Global Generative AI School Policy Tracker for ChatGPT Sites

Executive summary

The strongest design is not a directory of policy webpages. It is a versioned policy intelligence system that separates the issuing authority, the policy document, individual rules, source evidence, translations, and change history. That distinction is essential because a single jurisdiction can simultaneously permit classroom experimentation, prohibit AI-generated assessment evidence, impose privacy conditions, and leave procurement decisions to local authorities. Current official guidance in France, New Zealand, Japan, Singapore, England, Australia, and other jurisdictions already exhibits this kind of conditionality. ^[1]

Overall confidence: High on the recommended architecture, schema, source hierarchy, and the characterization of the exemplar policies. Moderate on global completeness, because policies are fragmented across ministries, examination authorities, states, districts, schools, privacy regulators, and non-English websites, and absence of a discoverable document cannot safely be interpreted as absence of a policy. UNESCO itself has noted that regulation has lagged the rapid diffusion of generative AI and has urged coherent, human-centered policy frameworks. ^[2]

The resource should have four core objectives:

The intended public audience should be adults, particularly parents, teachers, administrators, advocates, journalists, and researchers. That is also the safest fit for ChatGPT Sites. OpenAI's current Sites documentation says Sites can publish hosted interactive websites, support public or workspace-restricted audiences, use structured D1 storage and R2 file storage, and save versions before deployment. OpenAI also says Site owners are responsible for their Site and its content, that the Site owner is the controller of End User Data under the Sites terms, and that Sites should not be used to target children under 13 or the applicable age of digital consent. Sites also does not support data or inference residency at launch. ^[3]

That produces a clear product recommendation: make the initial Site public, read-only, citation-first, and account-free for visitors. Keep collection of personal information to effectively zero. Add optional email alerts or authenticated crowdsourcing only after a separate privacy review. An RSS/Atom change feed is a better first alert mechanism because it does not require collecting subscriber identities.

The dataset should also distinguish source reliability from policy force. An official ministry guideline may be highly reliable evidence but legally non-binding. A binding regulation may have greater legal force. Those are separate properties and should never be collapsed into a single "policy score."

Finally, universities should be an adjacent collection, not mixed into the default K-12 comparison layer. Their academic-integrity and GenAI policies are useful sources of emerging practices, but higher-education governance, student age, institutional autonomy, assessment design, and privacy obligations differ enough that combining university and school records without a clear education_sector facet would create misleading comparisons.

Scope, objectives, and users

The canonical scope should be formal and quasi-formal rules governing generative AI in primary and secondary education, with optional early-childhood and higher-education extensions. Include not only documents titled "AI policy," but also assessment rules, acceptable-use policies, data-protection directives, approved-tool lists, procurement standards, examination rules, teacher guidance, curriculum frameworks, and ministerial statements when those documents materially determine what schools, staff, or students may do.

A useful scope taxonomy is:

This broader conception matters. England's Department for Education, for example, allows schools and colleges to make context-specific choices while emphasizing safeguarding and responsible use. New Zealand combines school-level policy expectations with explicit national assessment authenticity rules. France has more explicit age- and context-specific boundaries. Singapore uses staged student exposure with supervision and assessment safeguards. Those are different governance models even though all might casually be described as "AI policies." ^[4]

Parents primarily need concrete answers: Can my child be required to use a generative AI service? Does the child need an account or consent? Can personal information be entered? Can AI be used for homework or examinations? What happens if a student violates the rule?

Teachers need the rule at the task level: whether brainstorming, editing, translation, feedback, lesson planning, question generation, student tutoring, grading, and final-answer generation are permitted, conditional, or prohibited. They also need disclosure requirements, approved tools, assessment-integrity rules, and the difference between teacher use and student use.

Administrators need the governance layer: procurement, data processing, approved tools, vendor terms, information security, staff training, assessment design, incident handling, policy review, and legal authority.

Advocates, researchers, journalists, and policymakers need comparable structured data, source provenance, historic versions, coverage statistics, and a way to distinguish genuine regulatory differences from missing evidence.

The Site therefore should never display merely "AI allowed" or "AI banned." The more accurate unit is a conditional rule:

> Actor + activity + education stage + tool type + status + conditions + authority + effective period.

That rule-oriented model is one of the most important architectural decisions in the project.

Canonical data model and editorial schema

The requested fields are all necessary, but a single flat policy table will become brittle. The better model has a stable policy record, immutable policy_version records, granular policy_rule records, and separate evidence/document records. ChatGPT Sites' documented D1 relational storage is well suited to this structured model, while R2 can hold permitted document snapshots or supporting files. ^[5]

A recommended logical model is:

The core schema should preserve every field requested by the user, plus several fields required for defensible comparison.

The policy_rule entity should contain something like:

rule_id: "fr-edu-ai-2025-student-genai-lowersecondary-01"
actor: "student"
education_stage: "lower_secondary"
grade_or_age_scope: "from French 4e"
activity: "classroom_learning"
tool_category: "public_generative_ai"
action: "direct_use"
status: "conditional"
conditions:
  - "teacher-supervised"
  - "defined pedagogical purpose"
disclosure_required: true
consent_requirement: "not_specified_in_rule"
assessment_context: false
source_document_id: "fr-men-ai-framework-2025"
source_locator: "official section/page/anchor"
effective_from: "2025-06-13"

This granular representation is preferable to a free-text permitted_uses field because France, for example, differentiates student use by age and supervision, while New Zealand distinguishes learning use from NCEA external assessment, and Singapore differentiates primary stages, secondary use, coursework, and national examinations. ^[6]

A complete blank entry template could therefore look like this:

policy:
  policy_id:
  jurisdiction_level:
  country_code:
  subdivision_code:
  institution_name_original:
  institution_name_en:
  institution_type:

  policy_title_original:
  policy_title_en:
  policy_type: []
  bindingness:
  status:

  published_date:
  effective_date:
  review_date:
  supersedes:
  superseded_by:

  scope:
    education_stages: []
    actors: []
    activities: []
    ai_types: []
    named_tools: []

  permitted_uses: []
  prohibited_uses: []
  conditional_uses: []

  disclosure_requirements:
    required:
    actors: []
    method:
    notes:

  consent_requirements:
    parental_or_guardian:
    student:
    staff:
    notes:

  assessment:
    formative:
    summative:
    external_exams:
    academic_integrity:
    ai_detection_policy:

  staff_training:
    status:
    mandatory:
    provider:
    notes:

  procurement_and_third_party_tools:
    approved_tools_required:
    vendor_review:
    age_terms_check:
    security_review:
    model_training_restrictions:
    notes:

  data_and_privacy:
    personal_data:
    sensitive_data:
    account_creation:
    retention:
    vendor_training:
    applicable_law_or_guidance: []

  enforcement:
    responsible_authority:
    process:
    penalties:
    notes:

  sources:
    primary_documents: []
    secondary_sources: []

  language:
    original_language:
    bcp47:
    official_english_translation:
    translation_status:

  provenance:
    source_last_updated:
    tracker_last_verified:
    source_reliability_tier:
    source_reliability_score:
    extraction_confidence:
    verification_status:
    reviewer_ids: []
    archived_snapshot:
    content_hash:

  tags: []

Reliability should be scored against evidence quality, not whether the tracker agrees with the policy. A workable 100-point rubric is:

Recommended tiers are A = 90-100, B = 75-89, C = 60-74, D = 40-59, E = below 40. A signed ministry document or current official HTML policy would normally be Tier A. A respected newspaper reporting on a district policy might be C or D as evidence of the district rule, even though it may be excellent journalism. A teacher-union page is primary evidence for the union's own position but only secondary evidence for what a ministry requires.

A separate bindingness field prevents the common mistake of interpreting "A-rated" as "legally binding."

Sources, search, monitoring, and multilingual operations

The research process should follow an issuer-first evidence hierarchy.

UNESCO's GenAI education guidance is particularly useful as a baseline taxonomy because it emphasizes human-centered use, data privacy, age appropriateness, ethical validation, and coherent policy frameworks. UNESCO also maintains AI competency frameworks for teachers and students. ^[7]

The search strategy should run in the original jurisdictional language first, followed by English and common translations. A reusable query family is:

site:<official-domain>
("generative AI" OR "generative artificial intelligence" OR ChatGPT OR LLM)
(school OR education OR assessment OR examination)
(policy OR guidance OR framework OR rules OR privacy OR procurement)

Equivalent local-language terms should be maintained in a search dictionary, for example IA générative, 生成AI, inteligencia artificial generativa, and local terms for school levels, examinations, ministry circulars, and acceptable-use policies. Japan illustrates why this is necessary: MEXT's canonical landing page is in Japanese and links both the Japanese Ver. 2.0 guideline and a provisional English translation. MEXT states that the revision was published on December 26, 2024 following its 2023 provisional version. ^[8]

Every search session should retain the query, date, domains examined, candidate URLs found, disposition, and reason for rejection. That creates a reproducible coverage audit trail. A record such as searched_official_sources_no_policy_found is fundamentally different from no_policy_exists.

The monitoring pipeline should operate as:

1. Discover. Watch ministry and authority sitemaps, search indexes, RSS/Atom feeds, news/announcement pages, policy repositories, exam circulars, procurement lists, and targeted search queries.
2. Capture. Retrieve changed pages/documents, record HTTP metadata when available, save a lawful archival copy or hash, and preserve the source URL.
3. Diff. Compare normalized text against the last known version and create a machine-generated change candidate.
4. Extract. Use structured extraction to update candidate fields and rules, with field-level evidence locators.
5. Verify and publish. Require human review for substantive policy changes. High-impact changes such as a new prohibition, assessment rule, consent requirement, or enforcement provision should receive two-person review.

I would not make the public ChatGPT Site itself responsible for crawling the world's education websites. Treat monitoring as a separate ingestion service or scheduled research workflow. The Site should be the query, visualization, comparison, and editorial interface. This avoids coupling public uptime to scraping jobs and makes the data pipeline portable if the front end changes.

A sensible monitoring cadence is daily change checks for national/state authorities and examination bodies, weekly checks for priority districts and official announcement feeds, monthly broad discovery sweeps, and quarterly coverage audits. Highly volatile pages can be escalated automatically after a detected change.

For inaccessible or undiscoverable policies, use jurisdiction-appropriate public-records or freedom-of-information procedures. "FOIA" should not be treated as a universal legal mechanism. Maintain a request record with jurisdiction, authority, request date, wording, response deadline if known, disposition, and documents supplied.

Crowdsourcing should be a lead-generation channel, not publication authority. Require only a jurisdiction, institution, source URL/document, and short explanation. Submitter identity should be optional. Never invite the submission of student disciplinary records, student work, or other personal information. Every crowdsource item begins as unverified and cannot affect a published policy rule until independently validated.

Multilingual data should keep the original authoritative text intact:

Machine translation can support discovery and drafting, but the original document should remain the evidentiary source. Japan's MEXT explicitly labels its English document a tentative/provisional translation and directs readers to the original for accuracy, exactly the kind of qualification the tracker should retain. ^[9]

Grades also require normalization. Do not equate labels such as "4e," "Primary 4," "Year 7," and "grade 7" by string. Store the native label and a separate approximate age/ISCED-style educational-stage mapping for cross-country filtering.

ChatGPT Sites architecture and user experience

As of September 2026, OpenAI describes ChatGPT Sites as a public-beta capability for building, previewing, publishing, and sharing hosted websites/lightweight applications. The current developer documentation describes D1 relational storage for structured data, R2 for files, site versioning, public and restricted audiences, workspace collaboration, optional Sign in with ChatGPT, and basic analytics. OpenAI also cautions that every deployed Site URL should be considered production and recommends saving a version before deployment when review is needed. ^[10]

That supports the following architecture:

Official sources / monitoring / submissions
                  │
                  ▼
       Ingestion + verification workflow
                  │
        ┌─────────┴─────────┐
        ▼                   ▼
  D1 structured data     R2 documents/files
        │                   │
        └─────────┬─────────┘
                  ▼
          ChatGPT Sites UI
       search • filter • compare
       maps • timelines • print
       citations • change history

For Sites specifically, D1 should contain normalized policy metadata, rules, sources, translations, and change events. R2 should contain only files that the project is entitled to retain, such as snapshots, submitted public documents, or generated printable reports. ^[11]

The primary user experience should have six modes, exposed through navigation rather than six separate products:

Recommended filters include country, jurisdiction level, education stage, bindingness, policy type, student direct-use status, teacher-use status, assessment rule, disclosure requirement, parental consent, privacy restriction, approved-tool requirement, staff training, language, active/superseded status, source reliability, and last-verification date.

The most valuable comparison table is not document-versus-document. It is rule-versus-rule:

Every cell should be clickable to reveal the exact source passage and policy version. Never infer "permitted" from silence. The correct state in that situation is Not specified.

Each policy detail page should begin with a visible provenance block:

> Current status: Active
> Policy force: Official national guidance
> Effective/publication date: 13 June 2025
> Verified by tracker: 8 September 2026
> Primary source: Ministry of Education
> Evidence reliability: A, 98/100
> Tracker summary: Not an official translation or legal interpretation

Then show role-specific views:

For parents: child access, accounts, consent, data, assessment, consequences.
For teachers: classroom uses, assessment, disclosure, approved tools, training.
For administrators: procurement, privacy, staff use, governance, enforcement.
For advocates: comparison data, sources, version history, coverage gaps.

Printable summaries should contain the policy version, verification date, primary links, and a machine-readable QR/deep link back to the live entry so printed copies do not masquerade as permanently current.

Maps should visualize coverage and policy attributes, not imply that one country is simply "AI-friendly" or "AI-restrictive." A categorical legend such as framework, conditional student use, assessment restriction, or no verified policy located is analytically safer.

Alerts should begin with RSS/Atom feeds by jurisdiction, institution, and topic. Email subscriptions add identity and data-retention requirements and are therefore better treated as a later enhancement. OpenAI states that Site owners act as controller for End User Data and must provide appropriate privacy information and choices where personal data are collected. ^[12]

The interface should target WCAG 2.2 AA accessibility, with keyboard-operable filters and tables, non-color-only map legends, meaningful focus states, text alternatives, accessible table headers, and printable layouts. WCAG 2.2 is the current W3C Web Content Accessibility Guidelines recommendation. ^[13]

Legal, ethical, and governance controls

The primary legal risk is not displaying public policy information. It is mischaracterizing legal force, collecting unnecessary user data, redistributing documents without regard to rights, or publishing stale interpretations as current rules.

The Site should therefore display four separate concepts prominently:

Authority: Who issued this?
Bindingness: Is it law, a mandatory rule, or guidance?
Currency: Is this the latest verified version?
Evidence quality: How confident is the tracker that the source accurately establishes the coded rule?

A public read-only Site minimizes a second major risk, visitor privacy. OpenAI states that the Site owner is responsible for the Site and legal compliance, is the controller of End User Data under the Sites terms, should provide a visible privacy policy when processing personal information, and should practice data minimization and appropriate security. OpenAI also states that Sites does not support data or inference residency at launch. ^[14]

For this particular project that suggests:

• Do not collect student identities, school records, assignments, disciplinary cases, or sensitive family information.
• Do not aim the product at children or invite student accounts. OpenAI's current Sites documentation excludes targeting children below 13 or the applicable age of digital consent. ^[15]
• Keep crowdsourcing evidence-focused: policy URLs and public documents, not stories naming children.
• Avoid visitor accounts in the MVP.
• Publish a clear correction and takedown/contact process.

Legal interpretation must also be jurisdiction-specific. The EU AI Act illustrates why a generic "AI in education" legal badge would be inaccurate. The consolidated 2026 text identifies particular education uses as high-risk, including AI used for admissions/access decisions, evaluating learning outcomes, assessing the level of education an individual will receive or access, and monitoring prohibited behavior during tests. The same consolidated text requires providers and deployers to take measures supporting AI literacy among staff and others operating AI systems. This does not make every generative-AI classroom use a high-risk system. ^[16]

The schema should consequently include fields such as:

regulated_use_case
applicable_legal_framework
legal_status_verified
legal_interpretation_source
human_decision_required
automated_decision_context
student_monitoring_context

Copyright should be handled conservatively. Link to official source documents as the public default, quote only what is necessary for evidence, record document hashes and metadata, and retain/redistribute full files only where licensing, public-domain status, permission, or another lawful basis supports doing so. An official website being publicly accessible does not by itself justify treating every document worldwide as freely republishable.

Scraping should likewise be source-aware. Prefer official feeds, APIs, sitemaps, public HTML, and downloadable policy repositories. Respect access controls, applicable terms, and technical restrictions. A blocked crawler should trigger manual research rather than attempts to circumvent controls.

AI-generated summaries create a subtler ethical risk. Each summary should be labeled as tracker-authored, traceable to evidence at the field level, and reviewed by a human before publication when it changes substantive rights or obligations. Extraction confidence should be visible internally and, for uncertain records, publicly.

Coverage bias needs explicit treatment. English-speaking countries and centralized ministries are easier to research than jurisdictions whose policies are local, scanned, unpublished, or available only in less digitally indexed languages. Publish metrics such as:

> Coverage status: official national sources searched, regional coverage incomplete.

Do not display:

> No AI policy.

unless authoritative evidence actually establishes that conclusion.

Exemplar policies and cross-jurisdiction analysis

These ten exemplars are a seed dataset, not a claim of globally representative coverage. They were selected because primary or official sources are available and because together they demonstrate different policy models: national frameworks, age-banded rules, assessment restrictions, local moratoria, human-centered guidance, and school-level implementation requirements.

The comparison below shows why a binary "allowed/banned" field would fail.

Several patterns emerge from these exemplars.

First, the observable direction is away from simplistic prohibition and toward conditional governance, but not toward unrestricted use. England, Australia, Japan, Washington, Chile, and Ireland are primarily guidance-oriented. France, Singapore, New Zealand, and NYCPS demonstrate increasing granularity around age, supervision, assessment, or approved environments. ^[37]

Second, assessment is the most consistently restrictive domain. New Zealand explicitly prohibits GenAI in NCEA external assessments and requires student evidence to remain authentic. Singapore retains strong examination/integrity safeguards. France treats unauthorized AI substitution as academic fraud. Ireland separately points schools to State Examinations Commission rules. ^[38]

Third, privacy and procurement are converging with pedagogy. Japan explicitly tells schools to consider provider terms, age restrictions, consent, security, privacy, and copyright. New Zealand warns against sending personal information into AI systems. England has dedicated data-protection guidance. Singapore subjects ministry-developed educational AI to safety, data-protection, and fairness review. ^[39]

Fourth, staff literacy is becoming a governance obligation rather than an optional professional-development topic, particularly in Europe. The consolidated EU AI Act now requires AI providers and deployers to support AI literacy among relevant staff and operators, while France, Ireland, Japan, Chile, and Singapore have all attached professional-learning or literacy elements to their education approach. ^[40]

The following timeline is deliberately a selected-policy timeline rather than a count of all global adoption:

Selected milestones in school GenAI policy development

1. 2023-03England publishes initial DfE GenAI position
2. 2023-07Japan issues provisional school GenAI guidelines
3. 2023-11Australia establishes national GenAI school framework
4. 2024-01Washington OSPI releases human-centered AI guidance
5. 2024-11New Zealand publishes national GenAI school guidance
6. 2024-12Japan publishes Ver. 2.0 with expanded operational safeguards
7. 2025-03Chile launches PotencIA pedagogical GenAI guidance
8. 2025-06France publishes national AI usage framework
9. 2025-10Ireland publishes national AI-in-schools guidance
10. 2026-05Singapore details staged student-use and assessment safeguards
11. 2026-27NYCPS applies age-banded student-facing AI restrictions

The milestone dates and policy evolution are documented by the relevant issuing authorities. ^[41]

Implementation blueprint and quality metrics

The first release should optimize for trust and comparability, not raw record count. A smaller corpus where every substantive field traces to primary evidence is more valuable than thousands of pages produced by unconstrained scraping and summarization.

A practical build sequence is:

1. Model the ontology first. Implement jurisdiction, institution, policy, policy_version, policy_rule, source_document, translation, verification, and change_event. Make Not specified a first-class value rather than allowing null to mean both missing data and policy silence.
2. Seed the ten exemplars above. Have two reviewers independently code the hardest records, particularly France, Japan, New Zealand, Singapore, and NYCPS, to test whether the rule model captures age, assessment, privacy, disclosure, and procurement distinctions.
3. Build the public read-only experience. Launch search, filters, policy pages, primary-source links, comparison tables, version history, timeline, map, print view, and RSS change feeds before accounts or crowdsourcing.
4. Add the monitoring pipeline. Automate official-source discovery, snapshots/hashes, diffs, extraction candidates, and editorial queues. Never auto-publish substantive rule changes solely from model extraction.
5. Expand by coverage cohorts. Add national education authorities first, then states/provinces, major examination bodies, high-enrollment districts, school networks, and a clearly separated higher-education collection.

The operational dashboard should measure:

A high-quality record should eventually satisfy an internal publication rule such as:

PRIMARY SOURCE PRESENT
AND BINDINGNESS CLASSIFIED
AND CURRENT/SUPERSEDED STATUS VERIFIED
AND EVERY MATERIAL RULE HAS AN EVIDENCE LOCATOR
AND TRANSLATION STATUS DISCLOSED
AND REVIEWER APPROVED

ChatGPT Sites is a credible presentation and lightweight application layer for this because the current platform supports hosted interactive Sites, structured relational data, files, access controls, and versioned deployments. The principal constraint is governance rather than interface technology: the resource's credibility will depend on disciplined provenance, human verification, multilingual research, and preservation of policy history. ^[42]

The recommended first build action is to implement the canonical schema and manually encode these ten exemplar policies before designing the final comparison interface, because that exercise will expose ontology failures while the dataset is still small.

[2026-09-08]

Original report citation identifiers

The pasted report did not include the URL mapping for these ChatGPT references. They are preserved for traceability, not presented as verified clickable sources. The explicit official links in the report and atlas remain available.

1. [1] turn18search0, turn18search1, turn19search2, turn20view0, turn20view1, turn19search1
2. [2] turn23search0, turn23search6
3. [3] turn10search0, turn11search0, turn10search2, turn10search7
4. [4] turn19search0, turn19search2, turn20view1, turn18search1, turn19search1
5. [5] turn11search0
6. [6] turn18search1, turn20view1, turn19search1
7. [7] turn23search0, turn23search6, turn23search18
8. [8] turn20view0, turn21view0
9. [9] turn21view0
10. [10] turn10search0, turn11search0
11. [11] turn11search0
12. [12] turn10search7
13. [13] turn24view0
14. [14] turn10search2, turn10search7, turn11search0
15. [15] turn11search0
16. [16] turn24view2, turn24view3
17. [17] turn18search0, turn18search2
18. [18] turn20view0, turn21view0
19. [19] turn18search1, turn18search3, turn18search5
20. [20] turn19search0, turn19search2, turn2search0
21. [21] turn20view1
22. [22] turn19search1, turn19search5, turn19search6
23. [23] turn22search0, turn22search8, turn22search4
24. [24] turn16view0, turn17view0, turn17view1
25. [25] turn22search1, turn22search3
26. [26] turn24view1, turn6search4
27. [27] turn18search0
28. [28] turn21view0
29. [29] turn18search1, turn18search3
30. [30] turn19search2, turn2search0
31. [31] turn20view1
32. [32] turn19search1, turn19search5
33. [33] turn22search0, turn22search8
34. [34] turn16view0, turn17view1
35. [35] turn22search1, turn22search3
36. [36] turn24view1, turn6search4
37. [37] turn18search0, turn19search2, turn21view0, turn22search1, turn18search1, turn20view1, turn19search1, turn24view1
38. [38] turn20view1, turn19search6, turn18search1, turn16view0
39. [39] turn21view0, turn20view1, turn2search0, turn19search5
40. [40] turn24view3, turn18search11, turn17view0, turn21view0, turn22search8, turn19search5
41. [41] turn19search0, turn20view0, turn18search0, turn22search3, turn5search0, turn22search0, turn18search1, turn14search2, turn19search1, turn24view1
42. [42] turn10search0, turn11search0