AI in Schools
Canvas breach hits Queensland K-12, ARC limits AI in grants
Yesterday the Canvas breach was a higher-ed story. Today it is a K-12 story, and the rules around AI in research assessment got tighter at the same time.
Queensland's Department of Education has now confirmed the Canvas breach reached every state school using QLearn
Education Minister John-Paul Langbroek confirmed on 7 May that QLearn, the state's Canvas-backed learning platform, was caught up in the Instructure breach. QLearn covers 1,264 K-12 schools, 572,160 students and more than 73,000 teaching staff, and applies to anyone who has used the platform since 2020. The compromised fields, per the minister, are names, email addresses and school locations only, with no evidence of passwords, dates of birth or financial information accessed. The NSW Department of Education confirmed it has only 45 schools using Canvas and is treating the breach risk as low, partly because departmental sign-on means passwords are not stored with the vendor. Tasmania is investigating, and the University of Sydney has now joined RMIT, UTS, Western Sydney and TasTAFE in the affected list. The 6 May ransom deadline set by ShinyHunters has passed, with no public confirmation either way from Instructure on payment.
Why this matters: This is what a vendor incident looks like once a state department has standardised on a single LMS. Queensland did not get hit because of anything Queensland did or did not do in cyber, it got hit because Instructure did. For independent and Catholic systems running their own Canvas tenancies, the read is two-fold. First, the actual data exposure is narrow (names, emails, school context, messages), so the immediate operational risk is targeted phishing aimed at students and staff over the next six to eight weeks, not identity theft. Second, the procurement read is harder. Anyone tendering for a new LMS this year now has to ask Instructure for written assurances on the post-incident control posture, and ask the same questions of every other vendor on the shortlist. The 7 May iTnews coverage has the Queensland-specific numbers, iTnews on Queensland, and Cyber Daily has the cross-state picture, Cyber Daily on NSW and other states.
The ARC and NHMRC have just told peer reviewers they cannot use generative AI to evaluate or score grant applications
The Australian Research Council and the National Health and Medical Research Council issued a joint policy update on 28 April. Two changes matter. Applicants may now use generative AI as a support tool when preparing grant applications, with responsibility for accuracy and integrity remaining with the applicant. Peer reviewers, by contrast, may use AI only to refine the grammar, spelling, formatting and readability of comments they have already drafted themselves. NHMRC's framing is direct: using GenAI by peer reviewers to evaluate, critique or score applications is "inappropriate". The policy applies from 28 April 2026 to all rounds opening from that date, including Discovery Indigenous 2027.
Why this matters: This is the cleanest line a major Australian funder has drawn between AI-as-typist and AI-as-judge, and it is a useful template for any university that has not yet sorted its own assessment-marking policy. The applicant side has been formalised more than loosened, the previous position was already ambiguous. The reviewer side is the harder rule, because there is no audit trail when a reviewer pastes an application into ChatGPT to "summarise the limitations". Research offices should expect to be asked, at the next NCGP round, what controls they have in place to remind their assessors of this rule, and pro-vice-chancellors (research) should treat the joint statement as the floor, not the ceiling. Joint statement from the ARC and NHMRC.
Queensland's academic integrity course is now a QCE eligibility rule, and 80 per cent of Year 12s are already through
The QCAA's April system update confirms that more than 80 per cent of current Year 12 students have completed the academic integrity course required for the Queensland Certificate of Education. The course runs about an hour through the Student Portal, covers attribution of AI-generated content, original work, and time management, and applies to anyone scheduled to finish Year 12 from August 2026 onwards. Schools using an alternative format need to record completion manually in the Student Management app. There is also an equivalent course route, which is what most independent and Catholic schools are using.
Why this matters: Queensland is the first Australian jurisdiction to make a piece of AI-aware integrity training a graduation requirement, not a recommendation. The 80 per cent number is the part to watch, because it tells you the rule was operationally achievable inside a single senior cycle, which is the answer that NSW, Victoria and SA were waiting on before considering similar moves. For independent schools running QCE pathways, the equivalent-course route is the lever, but the equivalence test is real and schools that have not yet mapped their existing PD against the QCAA criteria will be behind their state-school peers when the August deadline lands. The detail is in the QCAA system update, QCE academic integrity requirement, and the formal eligibility text sits in the QCE handbook, QCE eligibility 2.1.
Three platform stories, three different layers. The vendor below the school just leaked, the regulator above the university just drew a line, and the state assessment authority just made AI literacy a graduation rule. All three say the same thing: the way student work is produced, marked and stored is being decided faster than the policy frameworks can keep up.