AI in Schools
US class actions name KKR over Canvas, three weeks left on OAIC code
The Canvas breach has moved from incident response to courtroom, while the OAIC Children's Online Privacy Code consultation enters its final three weeks. Both threads decide what Australian schools and universities have to defend in writing for the next two years.
US lawmakers and class action lawyers move on Instructure and KKR
Three days into the budget week, US Senators and class action firms have started writing the next chapter of the Canvas story. TechCrunch reports that US lawmakers have demanded answers from Instructure on the breach response, and Bloomberg Law confirms KKR (Instructure's $4.8 billion private-equity owner) has been named as a defendant in a federal class action filed in the Southern District of New York. There are at least seven federal suits on foot in the US, six of them in the Utah district court where Instructure is headquartered, asserting negligence, breach of legal obligations, and unjust enrichment.
Why this matters: The Australian legal architecture is different, but the trajectory is not. The OAIC's published statement already directs affected users to lodge complaints with Instructure or the institution first and wait 30 days, which is the procedural opening for the same negligence and breach-of-contract arguments to land in Australian courts later this year. For VC offices, registrars, and school business managers, the practical step in the next fortnight is documenting the institutional decision trail: when Canvas was disabled, when it was re-enabled, what scam-warning notices were issued, what advice was sought from the Notifiable Data Breaches process. The institutions whose paperwork is in order will be the ones whose names do not appear in the Australian filings if and when they come. TechCrunch on the Senate questions to Instructure, and Bloomberg Law on KKR's exposure in the federal suits.
OAIC's Children's Online Privacy Code consultation has three weeks left
The OAIC ran its Wednesday webinar on the Children's Online Privacy Code at 1pm AEST, and submissions to the industry consultation close Friday 5 June. The Code applies to any service likely to be accessed by children, which captures the bulk of the school edtech stack, and registers by 10 December 2026. The exposure draft introduces best-interest assessments, restrictions on targeted advertising and profiling of children, and obligations to honour deletion requests.
Why this matters: The school-side procurement question changes once the Code is registered, because the vendor obligations become a contractual checklist. For school IT leaders, the immediate work is two-part. First, the parent who has to consent to sixteen edtech apps via one platform consent form is a real example from the OAIC's own consultation responses, so any submission that names that pattern, with the school's actual app count, carries weight. Second, legal and procurement teams should be mapping every active edtech contract against the draft Code's vendor obligations now, because re-papering a thousand-school contract base in November will not be possible. The OAIC media release on the exposure draft and the path to registration.
The Brisbane summit wraps today, and the take-home is the credentialled-PD market
Day two of the National Education Summit at the Brisbane Convention Centre runs through 4pm today, with the AI in the Classroom stream centred on the Australian Framework for Generative AI in Schools, intelligent tutoring, and the practical politics of differentiation at scale. Sessions count as APST-aligned PD hours.
Why this matters: The headline announcements are not at the summit. The signal is in the room. Microsoft's AI Literacy for Educators credential, the Adelaide PACE-funded micro-credentials for Australian-based educators, the Charles Sturt practical-AI short courses, and the ESA and Microsoft online modules are stacking into a recognisable PD market that schools and dioceses are now budgeting for in the 2026 PD line. For independent and Catholic school heads, the question to brief boards on this term is which credential framework the school will recognise for the standards-aligned hours, because the answer locks in a vendor relationship for a couple of years. For state systems, the equivalent question is whether the state-built tools (NSWEduChat, EdChat, ClassmAIte) earn their own PD credit, or whether teachers chase Microsoft's globally portable one. The AI in the Classroom program for today.
The AERO governance review is due to land this month
KPMG's review of the Australian Education Research Organisation, which the Commonwealth, states and territories jointly own, was commissioned with a May 2026 reporting date. The review's remit covers AERO's governance, independence, and remit, and will be read alongside Tuesday's budget allocation of $5.6 million over two years to scope the new Teaching and Learning Commission, which proposes consolidating AERO with ACARA, AITSL and Education Services Australia.
Why this matters: For school leaders relying on AERO's evidence base for procurement and pedagogy decisions (especially the small-group tutoring and structured-literacy material), the question is not whether AERO continues, but how independent the next iteration is from the Commission framework. The KPMG review will set the terms of reference for what is left of AERO, what gets folded into the Commission, and what independence the residual evidence function carries. Procurement teams making 2027 commitments to AERO-aligned products should track the report release date this month and pause large multi-year buys until the governance position is clear. EduResearch Matters on what an independent AERO actually requires.
From Digital Attitudes: a calculator for what your school is paying for, twice
The Canvas week has put the cost of the school edtech stack back on the agenda, and one of the recurring questions in operations meetings is how much of the spend is duplicated capability across overlapping platforms. The piece published last week introduces a free tool that lets a school tick off the platforms it actually uses (LMS, gradebook, attendance, parent comms, payments, library, behaviour, wellbeing) and surfaces the overlaps and the annual cost of carrying both. The argument the tool is built around is that ten years of accumulated procurement decisions tend to produce two of everything, and the redundancy is hidden because no single team owns the whole stack. The tool returns a starting point for a consolidation conversation, not an audit. Try the platform overlap calculator.
The thread today is the legal and regulatory work that catches up to the operational decisions schools and universities have already made. The Canvas defendants list, the privacy code obligations, and the AERO governance answer are all scheduled to land before the new financial year, and the institutions reading them now will be the ones with options in July. More on the operational landscape at digitalattitudes.com.au.