The price of "free" AI for schools.
A trustee in a Tier-2 affordable-private school does the math: a paid AI vendor costs lakhs per year, the free consumer products cost nothing, the budget is what the budget is. The math looks clean. It is wrong on three structural counts, and the people who pay are not the people doing the math.
The first cost the math misses is the legal authorisation cost. ChatGPT's minimum age is thirteen. There is no consumer-grade child-facing OpenAI product for K-12. The school operates as the Data Fiduciary under DPDP; the duty of authorising what tools may be used with children's data belongs to the school, and it cannot be delegated to a consumer-license agreement the school never signed. When a CBSE Class 9 teacher tells the class to "just use ChatGPT for the Math practice," the school has authorised — implicitly, without a DPA, without a sub-processor agreement, without a consent path — the processing of children's data in a US data centre by an organisation that owes the school no contractual duty of care. The cost of that decision shows up in 2028, when the first DPDP enforcement action lands and the school's own legal team has to reconstruct what happened. The conservative-planning number for the worst per-incident fine is ₹250 crore. The school's annual ed-tech budget is not.
The second cost is the absence of an audit trail. The free product does not give the school a per-student session record. That means the school cannot answer, six months after the fact, what conversation a fourteen-year-old had with the AI on a Tuesday afternoon. It cannot give that record to the parent who comes asking. It cannot give it to a regulator if asked. It cannot use it to triage an incident — because there is nothing to triage from. The school is missing the basic information needed to satisfy its own duty as Data Fiduciary. The vendor that the school chose for free has no obligation to provide it.
The third cost is the absence of a self-harm protocol. A child types "I want to disappear" into the free product. What happens? The product responds based on whatever consumer-safety scaffolding its general-population model has, which is built for adults. There is no warm-handoff partnership with Tele-MANAS or Vandrevala. There is no clinical-reviewed script. There is no tiered escalation to the counsellor and the parent within an SLA. The product is not designed for the population the school is putting in front of it. When the first incident reaches a peer school's parent WhatsApp group — and it will, somewhere, in 2027 — every principal in the city will be asked the same question by every parent the next morning: what does your school do when this happens. The honest answer, if the school authorised free ChatGPT, is that the school does not know.
The fourth thing the math misses is not a cost. It is a question of structure. Free consumer AI is built for a different customer — an adult, who has reviewed and accepted a terms-of-service, who is not bound by another fiduciary obligation, who is processing their own data. The Indian school is none of those things. It is a regulated educational institution operating on children's data under a specific legal carve-out (Schedule IV) that requires a written Data Processing Agreement with any vendor. Free consumer products do not sign DPAs. They do not need to, because the school is not their customer. The school is using a product that was not built for the school's customer either.
The lakhs-per-year a paid school AI vendor charges look expensive next to free. The math changes when you put the cost on the same line as the duty. The school is not buying a tool. The school is buying a relationship that includes a DPA, an audit log, a safety protocol, an incident-response process, and a counterparty that can be held accountable when something breaks. That is the difference. The free product cannot be that counterparty, no matter how good the model gets.