App vetting gap widens as parent AI survey lands

Digital Attitudes, 24 September 2026

Thursday in the September school holidays, and the operational question of the week is who is watching. A UNSW audit says nobody is watching the apps. A TrendLife survey says parents are not watching their kids on AI. And the sector critique of the two Group of Eight OpenAI deals now names the specific consultation that never happened. Three procurement briefs for the Term 4 board paper.

Nobody vets the apps in Australian classrooms, and the two September breaches are the reference cases

Writing in The Educator on Wednesday 23 September, Brett Henebery consolidated the case that Australia has no single national body vetting the educational apps schools plug into, against the backdrop of two September breaches: the Mathspace incident on 3 September (over a million users, an unpatched vulnerability left open for 23 days) and the Canvas breach on 6 May (275 million records across 9,000 institutions in 41 countries) (The Educator on the app vetting gap in Australian classrooms). The piece leans on a UNSW audit of nearly 200 school-endorsed apps which found most begin harvesting children's data within seconds, often in direct contradiction of their own privacy policies. SentinelOne's Jason Duerden on the record calls for "one minimum security standard for every classroom platform" with centralised verification instead of the current per-principal audit. Arctic Wolf's Steve Hunter adds that nearly 10 per cent of publicly disclosed software vulnerabilities this year (roughly 3,000) remain unanalysed.

Why this matters: for a director of digital learning, a school ICT lead, or a Term 4 procurement panel writing a 2027 tender, the vetting patchwork is now the specific gap the Digital Duty of Care draft (submissions closed Tuesday) and the OAIC Children's Online Privacy Code (register by 10 December) will both be measured against. Two operational reads. First, the vendor scope. The current model is a state education department "recommended list" that each school layers its own audit on top of, and it stops at the front page of a vendor's privacy policy. The UNSW finding that most apps start harvesting inside seconds is the argument the school procurement paper needs to name in writing before the next EDU app is added to a NSW T4L, a Victorian FUSE, or a Queensland Learning Place list. Second, the operational read. Duerden's "one minimum security standard" is the specific ask an AISNSW, AISWA, ISV, CEWA or CSNSW policy officer can now put to the OAIC or the eSafety Commissioner in writing this term, and the vendors most exposed to a centralised standard are the ones already inside the school stack: Mathspace, Reading Eggs, Studyladder, Cluey, Atomi, Mathletics and Essential Assessment. A 2027 board paper that treats vendor security as a per-vendor conversation is a paper written to the model the two September breaches just tested.

TrendLife's Australian parent survey lands: 92 per cent say they keep up, 42 per cent actually talk to their kids about AI

TrendLife published its "AI and Family Life" research on Wednesday 24 September, presented at a Families in the Age of AI event in Sydney the night before. The study surveyed 1,030 Australian parents who use AI regularly and have at least one school-aged child using AI at home. Three in four households say their school-aged kids are already using general AI tools (ChatGPT, Gemini, Claude), mostly for homework help and research. 52 per cent of parents say their teens are regular users, and 32 per cent of parents of five to twelve year olds say the same. But 92 per cent of parents believe their household is keeping pace with AI, and only 42 per cent actually sit down and talk with their kids about how they use it. Parents aged 25 to 34 are both the most enthusiastic (62 per cent already pay for an AI tool) and the most anxious about being left behind (The Sector on TrendLife's Australian AI and Family Life research).

Why this matters: for a school principal, a head of digital learning, or a head of pastoral care writing a Term 4 parent communication plan, the 92 per cent versus 42 per cent gap is the specific operational number the parent night presentation and the Term 4 acceptable use letter need to cite. Two operational reads. First, the parent communication read. If the parent survey says households believe they are keeping pace but only 42 per cent are actually talking to their kids about AI use, the school parent night is where that conversation gets started, not the vendor. The Term 4 parent communication plan for any Australian K to 12 school should carry a specific "talk to your child about how they use AI" prompt for each year level, ideally aligned with the ClassmAIte, EdChat, NSWEduChat or Gemini for Education tool the school itself has already switched on. Second, the assessment read. If a third of parents of primary students say their child is a regular AI user at home, the assessment framework for Years 5 and 6 that assumes AI is a Year 10-and-up conversation is a framework written to a household reality that no longer holds. NSW's 15 per cent take-home cap for HSC from 2027 (covered Tuesday), the Victorian Term 1 2027 device-free primary rules, and the NESA push toward supervised assessment all now sit on top of a parent base that is quietly outsourcing homework help to a chatbot the school never approved. Print the two numbers on the Term 4 board paper and the assessment conversation writes itself.

The Group of Eight OpenAI deals draw a consolidated sector critique, and the NTEU line is now on the record

Writing in Campus Review on Monday 21 September, Euan Kielly consolidated the sector critique of the two Group of Eight OpenAI deals (UNSW on Wednesday 10 September, University of Sydney on Sunday 14 September), naming the National Tertiary Education Union as the specific voice that was not consulted before the two ChatGPT Edu partnerships were signed (Campus Review on the sector critique of the UNSW and University of Sydney OpenAI deals). Greens Deputy Leader and Higher Education Spokesperson Senator Mehreen Faruqi is quoted on the record against both deals, following her appearance at the USyd rally on Wednesday 16 September (covered in Thursday's brief). The piece lands in the same week the NTEU is still bargaining on AI protections at USyd, three weeks after the 2 September 24 hour strike that shut labs and pushed most classes online.

Why this matters: for an Australian DVC, provost, or head of teaching and learning writing a 2027 AI framework this term, the Campus Review piece is the first sector-wide consolidation of the consultation gap the two Sydney signatures produced. Two operational reads. First, the governance read. The two Go8 deals were both signed before the NTEU or the student representative bodies were formally consulted, and the specific paragraph the 2027 university AI policy needs is a named pre-signature consultation trigger with the Academic Board, the NTEU branch, and the SRC on the list. UNSW's implementation posture (ChatGPT Edu with a Responsible AI Framework on top) and USyd's parallel Cogniti-plus-ChatGPT Edu structure both need a written response to the consultation-first argument, not an implementation guardrail written after. Second, the vendor read. OpenAI now has four announced Australian deals in nine months (La Trobe December 2025, UNSW 10 September, USyd 14 September, and the OpenAI for Australia NEXTDC S7 supercluster from December 2025 targeting late 2027 first phase). Anthropic's Claude for Teachers K to 12 offer sits at zero cost through June 2027, and Google's Gemini for Education study notebooks landed 17 September. A 2027 tender written in Term 4 that does not name whether the vendor's product was preceded by a documented consultation with staff and students is a tender written to the model the Campus Review piece just critiqued.

Anthropic's Kogan deal drags a coal plant proposal into the education compute conversation

On Thursday 17 September, Nationals MP David Littleproud used the announcement of Anthropic's $32 billion Western Downs Digital Park lease (Tuesday 16 September brief) to call for a duplication of the 750 MW Kogan Creek coal-fired power station to underwrite the site's 2.16 GW peak capacity, with the line "we're getting to a point where technology is outstripping energy supply" (ABC on the Littleproud coal call for the Anthropic Kogan data centre). Littleproud also floated nuclear, and named the site's water draw as "effectively six Olympic swimming pools" per year, with a written Anthropic assurance on the record. The proposal sits inside a wider federal picture: 27 approved-but-unbuilt data centres from AWS, Microsoft, AirTrunk, CDC, NEXTDC, Goodman and Stockland (representing at least 3.38 GW) escape the incoming national standards because retrofit is off the table.

Why this matters: for a university chief data officer, a research pro vice-chancellor, or a K to 12 system director writing a 2027 AI vendor register, the Littleproud proposal drags the emissions and water paragraph of the Term 4 board paper from a footnote into the front page. Two operational reads. First, the sovereignty read. Anthropic's Kogan site anchors the "we do have local Claude compute from 2027" answer that the ANU, Curtin, MCRI and Garvan pilots have already made procurement conditional on, and the emissions profile now attaches to that same paragraph. A university 2027 vendor register that names Claude without naming Kogan and without naming whether Anthropic's stated long-term renewable PPAs land inside the LTA cycle is a register that missed the political framing this week added. Second, the escape-clause read. The 27 pre-approved data centres carrying 3.38 GW past the new rules include the ones the education sector is already procuring against, and the specific question the 2027 board paper needs to answer is whether the school or university's preferred vendor is running on a site subject to the national standards or one that escaped. A 2027 AI vendor scorecard that treats "Australian compute" as one column is a scorecard that missed the standards-inside or standards-outside distinction the coal proposal just made visible.

Four moves, one Thursday. A vetting gap that names the platforms, a parent survey that names the household gap, a governance critique that names the consultation gap, and an energy proposal that names the compute gap. Put the four numbers on the Term 4 board paper and the operational shape at digitalattitudes.com.au has a template to work against.