Learn21's Weekly EdTech Update
September 17, 2026
| | The New Shadow IT Is Shadow AI
By Stacy Hawthorne, Ed.D. | | |
For years, technology leaders worried about shadow IT. A teacher found a useful website, created an account, uploaded a class roster and started using it before anyone in the district knew the product existed. No security review. No privacy agreement. No procurement process. We built systems to deal with that.
Then AI arrived.
Now the challenge is bigger because shadow AI does not always look like a new piece of software. It might be a free chatbot someone uses to summarize a document. An AI meeting assistant that joins a video call. A browser extension that rewrites text. A feature quietly added to software the district already licenses. An employee using a personal AI account to speed up work.
The new shadow IT is shadow AI, and blocking a handful of websites is not going to solve it.
The Problem Is Not That People Want to Use AI
Educators are experimenting with AI because it can be genuinely useful. It can help brainstorm lessons, draft communications, organize information, create examples, translate ideas and eliminate repetitive work.
The U.S. Department of Education has explicitly recognized AI's potential across education while emphasizing that its use must remain consistent with privacy, security and other legal requirements.
The goal should not be to make AI harder to use. The goal should be to make responsible AI easier to use. This matters because when the approved path is unclear, inconvenient or nonexistent, people create their own path.
| | |
Imagine an employee with 20 pages of notes to summarize before a meeting. A public AI tool can do it in seconds. The important questions to ask areWhat information was entered? Where did it go? What happens to it next?
Those questions become particularly important in education, where AI systems may interact with student information, personnel information and other sensitive data. Federal guidance has repeatedly emphasized the need for stronger attention to privacy, security and governance when AI is introduced into educational environments.
AI Is Also Hiding in Plain Sight
Districts may think they know which AI products they use because they have approved Gemini, Copilot, or other platforms. But AI is increasingly becoming a feature, not a destination.
It is appearing inside productivity suites, learning platforms, communication tools and other software organizations already use. That means an inventory of “AI tools” cannot stop with the applications that have AI in their names.
Technology leaders need to begin asking vendors different questions. What AI capabilities are included in the product? Which are turned on by default? What data can those features access? Is customer data used to train models? Can AI functionality be disabled? What happens when the vendor adds a new AI feature halfway through the contract?
This is increasingly a governance issue, not simply a software issue. NIST's AI Risk Management Framework encourages organizations to manage AI as an ongoing organizational risk rather than treating it as a one-time technology review. CISA similarly stresses that data used by AI systems needs deliberate security protections throughout its lifecycle.
Make the Right Path the Easy Path
Districts need clarity to begin addressing shadow AI. Staff should know which AI tools are approved. They should understand what kinds of information should never be entered into public AI systems. They need simple guidance for evaluating unfamiliar tools and a straightforward way to request review of something new. Then give people good options.
If educators see meaningful value in AI but every useful tool is blocked, shadow AI is predictable. If the district provides secure alternatives, useful professional learning and clear expectations, responsible adoption becomes much easier.
A five-minute conversation about why entering confidential information into an unapproved AI tool creates risk will probably change more behavior than another paragraph buried in an acceptable-use policy.
Visibility Before Control
The instinct when something new creates risk is often to restrict it. AI is moving too quickly and becoming too embedded for a purely restrictive strategy to work.
District leaders need visibility into how AI is being used, thoughtful governance around sensitive data, stronger procurement questions, professional learning and approved tools that actually help people accomplish their work.
Shadow AI is not fundamentally a story about employees breaking the rules. It is a signal. When people are creating their own AI pathways, leaders should ask why the official pathway is not meeting their needs.
The districts that manage AI best will not be the ones that find a way to control every prompt.
They will be the ones that make responsible use the easiest choice.
| | |
Restrictions Alone Won’t Keep Kids Safe Online
New research highlighted by UNICEF USA suggests that habit and honest conversation protect children online more effectively than rules alone. This UNICEF USA piece makes the case for parent-led digital literacy, encouraging caregivers to talk openly with kids about what they encounter online rather than relying solely on restrictions and blocks.
TikTok’s Design Makes Critical Thinking Harder for Young Users
A new study finds that TikTok’s fast-scrolling format can leave serious mental health content sitting right next to unrelated entertainment, giving young viewers little space to pause and evaluate what they’ve just seen. This Digital Information World report highlights gaps in platform-specific media literacy and calls for schools to build stronger critical-thinking skills around online health advice.
Edtech Engagement Doesn’t Always Mean Learning, APA Warns
A new American Psychological Association report cautions educators against assuming that a highly engaging app or program automatically leads to real learning gains. This ISTE+ASCD SmartBrief summary explains why measuring what students retain after they close the app matters more than screen-time or click metrics.
| | |
When There is No Vendor to Ask
By Kevin Ghantous
| | |
Something real happened in the last two years. A person with a clear idea and no development background can now build working software. Not a mockup. A functioning application with a login, a database, and users. The years of training that used to stand between an idea and a product are no longer the barrier they were, and for anyone who has watched a good idea die waiting for a developer, that is good news.
What has not come along with it is everything that surrounds the code. Security, scale, and support were never the exciting part of building software. They are also the three things that decide whether a tool that works in August is still working, and still safe, in April.
Most of the current conversation about AI in districts focuses on the tools people use. This is about tools people make. A chat session ends when someone closes the tab. An application has users and a database, and it keeps running.
When a district buys software, it asks the vendor about security, scale, and support. A district building software has no one to ask.
Security. The instinct is to treat this as a skill gap, something a more careful builder would avoid. The data says otherwise. Veracode has been testing AI-generated code against the same benchmark since 2023, and their Spring 2026 update found that syntax pass rates climbed from roughly 50% to 95% over that period while security pass rates stayed flat, between 45% and 55%. The models got dramatically better at producing code that works. They did not get better at producing code that is safe. Some of the exposure is not in the code at all. When Wiz examined the Base44 platform, they found an authentication bypass that let anyone register a verified account on a private application using only an ID visible in the URL, defeating single sign-on entirely. It was patched quickly. The point is that a district can review the app it built and still inherit a vendor's security posture it never evaluated.
Scale. CoSN's 2026 State of EdTech report, drawn from 607 district leaders, includes a table of current AI initiatives. Twenty-two percent of districts report an initiative to research and develop custom solutions, including chatbots, GPTs, and custom apps built on Gen AI APIs. That is up from 15% the prior year. The next two rows in the same table: 7% report preparing identity access management systems and 7% report preparing data storage environments. Identity and storage are what carry a tool from one team to three buildings. Districts are building at three times the rate they are laying the groundwork that lets those builds survive their own success.
Support. Who is the person who built it? A classroom teacher, a paraprofessional, a curriculum coordinator. Their job description has not changed. When the tool catches on, and two more buildings want it, someone has to field the requests, fix what breaks, and answer the questions. That work is real, and it lands on someone who still has a full teaching load or a full caseload. If a district wants the value, it has to decide who backfills the role the builder is no longer fully doing. Most districts have not had that conversation, and without it the ending is predictable. The builder transfers in June, and in September the tool is still running, still holding student data, with nobody who knows how to maintain it or shut it down.
CoSN also found that 86% of districts have a process to vet tools before use. That machinery was built entirely for software someone else made and sold. Nothing in it has an input for "we built this ourselves."
Start by asking your staff what they have already built, and write the answers down. Then ask about security, scale, and support. Same questions you would ask a vendor. The tool deserves them either way.
| | Big Ideas: Your Body Is Now a Subscription Service | | |
Three stories on the frontier of monetizing what used to be private. There was a time when the human body did its business and nobody but you and your bathroom ever found out. That time is over. This week, capitalism has discovered your gut, your gums, and your gas, and it would like $30 a month to tell you what you already knew: you should eat more fiber.
The Underwear That's Been Counting Your Farts
University of Maryland researchers have built what they're calling the first wearable made specifically to track human flatulence: a small hydrogen-sensing disc that snaps onto the back of your underwear and quietly logs every, ah, event, feeding results into something called the Human Flatus Atlas. The measuring device is a small disc that snaps into the back of a person's underwear, using tiny electrochemical sensors to detect hydrogen and provide insight on the wearer's flatulence.
The pitch is earnest, if you squint: the team's ultimate mission is to help people eat high-fiber diets comfortably with low intestinal gas, and an estimated 95% of Americans don't eat enough fiber, so there's a real gut-health story buried in here somewhere. It even tracks sleep flatulence, a topic researchers say is completely understudied. But let's be honest, we've spent thirty years building smart everything (fridges, mattresses, doorbells) and the logical endpoint was always going to be a Fitbit for farts.
The Toilet That Judges Your Poop (Subscription Required)
Smart toilets have quietly become a real product category: Kohler, Toto, Withings, and a scrappy startup called Throne all now sell cameras and sensors that scan your stool and urine and text you a wellness report. Smart toilets use cameras, optical sensors, and AI to automatically track stool texture, urine color, and hydration, and Throne Science raised $10 million and sells the $399 Throne One camera plus a $5.99 monthly plan.
Naturally, there's a catch built right into the plumbing: gastroenterologists are skeptical that products relying on AI to analyze toilet-bowl images are worth the price, and data-privacy advocates warn people can get locked into long-term subscriptions just to access their own health data. Somewhere, a Victorian plumber is spinning in his grave at the idea of a toilet with a recurring monthly fee. The tech itself isn't nonsense,doctors do value the objective data for gastrointestinal patients, but pairing genuinely useful medical monitoring with an app-store business model is a very 2026 move.
The $500 Toothbrush With a Camera in Your Mouth
Dyson — a company that has now applied "the physics of moving air" to hairdryers, headphones, air purifiers, and vacuum cleaners — has entered the bathroom cabinet with the CameraJet, a toothbrush that includes a built-in camera, a water flosser, and a machine-learning model trained specifically on your teeth. The device uses a 100,000-pixel macro camera paired with an AI system to detect gaps between teeth and fire a jet of mouthwash at them in under 100 milliseconds, analyzing 28 frames per second.
It is, per the numbers Dyson clearly loves reciting, the product of six years of research and 470,000 dental images — and it will run you $499 in the US, with proprietary RFID-tracked brush heads adding recurring costs on top of the purchase price, a pattern familiar to anyone already in the Dyson ecosystem. A toothbrush that costs more than some people's rent-controlled dental work, live-streaming the inside of your mouth to an app. Sure. Why not.
Give it five more years and there'll be a wearable for your eye-rolls — sold separately, subscription required.
| | | | |
