EDUCATION
IT support for schools
The window is set by somebody else.
Schools and districts buy through state contracts, cooperative agreements and program-specific funding, on cycles tied to fiscal and academic years rather than to when a project is ready. Most run lean teams carrying identity, endpoints, network and security at once.
The constraint is almost never knowledge. It is that the window to act is short, it is set by a funding rule or a directive rather than by the district, and by the time anyone has read the rule closely enough to act on it the window has usually closed.
Four things that cost schools money, in order of how much
01
Program eligibility that is never established
E-rate is the clearest case in American education finance. The rules are published in full at 47 CFR 54.500 through 54.516. Almost nobody reads them against their own situation.
Three provisions decide most outcomes and most districts have never had them explained.
The Category Two budget is a per-student calculation with a floor. For the FY2026 through FY2030 cycle it runs at $201.57 per student, with a floor of $30,175 for small schools. A district that has never calculated its own number does not know whether it is leaving budget unused, and unused Category Two budget does not roll forward indefinitely.
Extrapolation is prohibited. You cannot take a sample of eligible students and scale it. The count has to be actual. Districts that estimated have had funding commitments rescinded on review, which happens after the money has been spent.
Retention runs ten years. Documentation supporting a funding request must be held for ten years after the last date to receive service. That is longer than most district document retention policies specify, longer than most staff tenures, and it applies to records nobody thought were records.
There is also a disqualifier worth knowing if you are an independent school: an endowment above $50,000,000 removes eligibility entirely.
E-rate program values are set per funding cycle. Verify current figures against USAC before relying on them.
02
Student data privacy, which is state law before it is federal
Most districts believe the federal regulations govern this. They do, in the sense that they set a floor. But the binding, enforceable obligations on your vendors are state obligations, and they contradict each other.
The federal provision that decides what a school may disclose to a technology vendor, 34 CFR 99.31(a)(1)(i)(B), was last amended in December 2011. The definition of an education record at 34 CFR 99.3 was last amended the same month. Neither was written with generated content or AI output in view, and the Department of Education’s rulemaking to clarify them was scheduled for January 2026 and has not published.
The states have not waited, and they do not agree.
Requirement | New York | Illinois | California |
|---|---|---|---|
Vendor breach notice | 7 calendar days from discovery | 30 calendar days from determination | No provision at all |
Mandated contract terms | Security plan, signed Parents Bill of Rights, staff training attestation | Data categories, breach cost allocation, deletion timeline | None |
Named security standard | NIST Cybersecurity Framework alignment | Not specified | “Reasonable” practices |
Contract made public | Parents Bill of Rights only | Full agreement posted within 10 business days | Not required |
Two things follow from that table, and both are actionable this week.
The clocks do not just differ in length. New York runs from discovery of a breach. Illinois runs from determination that a breach occurred. Those are different moments, separated by exactly the period in which a vendor is investigating.
And when a vendor tells you it is compliant, the useful question is not whether. It is with which state. A vendor built to New York has, in substance, built to the strictest regime in the country. A vendor built to California has committed to nothing contractually, because that statute mandates no contract terms at all.
03
AI policy, which is now statute and not guidance
Thirty-five states have issued AI guidance for schools. Almost all of it is non-binding and says so on its face. The binding instruments are a much smaller set, they arrived in the last twelve months, and several impose duties directly on your vendors rather than on you.
Ohio. Revised Code 3301.24 required every district, community school and STEM school to adopt an AI use policy by 1 July 2026. That deadline has passed.
Idaho. Code 33-7007 requires vendors to disclose whether their products use machine learning, predictive analytics or generative AI, and to provide assurances on data protection and algorithmic transparency. That duty lands on the vendor, as a matter of statute. Most procurement questionnaires still do not ask.
Virginia. Code 22.1-20.2:1 contemplates data privacy agreements that prohibit the use of any division-level or student data for training or improving external AI models, and requires that teachers have access to transcripts of student interactions.
California. AB 1159, signed 10 September 2026, is the first AI training prohibition written into a student privacy statute.
None of them answers the question that actually matters: if an AI system generates an assessment about a named student, is that an education record the parent can inspect and demand be corrected? There is no federal answer, and no standard education technology contract contemplates it.
04
Change windows shorter than the change process
Remediation deadlines now arrive by directive with a fixed clock. Your change management process was designed to prevent outages, and it does that well. It was not designed against a clock set by somebody else.
The arithmetic is worth doing once. Take your last critical patch, count elapsed calendar days from disclosure to production, and compare it to the window you are actually bound by. Most districts have never done it, and the gap is usually larger than anyone expects.
What we do
Qwalora establishes what is true, in writing, with every finding cited to the published rule or the vendor’s own term and the date it was read. Where something cannot be verified, we say so rather than estimate it.
Practically, that means Microsoft 365 and Entra environments, identity and device management, network modernization, licensing and eligibility, and procurement that fits the vehicles and timelines schools actually buy through.
We also supply. Qwalora holds reseller and distribution arrangements with technology vendors and earns margin on products it supplies. We earn no margin from you on any product named in a report delivered to you, during the engagement and for twelve months afterward. Supply is a separate agreement, and you are free to act on every finding through any reseller you choose.
Most firms that can tell you what you are overpaying for have a reason not to. We wrote that reason out of the contract.
Where to start
Licensing Review
Fixed fee, ten business days. Your entitlement against your spend against the programs you qualify for. What is recoverable, what is exposed at your next renewal, what you are paying for twice.
AI Exposure Review
Fixed fee, fourteen calendar days. Which AI services are in use including the ones nobody approved, what terms apply at the tier each is on, whether staff reach them on school or personal accounts, and what an assistant grounded in your own files would surface to an ordinary member of staff.
Change Window Review
Fixed fee, fourteen calendar days. Your actual change path measured in elapsed days against every window you are bound by, and the single change that would most shorten it.
The evidence
We publish the research these engagements rest on, in full, with every source named and dated.
Why the advice does not transfer. Research Note 2026-04. Sixteen pages, twenty-seven primary sources, on artificial intelligence in K-12 schools and the nine structural reasons corporate AI governance advice does not apply to a school. Includes the full state comparison above and a list of the seven things we could not verify.
The discount you did not claim. Research Note 2026-02. Fourteen pages, eighteen primary sources, on school technology procurement and the programs districts qualify for and do not claim.
KEV remediation window, BOD 26-04. What happens when the mandated window closes before the change process finishes.
Before you contact us
Ask your technology vendor which state’s student privacy regime it built to. Not whether it is compliant. Which state.
If the answer is a brochure rather than a state, you have learned something useful, and it cost you one email.
Book a thirty minute scoping call
We establish what is in scope, what we would need from you, and whether this is the right engagement at all. You receive a fixed quote in writing afterward. No obligation and no follow-up sequence.