States are rapidly translating AI risk and opportunity into enforceable policy infrastructure for K-12 districts and postsecondary institutions, according to a new Education Commission of the States overview. Arkansas, Illinois, Ohio and Tennessee require institutions to adopt formal AI-use policies, while at least 35 states have issued guidance ranging from advisories to full frameworks. Across the patchwork, the report says the common priorities are minimizing risk, requiring human decision-making, strengthening student AI literacy, and expanding data protection and cybersecurity requirements. Several states also target AI-enabled student harms, including laws addressing deepfakes connected to bullying or sexual misconduct. The picture is one of compliance-by-design: districts and institutions are being pushed to build governance, training, and risk assessments into how they deploy AI.