AI in Schools
Two state budgets put real money on ed-tech
The Wednesday read is two state Budget lines that put real money on ed-tech, one university quietly tightening its AI policy, and the part of the Canvas breach that schools are about to find in their inboxes.
WA puts $4.6 million on ClassmAIte for another year
The 2026-27 Western Australian Budget, handed down by the Cook government on 7 May, includes $4.6 million to continue and expand the ClassmAIte generative AI lesson-planning platform. The pilot currently runs across roughly 60 public schools and is on a path to more than 100 institutions through the new funding window. The Mandarin's 11 May write-up framed the move as the state positioning itself for educational AI leadership, with the Department of Education building ClassmAIte against WA-specific data and privacy settings rather than licensing a vendor tool off the shelf.
Why this matters: WA has now committed enough money to keep ClassmAIte in market through the 2027 procurement cycle. Three state systems (NSW EduChat for students, ClassmAIte for teachers in WA, and the various internal Victorian and Queensland pilots) are now running with state-developed AI tooling rather than vendor product alone. For independent and Catholic networks doing 2027 AI procurement, the question to put on the table is whether to license a commercial tool, build against the WA or NSW framework, or wait six months and request access via a cross-jurisdictional arrangement. The procurement signal is that state-built tools are no longer pilots dressed up as policy; they are now budgeted line items the Commonwealth will be asked to recognise. The WA government's 2026-27 education Budget statement on ClassmAIte, and The Mandarin on WA's bid for educational AI leadership.
Victoria puts $222.2 million on rebuilding VCAA's exam technology
The Victorian 2026-27 Budget delivers $222.2 million over four years to the Victorian Curriculum and Assessment Authority, with the technology component earmarked for "stronger IT systems and digital infrastructure". Education Minister Ben Carroll framed the line as the response to the Yehudi Blacher review's root-and-branch examination of VCAA after the 2024 exam mishaps, with the funding addressing two specific Blacher recommendations: making VCAA's budget sustainable and upgrading the technology to operate reliably. EducationHQ's 6 May write-up notes the package is also intended to safeguard the integrity of VCE exams across the 2026 and 2027 cycles.
Why this matters: For Victorian schools, the operational risk that the senior secondary curriculum has been sitting on for two cycles is being underwritten, which means the 2026 VCE end-of-year run should not produce another platform crisis. For other state assessment authorities (NESA in NSW, SACE in SA, the QCAA), the precedent is direct: a serious operational failure now produces a serious budget response, and the cabinet case papers SACE and QCAA need for their own modernisation pitches just got better. For ed-tech vendors in the state assessment market (Cambridge Assessment, Pearson, Janison) a procurement window opens in the next six to twelve months as VCAA defines what "stronger digital infrastructure" actually means in tender form. The Victorian line is the first to put real money on assessment technology since the Commonwealth's $18.2 million NAPLAN allocation, and the comparison is now in the open. EducationHQ on the VCAA $222.2 million allocation.
USyd refreshes its AI integrity policy on 5 May, and the disclosure bar moves up
The University of Sydney updated its student-facing artificial intelligence and academic integrity guidance on 5 May, tightening the disclosure requirement: where AI use is permitted in a unit of study, students must acknowledge the specific software or tools used, reference all sources, and keep evidence of AI outputs throughout the assignment process. The refresh sits inside USyd's two-lane assessment structure (secure on-campus assessment alongside open assessment with AI declared) and pushes the decision on whether AI is permitted back onto the academic delivering the unit, not the institution-wide policy. The page is the most current public-facing position from the largest Australian higher-education employer of AI policy in production.
Why this matters: For Sydney's seventy-thousand-plus students, the practical change is that "I used ChatGPT a bit" is no longer a sufficient declaration. For other Australian universities reading the Sydney pattern (the most-copied model in the sector since the original two-lane document landed in late 2024), the operational lift is the evidence requirement: keeping AI outputs as part of the assessment record is a process students have not previously been asked to follow, and academic integrity teams will need to handle the volume. For registrars and DVCs (Education) considering their own refresh, the Sydney text is the document to lift directly rather than draft from scratch. For senior secondary schools the same logic is starting to flow into year 11 and 12 assessment procedures, with QCAA and VCAA both watching how the higher-education disclosure rules settle before publishing their own. The current Sydney AI integrity policy.
The Canvas breach lands as a phishing wave next, and schools have a fortnight
EducationHQ's 14 May report quotes Stacey Edmonds, co-founder of cyber-safety firm Lively and a former teacher, warning that the ShinyHunters dataset returned and destroyed by Instructure is no longer the threat. The next threat is a wave of highly personalised phishing emails built from the names, email addresses, student IDs and teacher-student message threads that were in the breach window before the agreement was reached. Edmonds's framing is operational: even after destruction confirmation, schools on the published breach list remain visible targets, and the genAI-personalised phishing email looks like internal correspondence rather than the usual generic attempt. Her advice is the basics: do not click unexpected links, do not share passwords, treat anything unusual as suspect.
Why this matters: For school IT leaders and business managers, the work this fortnight is the staff-room communication, and a generic "be alert" notice will not survive contact with the kind of phishing email the breach data enables. The operational work is a short, specific brief to teachers about the type of message to expect (one that references a real Canvas course, a real student name, a real assignment), and a clear single-channel reporting path so suspect emails actually get forwarded, not deleted. For diocesan and independent network IT teams, this is also the moment to bring forward the multi-factor authentication enforcement rollout if it is not already at 100%, because the breach data does not include passwords but it does include enough context to make a phishing message convincing enough to harvest one. The 6-week post-breach window is when the social-engineering attacks land in earnest. EducationHQ on the post-breach phishing risk.
The thread today is the operational gap between what the budget papers fund and what arrives in a teacher's inbox the next morning. The states are putting real money on the technology stack; the universities are tightening the rules on what students have to write down; and the breach response that started a fortnight ago is now becoming an inbox problem for every school IT lead in the country. More on the operational landscape at digitalattitudes.com.au.