Drift Audits 001 to 004 · Governance Signals, Forensic Reads, and Tool Intelligence

The First Watch.

Four drift audits and a research report tabulating them: Where Vendor Change Happens.

Download the report Open the drift timeline
No DriftFlag ConvergenceAsymmetricDivergence
34
tool-cycle findings across four audits
10
K-12 AI tools from seven vendors
15
Watch and Flag findings, 12 of them in three tools
0
decision labels changed in any cycle
00Summary of findings

Read as a dataset, the four audits support five findings.

Between April 6 and July 6, 2026, The First Watch recorded 34 tool-cycle findings on ten K-12 AI tools. Nineteen were No Drift, eleven were Watch, and four were Flag. This report counts that record and states only what the counts support.

01 · CONCENTRATION

Change was concentrated, not spread.

Three tools account for 12 of the 15 Watch and Flag findings: ChatGPT Free (Flag in all four cycles), Google NotebookLM for Education and Microsoft 365 Copilot (Watch in all four). The remaining three belong to three tools, one cycle each.

02 · STABILITY

Convergence was the most common pattern in three of four cycles.

No Drift / Convergence findings were 4 of 7, 3 of 8, 5 of 9, and 7 of 10. Asymmetric movement was the plurality only in Audit 002 (4 of 8).

03 · LAYER

Every Watch finding sat outside the governing privacy policy.

The eleven Watch findings touched retention, eligibility and access paths, third-party processors, and admin and compliance controls. Policy and contract terms anchored three findings, all of them ChatGPT Free Flags.

04 · MOVEMENT

Category changes reversed within one cycle.

Of 24 transitions between consecutive cycles, 18 held their category and 6 changed. Each of the three tools that moved from No Drift to Watch returned to No Drift in the next cycle.

05 · SOURCING

Most findings rest on vendor primary sources.

Twelve of the 15 Watch and Flag findings are anchored in the vendor's own publications. Three rest on approved secondary sources where the vendor was silent: trade press and user reports.

The finding, distilled

Vendor change that warranted practitioner attention happened mostly below the privacy policy, in a small number of tools, and the one tool that received a Flag received one in every cycle.

03Findings by cycle and tool

Ten tools, four cycles, one matrix.

Each cell is one tool's drift category and forensic pattern in one audit. In all 34 findings the two layers pair one to one: No Drift with Convergence, Watch with Asymmetric, Flag with Divergence.

Table 2 · Tool × cycle matrix
Tool001 · Apr 6002 · May 6003 · Jun 6004 · Jul 6Decision label
ChatGPT FreeFlag DivFlag DivFlag DivFlag DivDo Not Deploy
ChatGPT for TeachersNo Drift Conv AsymNo Drift ConvNo Drift ConvConditional
NotebookLM for Education Asym Asym Asym AsymTeacher-OK
Microsoft 365 Copilot Asym Asym Asym AsymConditional
KhanmigoNo Drift ConvNo Drift ConvNo Drift ConvNo Drift ConvTeacher-OK / Conditional (student)
Claude FreeNo Drift Conv AsymNo Drift ConvNo Drift ConvDo Not Deploy
Claude EnterpriseNo Drift ConvNo Drift Conv AsymNo Drift ConvConditional
Claude for EducationNot in rotationNo Drift ConvNo Drift ConvNo Drift ConvDo Not Deploy (K-12)
LingokidsNot in rotationNot in rotationNo Drift ConvNo Drift ConvDo Not Deploy
MagicSchoolNot in rotationNot in rotationNot in rotationNo Drift ConvConditional

Source: each audit, §04 table and §05 Decision box. Lingokids entered as a baseline in 003, MagicSchool in 004.

Audit 001 · 7 tools
4No Drift
2
1Flag
Convergence share 57%
Audit 002 · 8 tools
3No Drift
4
1Flag
Convergence share 38%
Audit 003 · 9 tools
5No Drift
3
1Flag
Convergence share 56%
Audit 004 · 10 tools
7No Drift
2
1Flag
Convergence share 70%

Shares are of tools audited in that cycle. Denominators differ because the rotation grew, so cycle-to-cycle shares are not a trend line.

05What the Watch and Flag findings touched

A review that re-reads only the privacy policy catches three of fifteen.

Each of the 15 Watch and Flag findings was coded to one of the five governance-signal categories named in the Watch rule, using the basis each audit's §05 finding states. No Watch finding was anchored in a change to policy or contract terms.

Age, eligibility, or access path5
Admin and compliance controls3
Policy and contract terms3
Third-party processors2
Data use or retention2
Watch (11) Flag (4) Table 4A
Persistence of the one divergence

ChatGPT Free is the only tool to receive a Flag, and it received one in all four cycles. In Audits 001 through 003 the Flag rests on an in-rotation U.S. Privacy Policy revision; in Audit 004 it rests on trade-reported expansion of the advertising program, with no revision in that rotation.

Sourcing

Twelve of fifteen are anchored in vendor primary sources. The three that are not involve events vendors did not publish: user-reported account enforcement, a change Microsoft announced through non-public Message Center posts, and market expansion OpenAI did not announce on its own pages.

04Movement between cycles

Six category changes. Every move into Watch reversed in the next cycle.

Of 24 transitions between consecutive cycles, 18 held their category. No tool moved into or out of Flag. The record shows movement that warranted practitioner awareness without changing what a district was told to do with the tool.

Table 3A · Each change and its stated basis
ToolChangeStated basis (audit §05)
ChatGPT for TeachersNo Drift → 002Codex-powered workspace agents opened in research preview to the Teachers plan, April 22.
ChatGPT for Teachers → No Drift 003No in-rotation event names the Teachers plan.
Claude FreeNo Drift → 002User-reported suspensions of accounts flagged as minors, with Yoti verification (Digit, April 12; MediaNama, April 15).
Claude Free → No Drift 003No fresh vendor event; age enforcement a standing state.
Claude EnterpriseNo Drift → 00328 security and compliance integrations built on the Claude Compliance API, May 21.
Claude Enterprise → No Drift 004No product-surface movement documented for the rotation; every policy signal held.
07What it cannot yet show

The tabulation counts a small, purposive record. Its limits are part of the result.

Sample

Ten tools chosen for K-12 relevance, not sampled. Five belong to two vendors. Shares rest on denominators of 7 to 10 and are not rates.

Window

Twenty weeks, February 16 to July 6, 2026, set to cover the K-12 contracting season. One-cycle reversals are visible; slower movement is not.

Classification

Findings follow the Watch rule. Under a different rule, product launches that touch no documented signal would produce different counts.

Detection

An event no vendor, approved secondary source, or user report surfaced is absent from the counts. The record cannot say how many such events there were.

A longer record would test whether drift stays concentrated in the same few tools, whether Watch findings continue to sit outside the governing policy, and whether one-cycle reversals remain the norm.

01 · The data

The First Watch, Drift Audits 001 to 004.

The First Watch is a recurring series of drift audits that checks the governance signals documented for each K-12 AI tool against current vendor primary sources, recording a dated, sourced finding for every tool at the close of each filing rotation. Its practical use is to tell districts whether the conditions under which a tool was approved still hold, showing where re-review is needed, which documents beyond the privacy policy must be re-read, and giving boards and counsel a filed record that oversight is ongoing rather than a one-time procurement check. Its research purpose is to build a longitudinal record of where, how often, and at which governance layer vendor change occurs beneath the products districts approve, a record that does not otherwise exist in K-12 education.

Drift Audit No. 001
April 6, 2026
Seven tools · eight-week rotation, February 16 to April 6. Establishes the baseline and the three forensic patterns.
Read audit 001 →
Drift Audit No. 002
May 6, 2026
Eight tools · April 7 to May 6. Claude for Education enters; monthly cadence begins.
Read audit 002 →
Drift Audit No. 003
June 6, 2026
Nine tools · May 7 to June 5. Lingokids enters as a baseline on vendor sources alone.
Read audit 003 →
Drift Audit No. 004
July 6, 2026
Ten tools · June 6 to July 6. MagicSchool enters with an independent check; Lingokids receives its first full finding.
Read audit 004 →
TLDrift timeline · Audits 001 to 004

Every dated movement, tool by tool.

Three views of the same record: each tool's findings across four audits, every dated event from January to July 2026, and the pattern shifts between cycles.

Open full screen
02Methods

Every number is a count of audit findings.

The unit is the tool-cycle finding: one tool's drift category, forensic pattern, and decision label in one audit. Categories were taken from each audit's §04 table and confirmed against the §05 finding heading. No figure is estimated or weighted. The method does not re-verify vendor claims, score tools, or infer causes.

The study period, February 16 to July 6, 2026, was set to cover the K-12 contracting season: the months in which districts review renewals, cancel existing agreements, and approve new ones before a fiscal year that begins July 1 in most states. Vendor change recorded in this window reaches districts while those decisions remain open.

The Watch rule · each audit, §03

A Watch finding rests on a dated event within the rotation window that touches a governance signal documented on the card: data use or retention, administrative and compliance controls, third-party processors, age, eligibility, or access path, or policy and contract terms. The event is documented by the vendor or, where the vendor is silent, by approved secondary sources. Standing conditions carried from prior cycles, and product or model launches that touch no documented governance signal, do not by themselves sustain a Watch.

READDiscourse analysis · document ecosystem inventory
TRACEPragmatic and intertextual analysis · accountability map
SURFACEForensic language analysis · evidence-grade findings
BUILDRegister and genre construction · governance infrastructure

The audits are conducted under The Forensic Read™. Drift categories are the SURFACE output; forensic patterns are tracked at TRACE.

The question the series asks

When was the last time someone verified that the conditions under which this tool was approved still hold?

The presence or absence of an answer is itself the governance signal.

Suggested citation

The Language Firm. (2026, October). Where Vendor Change Happens: A Tabulation of The First Watch Drift Audits 001-004. Published as part of The District Filing.

Disclosure of independence

The Language Firm reports no commercial relationship with any vendor named and does not offer legal advice. The First Watch series is funded by The Language Firm directly.

Download the documents · PDF
Research reportWhere Vendor Change Happens · 14 pp. Drift Audit No. 001April 6, 2026 · 23 pp. Drift Audit No. 002May 6, 2026 · 25 pp. Drift Audit No. 003June 6, 2026 · 26 pp. Drift Audit No. 004July 6, 2026 · 27 pp.

The interactive drift timeline plots every dated event from all four audits, tool by tool and month by month, with each audit's data-collection cutoff marked.

Open the drift timeline