Artificial Intelligence Education and Workforce Readiness Act of 2026

(a) Definitions. In this section:

(1) Appropriate Federal authority. The term appropriate Federal authority means—

(A) the Secretary of Education, in the case of covered activities undertaken using amounts provided by such Secretary;

(B) the Secretary of Labor, in the case of covered activities undertaken using amounts provided by such Secretary; and

(C) the Director of the National Science Foundation, in the case of covered activities undertaken using amounts provided by such Director.

(2) Covered activities. The term covered activities means activities that are undertaken using amounts provided under—

(A) this Act; or

(B) the amendments made by this Act.

(b) In general

(1) Requirements. An entity subject to the requirements of this section shall carry out each of the following:

(A) Make research findings and curricular materials resulting from covered activities conducted by such entity publicly available under a license that is open-access.

(B) Not less than twice during the period of such covered activities, undertake, publish, and submit to the appropriate Federal authority the results of an independent evaluation of such covered activities.

(C) Comply with the designated risk management framework with respect to such covered activities.

(D) With respect to each artificial intelligence tool used by such eligible entity that materially affects student learning, well-being, engagement or assessment—

(i) provide a summary of the function, purpose, and data inputs of such tool to students, parents, and educators—

(I) in plain language; and

(II) additionally, in languages other than English common among students served by such eligible entity;

(ii) provide a preview of such tool lasting not fewer than 14 days before beginning use of such tool for student learning or assessment;

(iii) provide students, parents, and educators with an opportunity to opt out of using such tool;

(iv) document the human oversight and decision-making authority procedures applicable to such tool, consistent with such procedures described in section 105; and

(v) perform bias and accessibility testing of such tool consistent with the designated risk management framework.

(E) Implement a data security program with respect to student data, where applicable, that includes—

(i) encryption of data at rest and in transit;

(ii) multi-factor authentication for individuals authorized to access such data;

(iii) regular review and testing of the vulnerabilities of such program;

(iv) mandatory data breach notification procedures requiring that, not later than 72 hours after discovery of a breach of personally identifiable student data, such entity notify—

(I) the Secretary of Education through the portal established under section 501(a);

(II) each student, and the parent or guardian of each student who is a minor, whose personally identifiable data was compromised in such breach; and

(III) in the case of a breach affecting students in elementary or secondary education, the State educational agency of the State in which such entity is located.

(v) as a condition of any contract for the collection, management, or storage of student data, written attestation by any contractor of compliance with the Family Educational Rights and Privacy Act of 1974, the Children’s Online Privacy Protection Act of 1998, where applicable, and the requirements of this section, which attestation the eligible entity shall retain and make available for audit; and

(vi) conformance with minimum information security standards, including relevant guidance issued by the National Institute of Standards and Technology and, where applicable, Federal policies for the management of information resources.

(2) Prohibition

(A) In general. An entity subject to the requirements of this section may not sell, license, use, or use to train, retrain, or otherwise develop any artificial intelligence model or system, including for the purposes of commercial advertising, marketing, or product development unrelated to educational services, any personally identifiable student data, including metadata, behavioral, or biometric data, collected or obtained by such entity in connection with covered activities.

(B) Exception. Subparagraph (A) does not apply to—

(i) the use of aggregated or deidentified data for research or program evaluation purposes, consistent with the Family Educational Rights and Privacy Act of 1974 (20 U.S.C. 1232g) and the Confidential Informational Protection and Statistical Efficiency Act of 2018 (44 U.S.C. 3561 et seq.); and

(ii) the use of such data described in subparagraph (A) that may be used to train, retrain, or otherwise develop an artificial intelligence model or system solely for the purpose of providing the same covered activity to the student from whom the data was collected, subject to the requirements of subsection (c).

(c) Enforcement

(1) In general. An entity that fails to comply with the requirements of this section shall be ineligible to receive amounts under this Act or the amendments made by this Act for a period determined by the appropriate Federal authority, not to exceed 5 years.

(2) Referral. In the case of a material failure to comply with the requirements of this section, the appropriate Federal authority shall refer such failure to the Inspector General of the relevant Federal agency for further action consistent with applicable law.