When AI tools enter the registrar's office, the compliance question is not abstract. FERPA — the Family Educational Rights and Privacy Act — governs every student record your institution holds. It was written in 1974, before cloud computing, before modern AI, and long before anyone imagined that an algorithm would be evaluating transcripts.
In 2026, applying 1974 law to AI-assisted evaluation requires careful interpretation. The Department of Education has issued limited guidance on AI-specific FERPA questions, which means registrars are often navigating novel territory without a clear roadmap. This guide addresses the questions we hear most often.
The Three Questions Every Registrar Asks About AI
When a vendor presents an AI evaluation tool, three FERPA questions come up in every room:
- Who 'sees' the student record when AI processes it?
- Who is responsible for the AI's evaluation decision?
- What disclosure obligations does the institution have to students?
The answers are nuanced but navigable. Let us take them in order.
School Officials and Legitimate Educational Interest
Under FERPA's third-party data sharing provisions, institutions can share student records with vendors who qualify as 'school officials' — if those vendors have a 'legitimate educational interest' in the data. This is the legal framework that allows AI evaluation vendors to process student transcript data at all.
For a vendor to qualify as a school official under FERPA, four conditions must be met: (1) the vendor is under direct institutional control through contract; (2) the vendor only accesses data for stated educational purposes; (3) the institution maintains governance over what the vendor can and cannot do with the data; and (4) the vendor complies with FERPA's use-limitation requirements.
This does not happen automatically. It requires a properly structured Data Processing Agreement (DPA) that explicitly establishes these conditions. Institutions that share student data with AI vendors without a FERPA-compliant DPA are exposed — not hypothetically, but concretely, under established regulatory interpretation.
A vendor handling your student transcript data must qualify as a 'school official' under FERPA. That requires a properly structured Data Processing Agreement — not just a Terms of Service acceptance.
The Human Override Requirement
FERPA does not require human review of every student record action. But FERPA's right-to-review provisions establish that students can challenge the accuracy of their educational records — and an AI-generated evaluation is an educational record the moment it is created.
In practice, this means every AI-generated evaluation must be reviewable and correctable by a qualified human evaluator. Override decisions must be documented. The institution must retain final authority over every evaluation outcome.
TC Evaluator's architecture reflects this requirement: the AI generates a recommendation, a certified evaluator reviews and approves it, the approval is logged with a timestamp and user ID, and the full audit trail is available for FERPA access requests. The AI never has final authority — the institution always does.
What Accreditors Are Actually Asking About AI
During accreditation reviews in 2025 and 2026, the AI governance question has become standard. Accreditors are not asking 'do you use AI?' — they are asking 'how do you govern AI?' The specific questions we have seen in institutional review documentation:
- Who has access to AI-generated evaluation records, and under what role-based controls?
- What is your documented process for reviewing and overriding AI recommendations?
- Are AI vendors under FERPA-compliant data processing agreements?
- How do you handle FERPA access requests that include AI-generated content?
- What training have evaluators received on the limitations of AI recommendations?
If your institution cannot answer these questions with documented policies and audit trails, you have a governance gap — not necessarily a violation, but a gap that will generate findings in a site visit.
A Checklist for AI Vendor Evaluation
- Does the vendor have a FERPA-specific Data Processing Agreement available?
- Does the DPA explicitly prohibit using student data for AI model training?
- Does the system maintain a complete audit trail of all AI recommendations and evaluator overrides?
- Does your institution retain final authority over all evaluation decisions?
- Does the vendor provide documentation suitable for accreditation review?
- Is encryption in transit (TLS 1.3) and at rest (AES-256) confirmed in the vendor's security documentation?
FERPA compliance with AI is not a barrier to modernizing the registrar's office — it is a framework for doing so responsibly. The institutions that build AI governance infrastructure now will be better positioned as regulatory guidance inevitably evolves.