The American Federation of Teachers walked into a Microsoft meeting with a simple demand: classroom AI does not get to train on kids. The deal that followed, reported by SecurityWeek, commits Microsoft to privacy standards and guardrails for school deployments. If you run cybersecurity for a district, a hospital, or a bank, that clause should sting. A union just treated model training as a contract fight. Most of your SaaS riders still call it product improvement.

The clause a union extracted and you didn’t

Microsoft’s school announcement is easy to file under education news and ignore. File it under procurement instead. The American Federation of Teachers treated student prompts, essays, and classroom transcripts as data with a purpose limit. Vendors love purpose limits in slide decks. They leave “help us improve the model” enabled in the admin tenant, where nobody from legal ever clicks.

If you buy the same Copilot family, or a close cousin, for a credit union or a clinic, you are running the unconstrained SKU. School systems now have a political backstop. You have a data processing addendum that probably lets the vendor learn from your tickets unless you strike the language. That gap is the story. The signal lives in a setting you never opened, not in a malware alert.

Google and the rest of the classroom market have not signed the same public terms. SecurityWeek asked whether other tech giants will follow. They will follow a purchase order. If your board wants responsible AI, put the ban in the rider: no training on tenant content, no human review of prompts without a named legal basis, deletion on a clock you can audit. The union did not wait for a standards body. Neither should you.

Search still needs the page; training wants the corpus

Cloudflare spent this week prying apart two jobs vendors glued together. Site owners can stay discoverable in search while telling AI crawlers they are not a free pretraining set. The Accountable designation is a shared model with Apple, Google, and Microsoft. The companies that rank the web and the companies that train on it are finally naming those as different collection programs.

You should care if you do not run a publisher. Your status pages, knowledge bases, and public ticket portals get scraped. So do the PDF manuals someone posted in 2019. Split indexer traffic from trainer traffic in policy. A single firewall bot deny list will treat a named search crawler and a model ingest client as the same nuisance. Your robots policy and your CDN controls have to distinguish ranking from ingestion. Until they do, you already consented. Public API docs and status-page clones belong in that same pile: production data that happens to be world-readable, then a decision about which crawlers get a copy.

Malwarebytes reminded consumers that ChatGPT contractors have been reading real conversations. Opt-out toggles exist. Defaults still feed the corpus. Watch your own staff. They paste incident details, customer identifiers, and network diagrams into a chat pane because the pane sits next to the ticket. Your threat detection pipeline never sees a payload. Licensed software did the copy. That copy will not show up in last month’s phishing metrics.

Bruce Schneier and Cindy Cohn, writing in Lawfare and posted on Schneier’s blog, marked twenty-five years since the post-9/11 turn from targeted wiretaps to mass take. Backbone taps. Bulk metadata. Tools sold as counterterrorism that now show up in ordinary policing, including ICE work. The architecture outlived the original pitch. AI training is the commercial remix. Collect first. Invent the use case later. Retain because the weights might need another pass. You watched governments do this in the name of threat-protection. Vendors repeat it with a checkbox.

Cybersecurity inherits the logs the contract never covered

You can close this gap without waiting for Congress or for Microsoft to productize the school terms for every commercial tenant.

Start this afternoon with an inventory. List every copilot, chatbot, meeting summarizer, and ticket-bot that can see customer data or source. For each one, capture three facts: whether training is on, whether humans can review prompts, and where transcripts live. Those three answers are the control. A subscription without them is guesswork.

Turn the training switches off in the admin consoles you already pay for. Then put the same ban in writing. Copy the spirit of the AFT deal: tenant content stays out of the corpus, human review needs a legal basis, deletion is scheduled. Send it as a rider, not a Slack question to the account manager.

For public sites, split crawlers the way the new Accountable model tries to split them. Allow the indexer that keeps you findable. Disallow the trainer. Do it in robots.txt, CDN bot management, and WAF policy so one mis-set header cannot undo the others. Security hardening here is boring, and it works. Defense in depth means the legal clause, the crawler policy, and the admin toggle all say the same thing.

Build the ongoing loop. Quarterly, re-check the toggles; vendors relabel settings during “improvements.” Add prompt and paste monitoring to the same DLP you use for email. Teach incident response to treat a leaked chat log like a file share dump: scope the identifiers, revoke the session, demand the vendor’s retention proof. If a vendor later says contractors sampled your threads, you need a named owner, a legal hold request, and a customer-notification threshold before the press call. Rehearse that once. Your cyber security program already spends real money chasing brute-force noise at the edge. Spend a smaller slice on the API path that never trips an IDS.

The teachers noticed that collection always outlives the pitch. Your next renewal is the chance to catch up.

Sources

• Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow?
• Have it both ways: stay discoverable in search while disallowing AI training
• How to opt out of AI chatbot training
• 25 Years of Mass Surveillance Is Enough