AI in Schools
Four regulatory and procurement clocks for Australian education
The Sunday read is three regulatory and procurement clocks the school and university sectors should have in their diaries this morning, and one Sydney conference floor worth turning up to in eleven days.
NSW IPC publishes its generative AI guide and the Department of Education is bound by it
The NSW Information and Privacy Commission released its guide on the privacy risks of generative AI tools for NSW public sector agencies on 14 May, the closing week of Privacy Awareness Week NSW 2026 (theme: "Smart Tech, Smarter Choices"). The guide names the obligations: privacy impact assessments before deployment, updated privacy management plans, a documented acceptable-use policy, third-party vendor assessments, data residency in Australia where feasible, and mandatory human review of any AI output that affects individual access to a service. The IPC's framing is that a "set and forget" approach is not enough.
Why this matters: The NSW Department of Education is the largest NSW public sector agency and therefore bound by this guide. For school IT leads and business managers inside the NSW public system, the practical work this fortnight is mapping the AI tools currently in use (NSWEduChat plus whatever sits in the shadow tooling layer) against the seven IPC tests and identifying where the school is short. For independent and Catholic networks not technically bound by the guide, the IPC text is the cleanest sector-relevant checklist published in Australia this year and reads as the de facto standard the OAIC's December code will likely codify. Digital Watch Observatory on the IPC's generative AI privacy guidance, and Maddocks on Privacy Awareness Week 2026 and the smart tech guidance for NSW government.
The Privacy Act automated decision-making clock is at two hundred days
The Privacy and Other Legislation Amendment Act 2024 introduces mandatory transparency duties for any APP entity that uses automated systems to make, or substantially assist in making, decisions that significantly affect individuals. The provisions take effect on 10 December 2026, two hundred days from this morning, and require entities to disclose in their privacy policies the kinds of personal information used, the types of decisions made, and the categories of decisions that significantly affect rights or interests. Universities, TAFEs, and large school systems that use AI for admissions, eligibility, assessment marking, recruitment, or student support recommendations are squarely in scope.
Why this matters: For university registrars and DVCs, the work between now and December is a system-wide audit of where an automated or AI-assisted system is part of a decision pipeline, and the privacy policy rewrite that follows. For school systems running attendance, behaviour, or wellbeing flags through any kind of AI-assisted scoring, the same audit applies and the answer is often "we don't know yet". For ed-tech vendors selling into the sector, the question to expect in every renewal conversation from August onwards is whether the product's automated outputs can be explained, traced, and overridden. Vocare Law's read of the December amendments, and the Johnson Winter Slattery analysis of the practical implications.
Microsoft's whole-of-government deal starts in six weeks and resets the Copilot baseline
The Microsoft VSA6, the five-year volume sourcing arrangement the Digital Transformation Agency negotiated for the Commonwealth, commences on 1 July 2026. It bundles Microsoft Copilot, Microsoft 365, Azure, Dynamics 365, and security and identity services under capped price increases, and sits inside Microsoft's separate A$25 billion (about US$18 billion) infrastructure commitment through 2029. The federal Department of Education and the interim Australian Tertiary Education Commission both sit inside the agreement's scope.
Why this matters: The VSA6 sets the procurement reference price every state department, university, and large diocese will negotiate against for the next five years. For state Department of Education CIOs reading the Brisbane Catholic Copilot rollout (12,500 staff, 80,000 addressable students) and the Microsoft Elevate credential as the implementation evidence, the VSA6 closes the price-discovery question that has slowed state-level decisions through 2025. The harder question for the sector is whether the Copilot baseline is now the assumed AI floor in every tender response from August, with state-built tools (NSW EduChat, WA ClassmAIte, SA EdChat) positioned alongside rather than against it. Computer Weekly on the five-year VSA6 deal, and Microsoft on its A$25 billion Australian investment.
EDUtech Sydney lands at ICC Sydney on 3 and 4 June
Terrapinn's EDUtech Australia 2026 runs at ICC Sydney across Wednesday 3 and Thursday 4 June with more than 350 speakers and a 15,000 square metre exhibition floor. The agenda spans K to 12 leadership, higher education transformation, vendor product showcases, and the AI procurement breakouts the sector spent the autumn telling vendors to run. The Innovation Alley stream curated by EduGrowth is the Australian ed-tech startup showcase, and the floor question every state procurement team should be asking is which AI tools published an OAIC submission to the Children's Online Privacy Code and which did not.
Why this matters: For state and diocesan CIOs, EDUtech is the only Australian floor where the Compass, Sentral, Schoolbox, Stile, and Edrolo procurement conversations all run in one place across two days. The conference lands eleven days from this morning and three weeks before the Microsoft VSA6 starts trading, which makes the vendor side of the floor more compressed than usual: a tool that cannot answer the IPC's seven test privacy checklist or the December automated decision-making disclosure question is a tool that should be marked down in the post-conference shortlist. For school principals not attending, the materials usually come back into the public domain inside two weeks. EDUtech Australia 2026 agenda and registration.
The thread this morning is the operational distance between the policy that has been published, the law that comes into force in December, the procurement floor that resets in six weeks, and the conference floor that opens in eleven days. The institutions reading the four together this Sunday will be the ones with sharper procurement and compliance questions on Tuesday morning. More on the operational landscape at digitalattitudes.com.au.