# AI Dean's List 2026: Technology Priorities for U.S. Colleges and Universities (12–24 Month Outlook)

- **AI system/product:** Claude (Anthropic), accessed through the claude.ai chat interface
- **Model name/version:** Claude Opus 5.5
- **Date:** September 23, 2026
- **Web research used:** Yes. Live web searches and page retrievals were conducted on September 23, 2026; cited sources are dated through September 2026.

---

## THE DEAN'S LIST

### #1 — AI Agents and Assessment Integrity
**Why it matters:** AI agents can now log in, watch lectures, take quizzes, and join discussions on students' behalf. Unless assessment and online course design change, grades and credentials lose credibility as evidence of learning.

### #2 — Cyber Resilience and Third-Party Risk
**Why it matters:** Attackers can exploit new flaws within a day, AI is speeding attacks further, and one vendor breach can disrupt a platform thousands of institutions depend on, as spring 2026 showed.

### #3 — Enterprise AI Strategy and Governance
**Why it matters:** Institutions are buying AI at scale, yet few have a unified strategy, clear data rules, or proven returns. Contracts and platforms chosen now will lock in costs, risks, and dependencies for years.

### #4 — Digital Accessibility Deadlines
**Why it matters:** Most public colleges must make websites, apps, and digital course materials meet federal accessibility standards by April 2027; HHS-funded (including NIH-funded) institutions, public or private, by May 2027. Remediation is large, costly, and slow.

### #5 — Identity Fraud and Ghost Students
**Why it matters:** Fraud rings use AI-generated identities to enroll, collect financial aid, and vanish. New federal screening makes campuses verify some flagged applicants in person, adding workload and risk, especially for community colleges and online programs.

### #6 — Graduate Outcomes in the AI Economy
**Why it matters:** Entry-level hiring is weak, students increasingly fear AI's effect on careers, and new federal earnings tests will judge programs by graduates' pay. Curricula and career preparation must adapt faster than governance usually allows.

### #7 — Technology Costs and Vendor Consolidation
**Why it matters:** IT costs keep rising while budgets tighten, as vendors consolidate, raise prices, and bundle AI. Without portfolio discipline and exit plans, institutions lose leverage and fund renewals instead of priorities.

---

## DEEPER ANALYSIS

### How this list was built

Research was conducted on September 23, 2026, using live web search. I prioritized primary sources (Federal Register, U.S. Department of Education and Federal Student Aid, HHS, FinCEN, Congress.gov, the Federal Reserve Bank of New York, accreditors), then independent sector research, legal analyses, and reporting. Some evidence comes from vendor threat-intelligence reports, vendor press releases, and industry-sponsored surveys; these are labeled in Sources. Attacker claims are marked unverified. For context, EDUCAUSE's member-voted 2026 Top 10 (450 responses, fielded June 2025) put collaborative cybersecurity first and human-centered AI second ([EDUCAUSE Review](https://er.educause.edu/articles/2025/10/2026-educause-top-10-making-connections)); this list gives more weight to academic-mission exposure and forcing dates inside the 12–24-month window.

**Ranking scorecard (judgment-based; 1–5 scale; weights: Severity 35%, Breadth 25%, Urgency 25%, Leadership leverage 15%).** Scores are my assessments, not measurements; reasonable people could swap #1 and #2.

| # | Priority | Severity | Breadth | Urgency | Leverage | Weighted |
|---|---|---|---|---|---|---|
| 1 | AI agents and assessment | 5 | 5 | 5 | 4 | 4.85 |
| 2 | Cyber and third-party risk | 5 | 5 | 4 | 4 | 4.60 |
| 3 | Enterprise AI strategy | 4 | 5 | 4 | 5 | 4.40 |
| 4 | Digital accessibility | 4 | 4 | 5 | 4 | 4.25 |
| 5 | Identity fraud | 4 | 3 | 5 | 4 | 4.00 |
| 6 | Graduate outcomes | 4 | 5 | 3 | 3 | 3.85 |
| 7 | Technology costs and vendors | 3 | 5 | 3 | 4 | 3.65 |

Throughout, **Evidence** lists established facts from cited sources; **Issue and rank**, **Outlook**, and **Institution-type differences** are my analysis and judgment.

### #1 — AI Agents and Assessment Integrity

**Issue and rank.** A credential certifies that a specific person learned specific things. Autonomous AI agents can now perform much of a course's observable work, so unsupervised assessment increasingly measures tool access rather than learning. It ranks first because it touches every institution's core product, lacks a mature playbook, and must be fixed through faculty governance, which moves slowly.

**Evidence.**
- In February 2026, a startup launched an agent designed to connect to Canvas and complete students' coursework; after Instructure sent a cease-and-desist letter, the site came down ([Inside Higher Ed](https://www.insidehighered.com/news/tech-innovation/artificial-intelligence/2026/02/26/agentic-ai-can-complete-whole-courses-now); [UW–Green Bay CATL](https://blog.uwgb.edu/catl/is-a-bot-taking-my-class-an-overview-of-agentic-ai-and-what-instructors-should-know/)).
- WCET authors reviewing one college's LMS data found 50-item short-answer exams completed in about three seconds, too fast for copy-and-paste AI use ([WCET](https://wcet.wiche.edu/frontiers/2026/03/26/agentic-ai-academic-integrity/)).
- In August 2026, the New York Times reported that agents can watch lectures, take tests, write papers, and join discussions; tested chatbots did not refuse to write students' papers, no fail-safe block exists, and AI companies have resisted having agents identify themselves ([Digital Trends summary](https://www.digitaltrends.com/cool-tech/ai-agents-taking-online-courses-student-cheating/)).
- In Tyton Partners' 2026 survey (3,000+ respondents at 750+ institutions; LMS vendor D2L was a research partner), 47% of faculty reported changing assessment design because of AI ([Every Learner Everywhere](https://www.everylearnereverywhere.org/blog/time-for-class-2026-highlights-the-intersection-of-ai-integrated-assessment-and-student-engagement/); [Tyton](https://tytonpartners.com/time-for-class-2026-the-ai-tipping-point-from-monitoring-students-to-engaging-them/); [WINS](https://www.winssolutions.org/ai-higher-education-tipping-point-2026/)).
- The Digital Education Council's 2026 global survey found 57% of students say assessments come with inadequate AI guidance, and 43% of U.S. and Canadian students would support an institution-wide AI ban ([ETIH summary](https://www.edtechinnovationhub.com/news/q6zw9wco2mttajdbd1jyeonjnpiovu)).
- HLC requires distance-education providers to have processes establishing that the student who registers is the one who participates and earns the credit; the policy was revised in November 2025, effective September 2026 ([HLC policy book](https://download.hlcommission.org/policy/HLCPolicyBook_POL.pdf); [HLC](https://www.hlcommission.org/accreditation/policies/verification-of-student-identity-and-protection-of-privacy/)).

**Outlook (12–24 months).** Agentic browsing will become a standard consumer feature, and detection inside learning platforms will lag. Expect high-stakes assessment to shift toward supervised, oral, and process-based formats, and accreditors and federal regulators to ask sharper questions about identity and academic engagement in online programs.

**Institution-type differences.** Exposure is highest where asynchronous online assessment carries most credit: community colleges, regional publics, and large online programs. Selective residential campuses can re-weight in-person assessment faster. Licensure-bound programs have external exams as a partial backstop.

**Questions for leaders.**
1. What share of our credit hours rests on unsupervised online assessment?
2. Who funds faculty time for assessment redesign, and by which term?
3. How will we show accreditors that enrolled students are doing their own work?

### #2 — Cyber Resilience and Third-Party Risk

**Issue and rank.** Campuses remain high-value, hard-to-defend targets, and risk is concentrating in shared platforms. Severity matches #1, but the defensive playbook (phishing-resistant MFA, fast patching, segmentation, tested recovery) is known and already a leadership priority.

**Evidence.**
- Comparitech, an industry tracker, counted fewer U.S. education ransomware attacks in H1 2026 than in H2 2025 (34 versus 61) but an 8% rise against higher education worldwide; the median education-sector ransom demand rose 53% to about $420,000 ([GovTech](https://www.govtech.com/education/k-12/ransomware-attacks-on-k-12-trend-down-higher-ed-trend-up-in-2026); [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/university-ransomware-attacks-rise/)).
- In May 2026, Instructure confirmed that attackers exploiting its Free-for-Teacher program exposed names, emails, student IDs, and some private messages; Canvas went offline May 7 and was restored the next day ([Bitdefender advisory](https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-shinyhunters-breach-instructure-canvas-lms)). It was the company's second compromise by the same group in about eight months ([Reed Smith](https://www.reedsmith.com/articles/canvasinstructure-cyberattack-key-developments-and-action-items-for-higher-education-institutions/)). The group, also linked to breaches at Penn, Princeton, and Harvard, claimed roughly 9,000 affected schools (unverified) ([Inside Higher Ed](https://www.insidehighered.com/news/tech-innovation/administrative-tech/2026/05/05/pay-or-leak-hackers-target-big-higher-ed-vendor)).
- CrowdStrike observed state-linked exploitation about 20 hours after a vulnerability's disclosure and expects frontier AI to compress timelines further ([CrowdStrike, vendor](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-threat-hunting-report/)); Recorded Future finds AI mostly additive so far but narrowing remediation windows ([Recorded Future, vendor](https://www.recordedfuture.com/research/h1-2026-malware-vulnerability-trends)).
- Federal backstops are thinner: federal MS-ISAC funding was cut in 2025, and the Cybersecurity Information Sharing Act's protections now run only to December 11, 2026 ([Infosecurity Magazine](https://www.infosecurity-magazine.com/news/us-cuts-funding-ms-isac/); [CRS](https://www.congress.gov/crs-product/IF12959)).
- Only 22% of CTOs say students receive adequate cybersecurity training, versus 68% for faculty and staff; 70% say leadership prioritizes cybersecurity investment ([Inside Higher Ed](https://www.insidehighered.com/news/tech-innovation/2026/06/09/students-remain-higher-eds-cybersecurity-weak-link)).
- DoD suspended CMMC Phase 2 third-party certification on July 13, 2026, pending review ([DefenseScoop](https://defensescoop.com/2026/07/13/dod-halts-cmmc-cybersecurity-requirements-phase-2/)), but DFARS safeguarding and incident-reporting obligations remain ([Mayer Brown](https://www.mayerbrown.com/en/insights/publications/2026/07/far-council-proposes-revised-cui-safeguarding-and-incident-reporting-framework-while-dow-pauses-cmmc-implementation)).

**Outlook (12–24 months).** More extortion aimed at shared vendors (LMS, SIS, CRM, identity providers), faster exploitation, and AI-enhanced phishing and help-desk impersonation. Watch the December 11 information-sharing sunset, the CMMC review outcome, and a final government-wide CUI rule.

**Institution-type differences.** Research universities and academic medical centers hold the highest-stakes data and federal obligations. Small colleges depend on managed services and consortia. Community colleges manage large, transient account populations.

**Questions for leaders.**
1. If our LMS, SIS, or identity provider were down for a week during finals, what is the tested plan?
2. Can we patch internet-facing critical vulnerabilities within 72 hours?
3. Do our top vendor contracts require breach-notice timelines, security attestations, and exit rights?

### #3 — Enterprise AI Strategy and Governance

**Issue and rank.** Institutions are moving from scattered pilots to enterprise AI contracts and, next, to agents with access to institutional systems, mostly without a strategy, data rules, or value metrics. It ranks third because spending, data-exposure, and lock-in decisions are happening now and are directly controllable by leaders; mistakes are costly but usually recoverable.

**Evidence.**
- Inside Higher Ed's 2026 provost survey (376 respondents) found about seven in ten provosts use AI weekly, but only one in ten report a centralized institutional AI strategy; reported value centers on individual productivity and administrative efficiency ([Inside Higher Ed](https://www.insidehighered.com/news/governance/executive-leadership/2026/09/23/ai-use-funding-cuts-how-provosts-navigate-2026)).
- Half of CTOs say AI's return on investment is unclear or below expectations; 29% say it met or exceeded them ([Inside Higher Ed](https://www.insidehighered.com/news/tech-innovation/artificial-intelligence/2026/05/12/half-campus-tech-leaders-question-ais-roi)).
- The California State University system renewed ChatGPT Edu at $13 million a year for three years, with annual cancellation rights, expanding access to 675,000 users ([LAist](https://laist.com/news/education/csu-renews-openai-contract-chatgpt-artificial-intelligence)), after a $17 million 18-month first term ([EdSource](https://edsource.org/2026/cal-state-renews-controversial-system-wide-contract-with-openai/758919)) and a faculty petition urging cancellation ([San Francisco Chronicle/EdSource](https://www.sfchronicle.com/california/article/csu-renews-openai-chatgpt-contract-22272144.php)).
- EDUCAUSE research found 56% of higher-education employees use AI tools their institution does not provide ([Inside Higher Ed](https://www.insidehighered.com/news/workplace/staff-issues/2026/01/13/data-shows-ai-disconnect-higher-ed-workforce)).
- Regulation is a patchwork. Colorado replaced its AI Act with a narrower disclosure-and-human-review law effective January 1, 2027; Texas's TRAIGA took effect January 1, 2026; federal preemption has not taken legal effect ([Wittliff Cutter](https://www.wittliffcutter.com/news-insights/ai-regulation-texas-colorado-federal-2026)). Illinois now covers AI used in hiring, discipline, and tenure decisions ([Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-us-ai-regulation-preemption-compliance-202/)). Florida's Board of Governors is weighing a rule requiring public institutions to adopt AI policies ([WUFT/WLRN](https://www.wlrn.org/science-technology/2026-09-16/state-education-officials-looking-to-set-ground-rules-for-ai-in-higher-education-raise-questions-about-the-future)).

**Outlook (12–24 months).** Expect a shift from chat assistants to agents that act inside student, finance, and CRM systems, raising the stakes on data classification, access control, and human review. Renewal cycles will force institutions to show value.

**Institution-type differences.** Systems can negotiate price and exit terms; small institutions risk defaulting to consumer tools with weak data protections. Research universities need AI rules covering research data and export controls. Publics face state mandates and public-records exposure.

**Questions for leaders.**
1. Who is the single accountable owner for AI across teaching, research, and operations?
2. Which data classes may enter which AI tools, and can vendors retain or train on them?
3. What outcome measure, not usage count, justifies each AI renewal?

### #4 — Digital Accessibility Deadlines

**Issue and rank.** Federal rules require web content, mobile apps, and digital course materials to conform to WCAG 2.1 AA. This is the clearest legal forcing date in the window, and it reaches more institutions than many assume. It ranks fourth because the standard and playbook are defined, even though the remediation lift is large.

**Evidence.**
- DOJ's April 20, 2026 interim final rule moved the Title II compliance date for large public entities from April 24, 2026, to April 26, 2027 ([Federal Register](https://www.federalregister.gov/documents/2026/04/20/2026-07663/extension-of-compliance-dates-for-nondiscrimination-on-the-basis-of-disability-accessibility-of-web)); smaller entities now have until April 26, 2028, and DOJ signaled further review of the rule ([Reed Smith](https://www.reedsmith.com/articles/doj-extends-digital-accessibility-compliance-dates-under-title-ii-of-the-ada/)).
- Because population is measured at the state level, nearly all public universities face the April 2027 date, and scope includes digital course materials ([UPCEA](https://upcea.edu/doj-extends-accessibility-deadline-to-april-2027-policy-matters-april-2026/)).
- HHS moved its Section 504 date to May 11, 2027, for recipients with 15 or more employees ([HHS](https://www.hhs.gov/press-room/hhs-extends-mobile-and-web-accessibility-deadline.html)). The rule covers private and public HHS-funded entities and, for colleges, all institutional operations ([EDUCAUSE Review](https://er.educause.edu/articles/2026/6/doj-and-hhs-extend-web-accessibility-deadlines-to-2027-2028)).
- Disability-rights advocates opposed the delay and urged withdrawal of the extension ([AAPD](https://www.aapd.com/aapd-statement-title-ii-doj-web-rule-ifr/)).

**Outlook (12–24 months).** Deadlines land in April and May 2027. The main uncertainty is DOJ's review; planning around further relief is a poor bet. Expect complaints and litigation after the dates pass.

**Institution-type differences.** Public institutions: Title II, April 2027 (April 2028 for some small-district community colleges). Private institutions with HHS or NIH funding: Section 504, May 2027. Others: existing ADA and Section 504 obligations, plus litigation risk.

**Questions for leaders.**
1. Do we have a content inventory and prioritized remediation plan covering PDFs, video, and course sites?
2. Do new contracts require WCAG 2.1 AA conformance and vendor remediation commitments?
3. Who supports faculty remediation, and with what time and tools?

### #5 — Identity Fraud and Ghost Students

**Issue and rank.** Organized rings use stolen or synthetic identities, often AI-assisted, to enroll, draw aid, and disappear, displacing real students and exposing institutions. The burden is concentrated rather than universal, but federal action has made verification an operational obligation for every Title IV institution.

**Evidence.**
- ED says it blocked more than $1 billion in attempted aid fraud since January 2025, after finding nearly $90 million fraudulently disbursed, including more than $30 million to deceased individuals ([U.S. Department of Education](https://www.ed.gov/about/news/press-release/us-department-of-education-prevents-more-1-billion-federal-student-aid-fraud-year-additional-crackdowns-expected-2026)).
- Since April 26, 2026, the FAFSA has included real-time identity screening ([Federal Student Aid](https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-04-15/fafsa-real-time-fraud-detection-updated-aug-21-2026)); high-risk applicants verify by live camera, and those rejected must be verified in person by institutions ([CRS bill summary](https://www.govinfo.gov/bulkdata/BILLSUM/119/s/BILLSUM-119s4428.xml)). ED reported more than $100 million blocked by June ([U.S. Department of Education](https://www.ed.gov/about/news/press-release/us-secretary-of-education-linda-mcmahon-issues-statement-passage-of-no-aid-ghost-students-act)).
- The California Community Colleges system reported that about 31% of 2024–25 applications were fraudulent ([Inside Higher Ed](https://www.insidehighered.com/news/government/student-aid-policy/2026/04/27/education-dept-launches-new-fafsa-fraud-prevention)).
- FinCEN warns that fraudsters may use AI chatbots to complete coursework so ghost students stay enrolled long enough to collect refunds ([FinCEN](https://www.fincen.gov/system/files/2026-07/FinCEN-Alert-Fraud-Schemes-Targeting-Federal-Student-Aid.pdf)).
- The House passed the No Aid for Ghost Students Act on June 10, 2026 ([The College Investor](https://thecollegeinvestor.com/82137/house-passes-bill-to-screen-every-fafsa-for-identity-fraud/)); it would bar aid to flagged applicants until they are verified in person or by live video ([Congress.gov](https://www.congress.gov/bill/119th-congress/house-bill/7892)). The Senate HELP Committee is scheduled to consider its companion bill on September 24 ([Legis1](https://legis1.com/news/student-aid-fraud-bill-senate-help-committee-will)).

**Outlook (12–24 months).** Likely codification of screening and verification, more convincing deepfakes, and pressure to verify identity during courses, not just at enrollment.

**Institution-type differences.** Community colleges and open-access online programs are most exposed. Selective institutions see less volume but must still resolve flagged applicants.

**Questions for leaders.**
1. Do we measure fraud rates at application, enrollment, and disbursement?
2. Can we verify identity at scale without delaying aid to real students?
3. Are admissions, financial aid, IT, and institutional research sharing fraud signals?

### #6 — Graduate Outcomes in the AI Economy

**Issue and rank.** Early-career outcomes are weak, students attribute part of that to AI, and federal accountability now ties loan eligibility to graduates' earnings. It ranks sixth because AI's causal role is contested and curricular change takes years to show in outcomes, but perceptions and accountability will move faster than the evidence.

**Evidence.**
- The New York Fed puts recent-graduate unemployment at about 5.6% in the second quarter of 2026 and underemployment at 42% ([Federal Reserve Bank of New York](https://www.newyorkfed.org/research/college-labor-market)).
- New York Fed economists find AI may contribute but is not the main driver of the hiring slowdown, noting that the gap for AI-exposed occupations predates ChatGPT ([Liberty Street Economics](https://libertystreeteconomics.newyorkfed.org/2026/05/do-job-postings-show-early-labor-market-effects-of-ai/)). Stanford's Erik Brynjolfsson finds weaker employment for 22-to-25-year-olds in AI-exposed roles and says the evidence is building ([NPR](https://www.npr.org/2026/08/18/nx-s1-5910677/recent-college-graduates-employment-job-artificial-intelligence); [excerpt](https://it.slashdot.org/story/26/08/22/0418223/is-ai-really-to-blame-for-high-unemployment-among-recent-graduates-what-economists-say)).
- In Handshake data on the Class of 2026, 85% of seniors used AI tools and 75% named fewer entry-level hires as their biggest concern ([Inside Higher Ed](https://www.insidehighered.com/news/student-success/life-after-college/2026/04/30/ai-skills-surge-entry-level-jobs-lag)).
- In a Lumina Foundation–Gallup survey, 16% of enrolled students said they had already changed majors because of AI ([Gallup](https://news.gallup.com/poll/704087/college-students-weigh-impact-majors-careers.aspx)).
- ED's final "do no harm" rule compares completers' earnings with those of workers holding the next-lower credential ([Duane Morris](https://www.duanemorris.com/alerts/department_education_finalizes_earnings_accountability_framework_title_iv_programs_0726.html)); first program results are due in 2027, with loan-eligibility penalties starting in 2028 for most programs ([Inside Higher Ed](https://www.insidehighered.com/news/government/student-aid-policy/2026/07/20/how-soon-could-colleges-lose-loan-access)).

**Outlook (12–24 months).** More, and more contested, labor-market evidence; the first public earnings-test results; and students voting with their feet on majors.

**Institution-type differences.** Regional publics, community colleges, and programs feeding AI-exposed entry roles face the most scrutiny; graduate programs are benchmarked against bachelor's-degree earners. Liberal arts colleges will need evidence for durable, AI-complementary skills.

**Questions for leaders.**
1. Which programs combine weak early earnings with high AI exposure?
2. Where, program by program, are AI skills and work-based learning built in?
3. Can curriculum governance approve changes within one academic year?

### #7 — Technology Costs and Vendor Consolidation

**Issue and rank.** Technology costs are rising faster than many budgets can absorb as vendors consolidate, reprice, and bundle AI. This is less dramatic than the others, but it determines whether institutions can afford #1–#6, and leaders have real leverage through portfolio and contract decisions.

**Evidence.**
- 49% of CTOs say the current pace of technology change is unsustainable without new resources, nearly all expect IT costs to rise over the next two years, and 56% name unsustainable cost trajectories as a major risk through 2030 ([Inside Higher Ed](https://www.insidehighered.com/news/quick-takes/2026/05/12/survey-ctos-cybersecurity-ai-lms-and-more)).
- Anthology filed for Chapter 11 in September 2025 ([ListEdTech](https://listedtech.com/blog/anthologys-chapter-11/)). Ellucian closed its purchase of Anthology's SIS and ERP business in January 2026, adding more than 260 customers ([Ellucian release via EDUCAUSE](https://www.educause.edu/about/corporate-participation/member-press-releases/ellucian-completes-acquisition-of-anthologys-sis-and-erp-business)), and Blackboard emerged as a standalone company in March 2026 ([Blackboard release](https://www.blackboard.com/news/blackboard-formerly-anthology-emerges-debt-free-and-focused)).
- An analyst firm reports VMware cost increases of 200% to more than 1,200% after Broadcom's licensing changes, with universities among those hit hardest ([Avasant](https://avasant.com/report/broadcom-vmware-shake-up-rising-costs-subscription-shock-and-enterprise-response/)).
- The 2026 EDUCAUSE Top 10 reports that most technology leaders see quick-fix purchases as common, straining staff and interoperability ([EDUCAUSE Review](https://er.educause.edu/articles/2025/10/2026-educause-top-10-making-connections)).

**Outlook (12–24 months).** Continued consolidation and private-equity pricing, AI features bundled into renewals, and selective platform switching; the 2026 CTO survey found some institutions already exploring LMS alternatives ([Inside Higher Ed](https://www.insidehighered.com/news/quick-takes/2026/05/12/survey-ctos-cybersecurity-ai-lms-and-more)).

**Institution-type differences.** Small institutions lack negotiating leverage; systems and consortia can aggregate demand. Research universities with large virtualization and research-computing estates face the biggest license shocks.

**Questions for leaders.**
1. Which major renewals land in the next 24 months, and what is our walk-away option for each?
2. What will we retire or consolidate this fiscal year?
3. Which purchases should move to consortium or system contracts?

### Cross-Cutting Observations

1. **Identity is the new perimeter.** Agents in courses (#1), credential theft (#2), and ghost students (#5) are one problem: proving that a real, authorized person is acting. The House fraud bill's reference to NIST Identity Assurance Level 2 shows where standards are heading ([GovTrack](https://www.govtrack.us/congress/bills/119/hr7892/text)). Fund identity assurance once, as shared infrastructure.
2. **Concentration risk is structural.** A few vendors run the LMS, SIS/ERP, and AI layers for large parts of the sector (#2, #3, #7). Contract terms (exit rights, breach notice, accessibility warranties, data-use limits) are now primary risk controls.
3. **Federal dates move; the work doesn't.** DOJ extended Title II four days before the deadline ([Seyfarth](https://www.adatitleiii.com/2026/04/doj-extends-ada-title-ii-website-accessibility-deadlines-for-governmental-entities-but-litigation-and-compliance-risks-remain/)), DoD paused CMMC Phase 2 ([DefenseScoop](https://defensescoop.com/2026/07/13/dod-halts-cmmc-cybersecurity-requirements-phase-2/)), and information-sharing protections run on stopgaps ([CRS](https://www.congress.gov/crs-product/IF12959)). Favor no-regrets work that holds under any timeline.
4. **Data is the hidden prerequisite.** AI governance, earnings accountability, federal admissions reporting (the next ACTS collection opens December 9, 2026 ([IPEDS](https://ipeds.communities.ed.gov/sites/default/files/ipeds/2026-08/IPEDS%202026-27%20Keyholder%20Handbook.pdf))), and fraud detection all depend on clean, governed data, which is why at least four of EDUCAUSE's 2026 Top 10 are data issues ([EDUCAUSE Review](https://er.educause.edu/articles/2025/10/2026-educause-top-10-making-connections)).
5. **Capacity is the binding constraint.** CTOs rank IT talent as their top risk through 2030 (62%) ([Inside Higher Ed](https://www.insidehighered.com/news/quick-takes/2026/05/12/survey-ctos-cybersecurity-ai-lms-and-more)). Sequencing, and stopping lower-value work, matters more than launching new initiatives.

### What Might Be Underestimated

1. **Federal-contractor security obligations are expanding despite the CMMC pause.** The re-proposed FAR CUI rule (June 23, 2026) would apply NIST SP 800-171 Revision 3 to civilian-agency contracts ([Hunton](https://www.hunton.com/government-contracts-intelligence-briefing/far-council-releases-updated-cui-proposed-rule-as-part-of-the-revolutionary-far-overhaul)). A June 2026 executive order sets 2030–2031 post-quantum deadlines for federal high-value systems ([Center for Cybersecurity Policy and Law](https://www.centerforcybersecuritypolicy.org/insights-and-research/from-strategy-to-implementation-the-white-house-accelerates-the-federal-transition-to-post-quantum-cryptography)), with a proposed FAR rule due by December 2026 to extend requirements to contractors ([OpenSSL Corporation](https://openssl-corporation.org/blog/post-quantum-cryptography-now-has-deadlines.html)). Research universities should start cryptographic inventories while they are cheap.
2. **Federal aid infrastructure is in transition.** Nearly half of Federal Student Aid's staff left or were laid off ([Federal News Network](https://federalnewsnetwork.com/management/2026/03/education-dept-hands-federal-student-loan-portfolio-to-treasury-in-latest-step-to-dismantle-agency/)), FSA staff were slated to begin moving into Treasury office space in August ([Inside Higher Ed](https://www.insidehighered.com/news/quick-takes/2026/07/28/fsa-staff-now-slated-move-treasury-office)), and a House committee voted 19–16 to transfer FSA to Treasury ([HEAG](https://heag.us/house-education-committee-advances-legislative-package-to-transfer-ed-responsibilities-and-appropriations-to-other-agencies/)). A technical issue also kept fraud results off some FAFSA records for about a week this summer ([Federal Student Aid](https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-04-15/fafsa-real-time-fraud-detection-updated-aug-21-2026)). Plan for processing delays and guidance gaps.
3. **AI-enabled student support creates duty-of-care exposure.** States are enacting companion-chatbot laws with crisis-response duties, and Oregon's adds a private right of action ([Orrick](https://www.orrick.com/en/Insights/2026/04/2026-State-Chatbot-Laws-Key-Provisions-and-Regulatory-Trends)); California's law excludes productivity tools ([Gunderson Dettmer](https://www.gunder.com/en/news-insights/insights/client-insight-california-sb-243-new-compliance-requirements-for-operators-of-ai-companion-chatbots)). As institutions extend AI to hundreds of thousands of students (CSU's contract covers 675,000 users ([LAist](https://laist.com/news/education/csu-renews-openai-contract-chatgpt-artificial-intelligence))) and build AI advisors or wellness bots, design choices will determine legal exposure.

### Sources

Labels: [vendor] = company with a commercial interest in the topic; [industry] = advisory-firm or sponsored research; [secondary] = summary of another source.

**Sector context**
- EDUCAUSE Review — "2026 EDUCAUSE Top 10: Making Connections" (Oct. 29, 2025). https://er.educause.edu/articles/2025/10/2026-educause-top-10-making-connections

**#1 AI agents and assessment**
- Inside Higher Ed — "Agentic AI Can Complete Whole Courses. Now What?" (Feb. 26, 2026). https://www.insidehighered.com/news/tech-innovation/artificial-intelligence/2026/02/26/agentic-ai-can-complete-whole-courses-now
- UW–Green Bay CATL, The Cowbell — "Is a Bot Taking My Class? An Overview of Agentic AI and What Instructors Should Know" (Mar. 2, 2026). https://blog.uwgb.edu/catl/is-a-bot-taking-my-class-an-overview-of-agentic-ai-and-what-instructors-should-know/
- WCET Frontiers — "Agentic AI, Academic Integrity, and the Question We Are Avoiding" (Mar. 26, 2026). https://wcet.wiche.edu/frontiers/2026/03/26/agentic-ai-academic-integrity/
- Digital Trends — "AI agents are sitting through students' online courses, and colleges are struggling to stop them" (Aug. 13, 2026) [secondary; summarizes The New York Times, Aug. 10, 2026]. https://www.digitaltrends.com/cool-tech/ai-agents-taking-online-courses-student-cheating/
- Tyton Partners — "Time for Class 2026: The AI Tipping Point: From Monitoring Students to Engaging Them" (June 12, 2026) [industry; D2L research partner]. https://tytonpartners.com/time-for-class-2026-the-ai-tipping-point-from-monitoring-students-to-engaging-them/
- Every Learner Everywhere — "Time for Class 2026 Highlights the Intersection of AI-Integrated Assessment and Student Engagement" (July 13, 2026). https://www.everylearnereverywhere.org/blog/time-for-class-2026-highlights-the-intersection-of-ai-integrated-assessment-and-student-engagement/
- WINS — "AI in higher education reaches a tipping point" (July 20, 2026) [secondary]. https://www.winssolutions.org/ai-higher-education-tipping-point-2026/
- EdTech Innovation Hub — "AI in higher education survey 2026: student AI use hits 88%, faculty lag" (July 9, 2026) [secondary; summarizes Digital Education Council]. https://www.edtechinnovationhub.com/news/q6zw9wco2mttajdbd1jyeonjnpiovu
- Digital Education Council — "AI in Higher Education Global Survey 2026" (July 2, 2026). https://www.digitaleducationcouncil.com/resource-library-items/ai-in-higher-education-global-survey-2026
- Higher Learning Commission — "Institutional Practices for Verification of Student Identity and Protection of Student Privacy" (revised Nov. 2025, effective Sept. 2026). https://www.hlcommission.org/accreditation/policies/verification-of-student-identity-and-protection-of-privacy/
- Higher Learning Commission — HLC Policy Book (PDF). https://download.hlcommission.org/policy/HLCPolicyBook_POL.pdf

**#2 Cyber resilience and third-party risk**
- GovTech — "Ransomware Attacks on K-12 Trend Down, Higher Ed Trend Up in 2026" (Aug. 10, 2026). https://www.govtech.com/education/k-12/ransomware-attacks-on-k-12-trend-down-higher-ed-trend-up-in-2026
- Infosecurity Magazine — "Ransomware Attacks Targeting Universities on the Rise" (Aug. 3, 2026). https://www.infosecurity-magazine.com/news/university-ransomware-attacks-rise/
- Bitdefender — "Technical Advisory: ShinyHunters Breach of Instructure Canvas LMS" (May 2026) [vendor]. https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-shinyhunters-breach-instructure-canvas-lms
- Reed Smith — "Canvas/Instructure cyberattack – Key developments and action items for higher education institutions" (June 18, 2026). https://www.reedsmith.com/articles/canvasinstructure-cyberattack-key-developments-and-action-items-for-higher-education-institutions/
- Inside Higher Ed — "'PAY OR LEAK': Hackers Target Big Higher Ed Vendor" (May 5, 2026). https://www.insidehighered.com/news/tech-innovation/administrative-tech/2026/05/05/pay-or-leak-hackers-target-big-higher-ed-vendor
- CrowdStrike — "CrowdStrike 2026 Threat Hunting Report" (Aug. 3, 2026) [vendor]. https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-threat-hunting-report/
- Recorded Future — "H1 2026 Malware and Vulnerability Trends" (2026) [vendor]. https://www.recordedfuture.com/research/h1-2026-malware-vulnerability-trends
- Infosecurity Magazine — "US Cuts Federal Funding for MS-ISAC Cybersecurity Program" (Sept. 30, 2025). https://www.infosecurity-magazine.com/news/us-cuts-funding-ms-isac/
- Congressional Research Service — "The Cybersecurity Information Sharing Act of 2015: Expiring Provisions" (IF12959, updated 2026). https://www.congress.gov/crs-product/IF12959
- Inside Higher Ed — "Students Remain Higher Ed's Cybersecurity Weak Link" (June 9, 2026). https://www.insidehighered.com/news/tech-innovation/2026/06/09/students-remain-higher-eds-cybersecurity-weak-link
- DefenseScoop — "DOD halts cybersecurity requirements for CMMC Phase 2" (July 13, 2026). https://defensescoop.com/2026/07/13/dod-halts-cmmc-cybersecurity-requirements-phase-2/
- Mayer Brown — "FAR Council Proposes Revised CUI Safeguarding and Incident-Reporting Framework, While DoW Pauses CMMC Implementation" (July 16, 2026). https://www.mayerbrown.com/en/insights/publications/2026/07/far-council-proposes-revised-cui-safeguarding-and-incident-reporting-framework-while-dow-pauses-cmmc-implementation

**#3 Enterprise AI strategy and governance**
- Inside Higher Ed — "From AI Use to Funding Cuts: How Provosts Navigate 2026" (Sept. 23, 2026). https://www.insidehighered.com/news/governance/executive-leadership/2026/09/23/ai-use-funding-cuts-how-provosts-navigate-2026
- Inside Higher Ed — "Half of Campus Tech Leaders Question AI's ROI" (May 12, 2026). https://www.insidehighered.com/news/tech-innovation/artificial-intelligence/2026/05/12/half-campus-tech-leaders-question-ais-roi
- LAist — "CSU renews contract with OpenAI, meaning three more years of ChatGPT" (May 22, 2026). https://laist.com/news/education/csu-renews-openai-contract-chatgpt-artificial-intelligence
- EdSource — "California State University renews controversial systemwide contract with OpenAI" (May 21, 2026). https://edsource.org/2026/cal-state-renews-controversial-system-wide-contract-with-openai/758919
- San Francisco Chronicle (EdSource reprint) — "California State University renews controversial systemwide contract with OpenAI" (May 22, 2026). https://www.sfchronicle.com/california/article/csu-renews-openai-chatgpt-contract-22272144.php
- Inside Higher Ed — "Data Shows AI 'Disconnect' in Higher Ed Workforce" (Jan. 13, 2026). https://www.insidehighered.com/news/workplace/staff-issues/2026/01/13/data-shows-ai-disconnect-higher-ed-workforce
- Wittliff Cutter — "Texas TRAIGA, Colorado's AI Law Reset, and Federal Preemption: What Companies Need to Know in 2026" (Sept. 2026). https://www.wittliffcutter.com/news-insights/ai-regulation-texas-colorado-federal-2026
- Cloud Security Alliance — "State AI Laws Take Hold as Federal Preemption Stalls" (May 20, 2026). https://labs.cloudsecurityalliance.org/research/csa-research-note-us-ai-regulation-preemption-compliance-202/
- WUFT/WLRN — "State education officials looking to set ground rules for AI in higher education raise questions about the future" (Sept. 16, 2026). https://www.wlrn.org/science-technology/2026-09-16/state-education-officials-looking-to-set-ground-rules-for-ai-in-higher-education-raise-questions-about-the-future

**#4 Digital accessibility deadlines**
- Federal Register (U.S. Department of Justice) — "Extension of Compliance Dates for Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities" (Apr. 20, 2026). https://www.federalregister.gov/documents/2026/04/20/2026-07663/extension-of-compliance-dates-for-nondiscrimination-on-the-basis-of-disability-accessibility-of-web
- Reed Smith — "DOJ extends digital accessibility compliance dates under Title II of the ADA" (Apr. 24, 2026). https://www.reedsmith.com/articles/doj-extends-digital-accessibility-compliance-dates-under-title-ii-of-the-ada/
- UPCEA — "DOJ Extends Accessibility Deadline to April 2027 | Policy Matters (April 2026)" (Apr. 30, 2026). https://upcea.edu/doj-extends-accessibility-deadline-to-april-2027-policy-matters-april-2026/
- U.S. Department of Health and Human Services — "HHS' Office for Civil Rights Extends Web and Mobile Accessibility Compliance Deadline" (May 7, 2026). https://www.hhs.gov/press-room/hhs-extends-mobile-and-web-accessibility-deadline.html
- EDUCAUSE Review — "DOJ and HHS Extend Web Accessibility Deadlines to 2027–2028" (June 2026). https://er.educause.edu/articles/2026/6/doj-and-hhs-extend-web-accessibility-deadlines-to-2027-2028
- American Association of People with Disabilities — "AAPD Statement on DOJ Title II Web Rule Interim Final Rule" (Apr. 20, 2026). https://www.aapd.com/aapd-statement-title-ii-doj-web-rule-ifr/
- Seyfarth Shaw, ADA Title III blog — "DOJ Extends ADA Title II Website Accessibility Deadlines for Governmental Entities—But Litigation and Compliance Risks Remain" (Apr. 21, 2026). https://www.adatitleiii.com/2026/04/doj-extends-ada-title-ii-website-accessibility-deadlines-for-governmental-entities-but-litigation-and-compliance-risks-remain/

**#5 Identity fraud and ghost students**
- U.S. Department of Education — "U.S. Department of Education Prevents More Than $1 Billion in Federal Student Aid Fraud This Year, Additional Crackdowns Expected in 2026" (late 2025). https://www.ed.gov/about/news/press-release/us-department-of-education-prevents-more-1-billion-federal-student-aid-fraud-year-additional-crackdowns-expected-2026
- Federal Student Aid — "FAFSA Real-Time Fraud Detection (Updated Aug. 21, 2026)" (Electronic Announcement, Apr. 15, 2026). https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-04-15/fafsa-real-time-fraud-detection-updated-aug-21-2026
- Congressional Research Service via GovInfo — Bill summary, S. 4428, No Aid for Ghost Students Act of 2026. https://www.govinfo.gov/bulkdata/BILLSUM/119/s/BILLSUM-119s4428.xml
- U.S. Department of Education — "U.S. Secretary of Education Linda McMahon Issues Statement on Passage of the 'No Aid for Ghost Students Act'" (June 10, 2026). https://www.ed.gov/about/news/press-release/us-secretary-of-education-linda-mcmahon-issues-statement-passage-of-no-aid-ghost-students-act
- Inside Higher Ed — "Education Dept. Launches New FAFSA Fraud Prevention Tool" (Apr. 27, 2026). https://www.insidehighered.com/news/government/student-aid-policy/2026/04/27/education-dept-launches-new-fafsa-fraud-prevention
- FinCEN — "FinCEN Alert on Fraud Schemes Targeting Federal Student Aid" (FIN-2026-Alert004, July 24, 2026). https://www.fincen.gov/system/files/2026-07/FinCEN-Alert-Fraud-Schemes-Targeting-Federal-Student-Aid.pdf
- The College Investor — "House Passes Bill to Screen Every FAFSA for Identity Fraud" (June 11, 2026). https://thecollegeinvestor.com/82137/house-passes-bill-to-screen-every-fafsa-for-identity-fraud/
- Congress.gov — "H.R.7892 – No Aid for Ghost Students Act of 2026" (119th Congress). https://www.congress.gov/bill/119th-congress/house-bill/7892
- GovTrack — "Text of H.R. 7892: No Aid for Ghost Students Act of 2026" (referred-to-Senate version, June 2026). https://www.govtrack.us/congress/bills/119/hr7892/text
- Legis1 — "Senate HELP Committee Will Examine Student Aid Fraud Bill" (Sept. 2026). https://legis1.com/news/student-aid-fraud-bill-senate-help-committee-will

**#6 Graduate outcomes in the AI economy**
- Federal Reserve Bank of New York — "The Labor Market for Recent College Graduates" (updated 2026). https://www.newyorkfed.org/research/college-labor-market
- Liberty Street Economics (Federal Reserve Bank of New York) — "Do Job Postings Show Early Labor-Market Effects of AI?" (May 2026). https://libertystreeteconomics.newyorkfed.org/2026/05/do-job-postings-show-early-labor-market-effects-of-ai/
- NPR — "Recent college grads say AI is making it harder to get a job. Is it?" (Aug. 18, 2026). https://www.npr.org/2026/08/18/nx-s1-5910677/recent-college-graduates-employment-job-artificial-intelligence
- Slashdot — excerpt of the NPR report (Aug. 22, 2026) [secondary]. https://it.slashdot.org/story/26/08/22/0418223/is-ai-really-to-blame-for-high-unemployment-among-recent-graduates-what-economists-say
- Inside Higher Ed — "As AI Skills Surge, Entry-Level Jobs Lag" (Apr. 30, 2026; Handshake data). https://www.insidehighered.com/news/student-success/life-after-college/2026/04/30/ai-skills-surge-entry-level-jobs-lag
- Gallup / Lumina Foundation — "College Students Weigh AI's Impact on Majors and Careers" (Apr. 1, 2026). https://news.gallup.com/poll/704087/college-students-weigh-impact-majors-careers.aspx
- Duane Morris — "Department of Education Finalizes Earnings Accountability Framework for Title IV Programs – Key Takeaways for Institutions" (July 9, 2026). https://www.duanemorris.com/alerts/department_education_finalizes_earnings_accountability_framework_title_iv_programs_0726.html
- Inside Higher Ed — "How Soon Could Colleges Lose Loan Access?" (July 20, 2026). https://www.insidehighered.com/news/government/student-aid-policy/2026/07/20/how-soon-could-colleges-lose-loan-access

**#7 Technology costs and vendor consolidation**
- Inside Higher Ed — "Survey: CTOs on Cybersecurity, AI, the LMS and More" (May 12, 2026; Inside Higher Ed/Hanover Research survey of 130 CTOs/CIOs). https://www.insidehighered.com/news/quick-takes/2026/05/12/survey-ctos-cybersecurity-ai-lms-and-more
- ListEdTech — "Anthology's Chapter 11 Filing: Breaking Up to Refocus" (Oct. 1, 2025). https://listedtech.com/blog/anthologys-chapter-11/
- Ellucian (via EDUCAUSE member press releases) — "Ellucian Completes Acquisition of Anthology's SIS and ERP Business" (Jan. 5, 2026) [vendor]. https://www.educause.edu/about/corporate-participation/member-press-releases/ellucian-completes-acquisition-of-anthologys-sis-and-erp-business
- Blackboard — "Blackboard, Formerly Anthology, Emerges Debt-Free and Focused on Enabling Transformational Teaching and Learning" (Mar. 2, 2026) [vendor]. https://www.blackboard.com/news/blackboard-formerly-anthology-emerges-debt-free-and-focused
- Avasant — "Broadcom–VMware Shake-up: Rising Costs, Subscription Shock, and Enterprise Response" (Jan. 5, 2026) [industry]. https://avasant.com/report/broadcom-vmware-shake-up-rising-costs-subscription-shock-and-enterprise-response/

**Cross-cutting observations and underestimated issues**
- National Center for Education Statistics — "IPEDS 2026–27 Keyholder Handbook" (Aug. 2026). https://ipeds.communities.ed.gov/sites/default/files/ipeds/2026-08/IPEDS%202026-27%20Keyholder%20Handbook.pdf
- Hunton Andrews Kurth — "FAR Council Releases Updated CUI Proposed Rule as Part of the Revolutionary FAR Overhaul" (June 30, 2026). https://www.hunton.com/government-contracts-intelligence-briefing/far-council-releases-updated-cui-proposed-rule-as-part-of-the-revolutionary-far-overhaul
- Center for Cybersecurity Policy and Law — "From Strategy to Implementation: The White House Accelerates the Federal Transition to Post-Quantum Cryptography" (June 23, 2026). https://www.centerforcybersecuritypolicy.org/insights-and-research/from-strategy-to-implementation-the-white-house-accelerates-the-federal-transition-to-post-quantum-cryptography
- OpenSSL Corporation — "Post-Quantum Cryptography Now Has Deadlines" (July 29, 2026). https://openssl-corporation.org/blog/post-quantum-cryptography-now-has-deadlines.html
- Federal News Network — "Education Dept hands federal student loan portfolio to Treasury, in latest step to dismantle agency" (Mar. 20, 2026). https://federalnewsnetwork.com/management/2026/03/education-dept-hands-federal-student-loan-portfolio-to-treasury-in-latest-step-to-dismantle-agency/
- Inside Higher Ed — "FSA Staff Slated to Move to Treasury Office Starting in August" (July 28, 2026). https://www.insidehighered.com/news/quick-takes/2026/07/28/fsa-staff-now-slated-move-treasury-office
- Higher Education Assistance Group (HEAG) — "House Education Committee Advances Legislative Package to Transfer ED Responsibilities and Appropriations to Other Agencies" (July 29, 2026). https://heag.us/house-education-committee-advances-legislative-package-to-transfer-ed-responsibilities-and-appropriations-to-other-agencies/
- Orrick — "2026 State Chatbot Laws: Key Provisions and Regulatory Trends" (Apr. 29, 2026). https://www.orrick.com/en/Insights/2026/04/2026-State-Chatbot-Laws-Key-Provisions-and-Regulatory-Trends
- Gunderson Dettmer — "Client Insight: California SB 243: New Compliance Requirements for Operators of AI 'Companion Chatbots'" (Oct. 29, 2025). https://www.gunder.com/en/news-insights/insights/client-insight-california-sb-243-new-compliance-requirements-for-operators-of-ai-companion-chatbots