AI in Schools
eSafety penalties double, ASD retires Essential Eight
Digital Attitudes, 1 July 2026
The Wednesday read is one federal amendment that doubles the maximum penalty eSafety can put on a social media operator and gives the commissioner the right to compel evidence from age assurance providers and app stores, one Australian Cyber Security Centre announcement that puts the Essential Eight on a two year sunset path and opens a new framework for consultation, one Stanford service announcement that lands ChatGPT Edu, Gemini Enterprise and Claude for Education in every faculty, student, postdoc and staff account on the same day, and one peer reviewed study published the same week that names the AI literacy variable Australian universities have been writing the wrong curriculum against.
Federal Government doubles eSafety penalty and gives the commissioner compel powers
Eleanor Dickinson at iTnews reported on Monday 29 June that the federal government will amend the online safety legislation to give the eSafety Commissioner the power to compel social media operators to produce evidence of compliance with the under 16 ban, gather information from third parties such as age assurance providers and app stores to verify platform claims, and lift the maximum penalty for systematic non compliance from AUD$49.5 million to AUD$99 million. Prime Minister Anthony Albanese named the trigger: "I'm heartened by the shift in conversation and the global momentum we've seen since introducing the social media minimum age, but it's clear big tech are not doing enough to comply." Communications Minister Anika Wells named the failure mode the amendments target: "social media platforms are adopting tricks straight out of the big tech playbook and doing the bare minimum." The evidence base sits in a British Medical Journal study the iTnews article cites, which found 85 per cent of Australian teens aged 12 to 15 still used social media three months after the December 2025 commencement, with two thirds of those teenagers circumventing age controls through self declared ages or one tap selfie verification. iTnews on the federal government strengthening eSafety Commissioner powers, 29 June.
Why this matters: For Catholic, AIS and government school principals who have been administering the under 16 ban as a recess and lunchtime phone rule against the eSafety incident reporting framework that has carried the deepfake, sextortion and online harassment escalation path since 10 December 2025, the operational read is that the commissioner now has a new lever to compel the social media operator to produce its own internal compliance evidence, and the question the next staff briefing answers is whether the school's serious harm escalation pathway gains anything new from the commissioner's expanded information gathering powers or whether the existing report at eSafety.gov.au/report channel still does the same job. For state Department of Education chief information security officers and the Independent Schools NSW, AISWA and ISV legal teams that wrote the age assurance and account creation policy each member school carries into term 3, the read is that the commissioner can now name the age assurance vendor whose work the school's policy relies on as a source of compliance evidence, and the question the term 3 policy paper answers is whether the school's existing age verification position needs an audit trail the commissioner can read or whether the existing parent declared age workflow still holds. For ed-tech vendors selling student accounts, school portals and learning platforms into the under 16 cohort (Education Perfect, Stile, Atomi, Compass, Sentral, Schoolbox), the procurement read is that the regulator who is the closest peer to the Office of the Australian Information Commissioner on student data has just doubled the financial penalty on the platform operator next door, and the vendor whose age assurance workflow cannot answer the same question the commissioner is now putting to Meta, ByteDance and Snap is the one whose next school renewal paper has the wrong audit trail on the first page.
ASD puts the Essential Eight on a 24 month sunset and opens a new framework for consultation
Richard Chirgwin at iTnews carried Chris Horlyck, head of cyber security resilience at the Australian Cyber Security Centre inside the Australian Signals Directorate, on Tuesday 24 June naming a two year transition path that will retire the Essential Eight maturity model first published in 2017 and replace it with a broader Essentials series covering enterprise IT, cloud, operational technology and agentic AI as separate security domains. Horlyck named the gap the new framework targets: "Essential Eight started before cloud was really a big thing." The transition timeline puts the first 12 months on deprecation and the next 12 months on full retirement, with both frameworks running in parallel through the period and the public consultation on the replacement open through Saturday 12 July 2026. The complaint the ACSC head named alongside the change was that the shifting maturity level definitions through the seven year life of the Essential Eight have made organisations look like they were going backwards on cyber security posture when no actual deterioration had occurred. iTnews on ASD retiring the Essential Eight framework, 24 June.
Why this matters: For state Department of Education chief information security officers and Catholic system IT directors who have spent the last three audit cycles writing the Essential Eight maturity level into each annual board report against the existing Sentral, Compass, Schoolbox, ClickView, Microsoft 365 and Google Workspace tenant the network runs on, the operational read is that the framework the audit committee has been asking about each November now sits on a sunset clock, and the question the next IT board paper answers is whether the school carries the Essential Eight reporting through to the framework's full retirement in mid 2028 or whether the cyber risk register pivots to the cloud, SaaS and agentic AI domains the Essentials series will name as standalone control sets. For university CIOs and chief information security officers writing the cyber resilience board paper against the Canvas, Workday, Oracle PeopleSoft and ServiceNow tenant the institution runs on after the Reynella East and Vic schools cyber events of the last 12 months, the read is that the existing Essential Eight maturity benchmark that has sat at the top of the IT audit since 2018 is about to be retired, and the question the next audit committee answers is whether the consultation paper open through 12 July gets the institution's submission against the cloud and agentic AI control framing or whether the audit position stays inside the existing baseline through the transition. For cyber security vendors selling control, detection and audit products into Australian education (CrowdStrike, Microsoft Defender, Sophos, ThreatLocker, Cisco Duo, Okta, KnowBe4), the procurement read is that the ACSC has just named cloud, OT and agentic AI as separate audit domains, and the vendor whose product roadmap cannot answer the standalone shared responsibility model question the new framework will codify is the one whose next renewal sits at the wrong level on the next education sector RFP.
Stanford puts ChatGPT Edu, Gemini Enterprise and Claude for Education in every account on the same day
Stanford University IT announced on Tuesday 30 June that all Stanford faculty, students, postdocs and staff now have base tier access to OpenAI ChatGPT Edu with GPT 5, Codex and Open API; Google Gemini Enterprise with NotebookLM and Agent Designer; and Anthropic Claude for Education with Claude Chat, Claude Code and Claude Cowork. The arrangement runs as a campus pilot through August 2027 with utilisation evaluation before continuation, base access at no charge to the user, premium tiers (ChatGPT Pro, Gemini Enterprise Pro, Claude Premium) available against Stanford negotiated discounts and charged monthly to the user's PTA. The data classification table runs across the three products: ChatGPT Edu and Gemini Enterprise approved for low, moderate, high risk data and protected health information; Claude Chat approved for all classifications except protected health information; Claude Code and Cowork approved for low, moderate and high risk data with protected health information routed through Stanford's AI API Gateway. Stanford IT named the trigger for the multi vendor entitlement: "Stanford's licenses will enable better data protection as well as more favorable pricing" relative to the research group level subscriptions that staff and students had been buying on their own through the back half of 2025. Stanford University IT on the three vendor AI tools arriving on 30 June.
Why this matters: For Group of Eight vice chancellors and university chief information officers reading the Stanford precedent against the UNSW Sydney 10,000 licence ChatGPT Edu agreement that the brief priced as the biggest education sector OpenAI deal in Australia, the ANU School of Computing partnership with Anthropic the AI brief carried in March, and the Monash University Claude for Education entitlement the same paper read in May, the operational read is that the U.S. flagship has just published the multi vendor procurement model the Australian sector has been writing toward, and the question the next vice chancellor briefing answers is whether the university's 2027 AI tooling baseline goes to a single preferred vendor or whether the term 2 2027 staff entitlement carries the three big frontier vendors at the base tier and pushes the user toward premium tiers at negotiated rates. For deans of teaching and learning, pro vice chancellors education and chief data officers writing the AI assessment, AI in research and AI in administration policy against the Pacific Northwest, North American and European reference institutions, the read is that the Stanford framing puts the data classification at the centre of the entitlement decision, with the protected health information line drawing the Anthropic, Google and OpenAI products into different access patterns inside the same institution, and the question the next academic board paper answers is whether the Australian university's existing data classification scheme is the one the AI procurement decision is now actually being made against. For ed-tech vendors selling AI tutoring, AI marking and AI in administration products into Australian universities (Cengage, McGraw Hill, Pearson, Wiley, Blackboard, Canvas, Workday, Ellucian), the procurement read is that the Stanford pilot just absorbed coding (Claude Code), agentic desktop (Claude Cowork), notebooks (Gemini NotebookLM, study notebooks already at Google), and the API tier (ChatGPT Open API, Claude Code direct) into the standard staff and student entitlement at no marginal cost, and the vendor whose paid product cannot name a clearly differentiated value the institution gets from the renewal beyond the frontier base tier is the one whose 2027 contract conversation answers a dean who has just read the Stanford IT page on the next tab.
Peer reviewed study names the AI literacy variable Australian curricula are missing
Emma Thompson at EdTech Innovation Hub carried a peer reviewed study from Qi Xia (Zhejiang University), Norah Salem Aldharman (University of Bisha) and Thomas K. F. Chiu (the Chinese University of Hong Kong), published in the journal TechTrends on Tuesday 30 June, that ran 333 art and design university students through a one week ChatGPT workshop and surveyed the cohort against autonomy, critical thinking, AI ethics and self regulated learning measures. The headline finding the study landed: critical thinking (coefficient 0.324) and perceived autonomy (0.203) directly predicted effective learning management, and "a generally positive attitude toward AI did not significantly predict self regulated learning." The ethics variables sat alongside the critical thinking number: students' ethical perceptions of AI use scored a coefficient of 0.143 against self regulated learning, and students' beliefs in AI's social good scored 0.257, both meaningful predictors that the same regression named the general enthusiasm measure as failing to predict. The implication the article carries forward: Australian universities writing AI literacy units focused on the prompting, drafting and integrity surface have been writing the wrong measurement framework, and the curriculum that builds the privacy, fairness, misuse, accountability and impact reflection layer is the one the regression names as the actual driver of student learning behaviour change. EdTech Innovation Hub on the AI ethics and self regulated learning study, 30 June.
Why this matters: For the Group of Eight Education Committee, Innovative Research Universities and Regional Universities Network deans of teaching and learning writing the AI literacy curriculum baseline against the TEQSA assessment integrity guidance and the Australian Framework for AI in Higher Education the brief priced through May, the operational read is that the first peer reviewed evidence that ethics anchored AI education actually shifts student learning behaviour has now been published, and the question the next term 3 curriculum board paper answers is whether the institution's existing AI literacy unit (the prompting skill, the integrity workshop, the AI tool comparison module) gets an ethics anchored design rebuild or whether the existing structure carries the cohort through to graduation against the regression the study has now put on the page. For school heads of digital learning and teaching and learning leads writing the equivalent year 7 to 12 AI literacy unit against the AERO research agenda 2026 and the Australian Framework for Generative AI in Schools, the read is that the variable the literature has now named as the predictor of self regulated learning is the ethics anchored frame, not the technical familiarity or the enthusiasm measure, and the question the term 3 staff meeting answers is whether the school's existing digital literacy curriculum gets the privacy, fairness, accountability and social good layer that the study names as the predictor or whether the unit stays at the tool comparison level. For ed-tech vendors selling AI tutoring, AI literacy curriculum and AI integrity products into Australian schools and universities (Khanmigo, MagicSchool, Eduaide, Education Perfect, Stile, Atomi), the procurement read is that the journal article cited by the trade press the institutional buyer reads first thing in the morning has just named the ethics anchored AI literacy as the variable that actually shifts student behaviour, and the vendor whose curriculum cannot point at a privacy, fairness, accountability and social good anchored design is the one whose next pitch is going to the wrong reading of the literature.
The Wednesday thread is the federal government raising the financial cost of failing the under 16 social media ban while giving the regulator the right to compel the evidence base, the ACSC putting the cyber framework the sector has audited against since 2018 on a two year sunset, the U.S. flagship university publishing the multi vendor AI procurement model the Australian sector has been writing toward, and the journal literature naming the AI literacy curriculum design the Australian sector has not been building. More on the operational read at digitalattitudes.com.au.