AI has arrived in IEP work. Whether or not districts choose to engage with it, special educators are already using AI in their work, with or without guidance.
In the absence of federal policy on AI use specific to special education, districts must rely on state guidance. While most states have general AI guidance for K–12, very few states address special education or IEPs specifically. As a result, many districts take one of two extremes: adopting AI everywhere without weighing the safeguards around student records, or banning it before understanding what it could help educators accomplish.
IEPs hold some of the most sensitive information a district keeps: a student’s disability, evaluations, and present levels. As such, special education data carries protections beyond FERPA, and the use of AI in special education raises the stakes.
Any AI tool that touches special education student data should meet a clear standard: the district decides how AI is used, educators make the decisions that shape each student’s IEP, and every safeguard protecting student data can be verified. In this article, we break this standard down into three criteria districts can use to evaluate any AI vendor, and show how Goalbook meets each one.
Why the Bar Is Higher: IDEA
IDEA’s confidentiality requirements add protections that FERPA alone doesn’t provide. The law surrounds this information with procedural safeguards: access limited to authorized personnel, training for those who use the records, and a list of who can access them; parental consent before information is shared; and parents’ rights over their child’s records.
While IDEA does not set technical requirements for software, it does require districts to protect the confidentiality of students’ personally identifiable information at every stage, from collection and storage to disclosure and destruction (34 CFR §300.623). Any tool that touches IEPs becomes part of how a district meets that obligation, which gives districts good reason to expect more from it than FERPA compliance alone.
Goalbook treats IDEA’s confidentiality requirements as the guiding ethos for how we bring AI into our work. The following three criteria show what honoring IDEA’s ethos looks like when AI is involved.
Criterion 1: District Control, AI Your Way
The Criterion:
A vendor should be able to show you everywhere it uses AI, adapt to your district’s and community’s approach, and evolve with you as that approach changes. AI isn’t a binary on/off decision. Most districts will land somewhere between the two extremes, and where they land today will likely change in the years ahead.
How Goalbook Meets Criterion 1
Goalbook can show districts every place AI appears in our software, so leaders know exactly what they’re deciding on. From there, Goalbook has the ability to configure and adjust AI features to fit a district’s approach, and to keep adjusting as that approach evolves.
That flexibility doesn’t come at the cost of results. Goalbook partners with districts across the AI spectrum, from districts that have customized Goalbook Threads, such as adapting rubrics to their own expectations, to districts that use Goalbook Toolkit with no AI features at all. Wherever a district falls on that spectrum, Goalbook can help it achieve impact.
The evidence supports this. Over a decade of research shows that Goalbook Toolkit improves educator effectiveness and student outcomes, and much of that research predates the use of AI in Goalbook’s software. Districts don’t have to adopt AI to see results, and districts that choose AI build on a foundation that’s already proven.
District control extends beyond AI to the student data itself. Only district-authorized educators and administrators use and access Goalbook Toolkit and Threads, with access scoped to the students each educator serves. Students do not log in or interact with Goalbook’s AI. And when a district’s relationship with Goalbook ends, its data is removed per their retention policies.
Criterion 2: Human Judgment
The Criterion:
Under IDEA, the IEP team makes decisions. If AI is used within the IEP process, it should inform those decisions, show its reasoning, and build educator expertise rather than replace it.
How Goalbook Meets Criterion 2
AI in Goalbook software is designed around key human judgment points. It presents choices with a rationale so that the suggestions are understandable and transparent to educators. The foundation is educator practice, so decisions are deliberately left to educators. This means that any content, choices, or recommendations can be edited or overridden by educators. Instead of replacing educator knowledge, Goalbook software builds upon it.
Goalbook software connects educators’ knowledge of each student with research, the data educators provide, and IDEA requirements, so its suggestions are grounded in evidence. Both special educators and administrators have the ability to review each step in the IEP process in Goalbook software.
Criterion 3: Foundational Security and AI-Specific Safeguards
Part One: Foundational Security
Before asking anything about AI, districts should confirm that a vendor’s foundational security is sound. AI doesn’t replace these protections; it depends on them. Every AI request, uploaded file, and piece of generated content passes through the same systems that hold the rest of a vendor’s data. If those systems aren’t secure, nothing built on top of them is. That makes baseline security more important with AI, not less, and it’s why districts should expect vendors to prove their security rather than describe it.
Goalbook’s Foundational Security
At Goalbook, we believe security claims should be verifiable, not just asserted.
- Independent Audits
Goalbook is independently audited for SOC 2 Type I and Type II against the AICPA Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. A Type I report confirms that the right controls are in place. A Type II report sets a higher bar: it confirms those controls worked as intended over months of real operation, not just on paper. - Regular Penetration Testing
Goalbook undergoes regular penetration testing, in which security specialists try to find and exploit weaknesses before anyone else can. Districts can request penetration testing results and audit reports. - Layered Protection
Encryption protects data in transit and at rest, with access to encryption keys restricted, so intercepted or stolen data stays unreadable. Access controls address the other common risk: someone signing in with stolen credentials. Goalbook enforces unique account authentication, supports multi-factor authentication and SSO for district-managed logins. Business continuity and disaster recovery plans are established and ready to execute. - A Live Trust Center
At trust.goalbook.com, district and compliance teams can review Goalbook’s security controls directly, across infrastructure, organizational, product, internal, and data and privacy security. It’s continuously monitored and kept current, not a static PDF or a slide in a sales presentation.
This foundation is essential, but it isn’t enough on its own. AI introduces new questions about where student data goes, what happens to it, and who can access it, and baseline security doesn’t answer them.
Part Two: AI-Specific Safeguards
AI creates new risks, so districts should ask every vendor the following questions:
- What student information do I need to give you for this to work?
- What information goes to the AI model?
- What do you keep afterward, and for how long?
- Who provides your AI infrastructure?
- Where is student data stored and processed, and which country’s laws govern it?
- Is student data ever used to train models?
- Is your AI used by staff, students, or both?
Goalbook Answers the Questions
1. What student information do I need to give you for this to work?
Only what is relevant to the task an educator is working on. To draft present levels or goals, for example, an educator might share a student’s grade, areas of need, and recent assessment results, or upload a prior IEP for Goalbook Threads to draw from.
Goalbook doesn’t require broader records like attendance or discipline history, and it doesn’t pull student data from other systems. Educators decide what to share, task by task.
2. What information goes to the AI model?
Only the student information educators choose to enter or upload, such as a student’s grade, needs, and present levels, along with information scanned and extracted from documents like assessment reports or prior IEPs. Goalbook Threads combines that with Goalbook’s research library to generate recommendations.
3. What do you keep afterward, and for how long?
Goalbook keeps only what educators need to continue their work. When an educator uploads a file, Goalbook Threads extracts the relevant information and deletes the original. Any text extracts that are retained can (and should) be edited or deleted by educators, such as a present levels statement or IEP goals, so educators can pick up where they left off. Requests aren’t stored by the AI service, and when a district’s relationship with Goalbook ends, its data isn’t kept.
4. Who provides your AI infrastructure?
Goalbook Threads runs on Amazon Bedrock within Goalbook’s AWS environment, the same cloud infrastructure that already hosts Goalbook Toolkit, so using AI doesn’t send student data anywhere new. Districts that want details about the specific models Goalbook uses can request them directly.
5. Where is student data stored and processed, and which country’s laws govern it?
Many districts assume their student data stays in the United States, but that isn’t guaranteed. Cloud services and AI providers can store or process data in data centers abroad, where other countries’ laws may apply to it.
Goalbook keeps student data in the United States. Student data is stored, and every AI request is processed, in U.S. data centers, so it remains under U.S. jurisdiction.
6. Is student data ever used to train models?
No. Under AWS’s data protection commitments, the information Goalbook sends through Bedrock isn’t stored, isn’t used to train models, and isn’t accessible to the companies that build the models. Goalbook also doesn’t save what educators enter or what Goalbook Threads generates to train future models.
7. Is your AI used by staff, students, or both?
Staff only. Goalbook Toolkit and Threads are used by district-authorized educators and administrators, and students never log in or interact with the AI. Student-facing AI raises different and more sensitive questions, so districts should evaluate it separately from tools used by staff.
A Note for Buyers
A vendor’s willingness to answer these questions matters as much as the answers themselves. Be cautious of any vendor that can’t or won’t tell you who provides its AI infrastructure, where student data is stored and processed, which country’s laws govern it or what happens to it afterward. Transparency is itself a safeguard: if a vendor can’t explain how it handles your students’ data, you can’t verify that it’s handled well.
A Better Question Than Yes or No
AI is already part of special education. For districts, the real choice was never between the two extremes of adopting AI and banning it. It’s whether the tools they choose work within the safeguards that have always surrounded IEPs. Each part of this standard protects someone who matters in the process:
- District control protects the district’s ability to set its own course. Leaders decide where AI fits, and that decision can change as their community’s thinking does, without trading away results.
- Human judgment protects the IEP team’s role. Educators bring what no AI model can: knowledge of the student in front of them. AI that explains itself makes that expertise sharper, not optional.
- Security protects students and families. Their most sensitive information stays where the district can see it, account for it, and answer for it.
A vendor that meets all three gives districts something more useful than a yes-or-no policy on AI — a way to say yes to what helps educators without saying yes to risks they can’t see.
We built Goalbook Toolkit and Threads to meet this standard, and we invite you to hold us to it. Verify our answers for yourself at trust.goalbook.com or by contacting trust@goalbook.com.
