an approved route so that useful work can continue on terms the district has chosen. A district that bans tools without providing an alternative gets the same usage on personal devices, with less visibility.
Ask the question without consequence attached and you will get an honest answer. Ask it as an investigation and you will get a much smaller number that is not true.
Student information is the constraint, and the question is not technical
Districts hold records about children, and those records carry obligations that most other organizations do not have to think about. The Family Educational Rights and Privacy Act is the one everybody names, and state student privacy law frequently adds to it.
We are technologists, not lawyers, and this page is not legal advice. What an assessment can do is establish the facts your counsel and records officer need in order to answer the question properly: which records would be in scope for a given use case, where those records currently live, who can already reach them, whether a proposed service would process or store them outside the district's control, what a supplier's terms actually say about retention and model training, and whether the district could evidence any of that if asked.
Those are technical and organizational findings. The determination about whether a particular arrangement is permissible is not ours to make, and any supplier who tells you their product is compliant with student privacy law is telling you something no product can be on its own. The Department of Education's Student Privacy Policy Office is the authoritative starting point, and its guidance is written for districts rather than for vendors.
The practical version of this: settle which categories of information may be sent to an external service before you evaluate any product, not after.
Where the useful applications actually are
The applications that pay for themselves in a district are almost all administrative rather than instructional, at least at first. That surprises people, because the instructional conversation gets the attention.
Teacher workload is the clearest case. Drafting routine family communications, producing differentiated versions of existing material, and generating first drafts of documentation absorbs hours that were never the job. Administrative processing is next: routine correspondence, records requests, scheduling problems, and the long tail of forms that a district generates.
Knowledge search is the quietly valuable one. A district's policies, procedures, board decisions and handbooks are usually spread across several systems and a shared drive, and staff answer questions from memory because finding the authoritative version takes longer than guessing. That is a genuine problem with a genuine solution, and it touches no student records at all, which makes it a good first candidate.
We work through this in more detail in AI use cases for K-12 school districts.
Instructional use is a different decision, made by different people
Anything that touches teaching and learning belongs to educators rather than to IT, and a readiness assessment should say so rather than quietly making the decision by choosing a platform.
Where an assessment helps is on the parts that are technical: whether a tool can be integrated with existing systems, what it does with student work, whether access can be scoped by role and grade band, and whether the district could turn it off cleanly. The pedagogical question of whether it should be used, and how, is for curriculum leadership, and the districts that get this right involve teachers in it early rather than presenting a decision.
The Office of Educational Technology publishes guidance for districts on this at tech.ed.gov.
The systems question: SIS, ERP and everything around them
A district's information sits in a small number of systems that were not designed to be read by anything else: a student information system, a finance and human resources platform, a learning management system, a food service system, a transportation system, and a website.
The assessment question per system is the same one and it has a specific answer: is there a documented interface, a supported export, or neither. Districts are often told integration is possible in general and find in practice that the specific data they need is only available as a formatted report. That is a hard constraint and it is much better discovered before a platform is selected.
Identity is the other half. Districts typically manage staff identity centrally and student identity through a rostering process, and an AI service introduced without a route into that arrangement becomes a separate account list nobody deprovisions. Since an AI service inherits the permissions of whoever operates it, that is not a housekeeping problem.
Cybersecurity, with the district-specific parts
Districts are attacked more than their budgets suggest they should be, and the AI questions sit on top of the ordinary ones rather than replacing them.
The specific additions are: whether staff can send student information to a third-party service without anything preventing it, whether the district can see what has been sent, whether an approved tool's access has been scoped or simply granted, and whether the supplier's terms permit your data to train a model. The last one is worth reading rather than asking about, because the answer is frequently in a linked document rather than in the contract.
Shadow AI is the finding that most often changes a district's priorities. A readiness assessment surfaces it as a fact rather than a suspicion, which is what makes it possible to act on.
Acceptable use, written once, in one page
Districts already know how to write acceptable-use policy. The AI version does not need to be long, and the districts that succeed here produce something a teacher will actually read.
A workable one states which tools are approved and how to request another, what categories of information may never be entered into an external service, that AI output is a draft rather than a decision, that anything affecting a student's grade, placement or discipline requires a human judgment that a person is accountable for, and where to go with a question. Separate positions for staff and for students, because the two audiences need different things.
Set a review date. This field moves faster than the policy cycle, and a position written eighteen months ago will be describing tools that no longer work the way it says.
What a district assessment produces
A readiness score across the seven dimensions, findings for each, an inventory of what is already in use, a prioritized set of candidate use cases with the student-data question answered for each, governance recommendations sized to a district rather than to an enterprise, and a roadmap that fits a school year rather than a calendar one.
That last point matters more than it sounds. Districts have windows: work that lands in August lands badly, and work that lands in June has a summer to bed in. A roadmap that ignores the academic calendar will be rescheduled by it.
Where to start
If you want a benchmark before committing to anything, the AI Readiness Self-Assessment scores your district across the same seven dimensions in about eight minutes. It is a self-reported benchmark and not a formal assessment, which the results page states plainly.
To work through it with your own team, use the public-sector AI readiness checklist. For a first conversation with a superintendent or a board, ten questions to ask is the shorter version.
Where the district needs the evidence examined rather than self-reported, our AI readiness assessment service covers it, and districts purchasing through a cooperative contract will find the route described on the TIPS members page. LABUSA works with districts on the surrounding infrastructure too; cybersecurity services for school districts covers that side.
If you would rather start by telling somebody what you are dealing with, get in touch.