Ohio Just Mandated an AI Policy for Every School District. What States Are Next?

A few weeks ago, a principal in Columbus asked me a question I've been hearing more of lately.

"Is Ohio really the only state doing this?"

Short answer: no. Ohio is the first state with a hard deadline. It won't be the last. And if you're reading this outside of Ohio thinking this doesn't apply to you — I'd read to the end before deciding that.

What Ohio Actually Did

Ohio didn't just issue guidance. It issued a mandate — with a deadline, applied to every public district, community school, and STEM school in the state. That's a different thing than a framework or a recommendation. It's a requirement.

The Ohio Department of Education and Workforce published a model policy to go with it. I've read through it so you don't have to spend an afternoon in a PDF. Here's what it actually calls for:

A cross-functional AI workgroup. Not IT. Not one administrator. A team — instruction, privacy, family communication, student support. Ohio is explicit: this is organizational work, not a technology decision.

Defined AI uses for students and staff. Specific. Written down. Not "AI allowed with teacher permission." What can a teacher use AI for? What can a 3rd grader do? What is prohibited for everyone? Those answers need to exist somewhere your board can point to.

Privacy and PII standards. A plain-English rule about what student information may and may not enter an AI tool. One sentence. Enforceable. Not a reference to FERPA — an actual rule your staff can read and apply on Monday morning.

Vendor agreement review. Before any tool touches student data, the vendor needs to have answered specific questions — in writing. Ohio doesn't give you the vetting template. That gap is real, and most schools haven't filled it.

Professional development. Not a document staff sign. Evidence that staff actually received training before they were expected to follow a policy. Ohio ties the policy to the professional learning explicitly.

What States Are Watching Ohio

Fifty-three AI-in-education bills across 25 states in 2026. That number is from FutureEd's legislative tracker, and it's been climbing all year.

The bills don't all look the same. But the themes are almost identical everywhere you look: local AI policy requirements, privacy standards, educator training, family transparency, human oversight of AI decisions, and limits on automated decision-making for things like grades and discipline.

Here's where the legislative activity is most concentrated right now:

Notice what none of these bills say. None of them say "ban AI in schools." None of them say "AI everywhere." What they consistently say is: have a policy, protect student data, train your staff, tell families what you're doing, and keep a human in the loop for decisions that affect kids.

That's not an unreasonable bar. It's just one that most K-8 schools haven't cleared yet.

What "Having a Policy" Actually Means

This is where I see schools get stuck. "Policy" sounds like something a lawyer writes. Something that takes six months to draft and three more months to get through a board vote.

It doesn't have to be either of those things.

A compliant AI policy — whether you're in Ohio racing a July deadline or in Texas watching a bill move through committee — is a set of documents. Most of them one to two pages. None of them require outside counsel. All of them are things any K-8 school can build in 90 days with the right sequence.

The documents Ohio's model policy implies you need:

• 1AI purpose statement. One sentence. What problem are we using AI to solve? Without this, every tool decision is arbitrary.
• 2AI launch team charter. Names, roles, and responsibilities. Who owns policy decisions, privacy review, training, and family communication.
• 3Staff acceptable-use policy. What teachers and staff may use AI for, what they may not, and what requires additional approval before using with student data.
• 4Student acceptable-use policy by grade band. K-2, 3-5, and 6-8 should not have the same rules. Write them separately.
• 5Prohibited-data rule. One sentence covering the specific student information that may never enter an unapproved AI tool. This is the single most important document you can produce this week — and it takes less than an hour.
• 6Approved-tool list and vendor vetting checklist. Which tools are cleared. How you reviewed them. What questions you asked. What answers were required before approval.
• 7Family communication and board update. What you're doing with AI, how students are protected, who to contact with questions — written for parents, not lawyers.

If You're in Ohio: You Have About 60 Days

If you start this week, you have enough time. Not a lot of room — but enough, if you start with the right sequence and don't spend three weeks debating tool choices before you've written a single rule.

Weeks 1-2: name the team, write the prohibited-data rule, communicate it immediately. Weeks 3-4: draft the staff and student AUPs, start the approved-tool list. Weeks 5-6: staff training, family communication. Weeks 7-8: board presentation and adoption.

Eight weeks. That's the window. It's workable.

If You're Not in Ohio: You're Not Off the Hook

You're just ahead of your deadline — not exempt from it.

The school that builds the governance foundation now is the one that won't be scrambling when their state follows Ohio's lead. And based on what's moving through state legislatures right now, most of them will.

The parent who emails asking about your AI policy doesn't care whether your state has passed a law yet. The board member who asks at the next meeting doesn't either. The question is coming regardless of where the legislation stands.

Ohio just made it official. The rest of the country is catching up.