Yes. An AI tutor adds new things to your supply chain: a model provider, client libraries, prompt and retrieval components, and possibly tool connections. Each can receive or act on student data. Add them to your inventory, decide what data may reach them, and review them like any other third party.
What gets added
| New element | Why it matters |
|---|---|
| Model provider API | Student questions and context may leave your system |
| Client SDKs and agent frameworks | Code that runs with your app's permissions |
| Retrieval and vector tools | May index student work or course content |
| Tool connections (for example MCP servers) | Can read or write data on the model's behalf |
| Prompt templates and system instructions | Define what the assistant can be told to do |
| Model versions | A provider update can change behavior without a code change |
None of these appears in a classic web app, and each belongs in the same inventory as your packages.
Questions to answer before launch
- What student data goes to the model? Name the fields. Send the minimum needed. Strip names and identifiers where the task does not need them.
- Does the provider keep or reuse the data? Read the provider's data terms for your plan. Record the answer and the date.
- Is the provider a sub-processor under your agreements? If your district contracts list sub-processors, update the list before release. Ask counsel how your agreements define it.
- How does COPPA apply? FTC staff guidance says school consent covers educational services with no other commercial purpose, and operators must not use students' information for their own commercial ends without parental consent. Make sure model use sits inside the educational purpose.
- What can the assistant do? If it can call tools, list them. Give each the least access needed, and require approval for actions that change records.
- How do you handle untrusted text? Students and web pages can include instructions that try to steer the model. Treat model input and output as untrusted when they touch tools or data.
Controls that carry over from normal supply chain work
- Pin versions. Pin SDKs, and where the provider allows it, model versions. Test before you move.
- Scan packages. Agent frameworks and model client libraries are open source packages with their own vulnerabilities.
- Review additions. A new tool connection should go through the same review as a new dependency.
- Log safely. Prompts can contain student writing. Apply the same redaction rules you use for other logs.
- Keep a human check on any change the assistant proposes to grades, rosters, or messages.
What to tell schools
Be specific: which provider, what data is sent, what is not sent, how long it is kept, and how a district can turn the feature off. Districts are likely to ask, so answer first.
Quick check
Is an AI provider a sub-processor?
It depends on how your agreements define the term and what data it receives. Treat the question as one to settle with counsel, and disclose clearly either way.
Do we need to inventory model versions?
Yes. A changed model can change what happens to student data and what the assistant does, so record which version you run and when it changed.
Safeguard offers an MCP Guardrail and agent identity for teams that connect tools to AI agents, plus dependency scanning for the libraries around them, and the free scan covers your packages.
Sources
Last reviewed: 19 October 2026.
