Classroom AI in India 2026: an NEP-aligned rollout playbook for EdTech

Summary. From the 2026-27 academic year, India makes AI and computational thinking part of school from Class 3 onward, under the National Education Policy 2020 and the National Curriculum Framework for School Education 2023. The framing is "AI for Public Good," a CBSE expert committee led by a faculty member at IIT Madras is designing the curriculum, and the government must train more than 10 million teachers through NISHTHA. For EdTech founders this is among the largest classroom-AI openings in the world, and the most regulated: under the Digital Personal Data Protection Act 2023 and its 2025 Rules, a child is anyone under 18, behavioural tracking and targeted advertising at children are banned, and mishandling children's data can cost up to ₹200 crore. Around 15% of teachers feel ready and roughly half of schools lack basic digital infrastructure. Here is an NEP-aligned playbook.

The opportunity and the constraint arrive together. The mandate guarantees demand across every school, but the same children it serves are the most protected data subjects in Indian law, and the schools that need help most are the least equipped to run software. An EdTech product that wins here is curriculum-aligned, compliant by design, and usable on weak infrastructure, in that order. This playbook walks each one. For the architecture behind privacy-first AI products, see our guide to generative AI enterprise strategy.

The mandate: what NEP and the curriculum actually require

The headline is that AI and computational thinking become mandatory from Class 3 in the 2026-27 academic year, treated as a basic universal skill rather than a specialised subject, as techwireasia and convergence-now report. It sits under NEP 2020 and the National Curriculum Framework for School Education 2023, and the curriculum theme is "AI for Public Good," emphasising ethical use, social responsibility, and critical thinking over technical depth. The Central Board of Secondary Education has set up an expert committee, with a faculty lead from IIT Madras, to design the AI and computational-thinking curriculum, and NCERT reviews it, per STEMpedia.

The product lesson is to map your content to the framework's outcomes, not to a generic AI syllabus. A tool that demonstrably teaches computational thinking and responsible technology use, in age-appropriate language, fits the mandate. One that teaches prompt tricks does not.

The compliance reality: children's data under DPDP

This is where most EdTech plans break, so treat it as a design constraint, not a legal afterthought. Under the DPDP Act 2023 and the 2025 Rules, a child is anyone under 18, which is broader than the under-13 line used by the United States' COPPA, per K&S analysis. Section 9 requires verifiable parental or guardian consent before processing a child's personal data, and the burden of authenticating it falls on you. Methods include an OTP to the parent's verified mobile, identity-document checks, or Aadhaar-based authentication where legally feasible.

The harder rule for AI products is the prohibition. The DPDP framework bans tracking, behavioural monitoring, and targeted advertising directed at children, so anything that profiles a child's behaviour, predicts choices, or tailors content based on tracked activity is off-limits, as CyberPeace's analysis explains. That directly constrains the personalised-learning engines most EdTech is built on. Failure on children's-data obligations can draw a penalty up to ₹200 crore.

The way to keep a personalised product legal is to personalise on what a student does in the lesson, the inputs and answers they give in the moment, rather than on a behavioural profile built by tracking them over time. Keep processing on-device or in-school where you can, minimise what you collect, and retain it briefly.

The infrastructure reality

The third constraint is physical. Surveys in 2025 put the share of teachers who feel ready to teach AI at around 15%, and roughly half of India's schools lack the basic digital infrastructure, electricity, internet, and computers, to run any of this, as Peepul India documents. The government plans to train more than 10 million teachers through NISHTHA using video-based, grade-specific modules, but the states where the intervention matters most are also where it is most likely to stall.

For a founder, this is a product-design fact, not a footnote. A tool that assumes a reliable laptop, fast broadband, and a confident teacher will fail in the schools that most need it. The winning design is offline-first, low-bandwidth, low-cost, and teacher-supporting, so it degrades gracefully where infrastructure is thin.

The playbook

Put the three constraints together and the rollout sequence is clear. First, align to the curriculum: map every feature to a specific NCF-SE outcome and the "AI for Public Good" framing, in age-appropriate language from Class 3. Second, build compliant by default: a verifiable parental-consent flow, personalisation from in-lesson inputs rather than behavioural tracking, no ad-tech on student accounts, data minimisation, and short retention. Third, design for the lowest-infrastructure school in your target, with offline modes and low-bandwidth content. Fourth, support teachers rather than replace them, aligning with NISHTHA and giving teachers dashboards and lesson scaffolding, because a tool that threatens teachers does not get used. Fifth, measure learning outcomes, not engagement minutes, because the mandate is about skills, and outcome evidence is what wins school and government trust.

The order matters. Compliance and infrastructure are not features you add later; they decide whether your product is legal and usable at all, so they belong in the first version.

Where EdTech actually adds value

Given the constraints, the highest-value products are not the flashiest. Three areas stand out. The first is teacher enablement: tools that cut a teacher's preparation time, generate grade-appropriate lesson material aligned to the framework, and explain AI concepts the teacher can then teach. With only about 15% of teachers feeling ready, the product that makes an unready teacher effective has the widest market. The second is offline-capable learning content that runs on a shared, low-end device and syncs when a connection appears, because that fits the infrastructure most schools actually have. The third is assessment of understanding rather than recall, helping teachers see whether a student grasped computational thinking, without profiling the child over time.

What to avoid is equally clear. A consumer-style engagement loop that maximises screen time collides with both the educational goal and the spirit of the children's-data rules. A personalisation engine that depends on long-term behavioural tracking is not compliant for under-18 users. And a premium product priced for affluent families ignores the mandate's reach into every government school.

Designing personalisation that stays legal

Personalisation is the feature founders worry about most, because it is both the product's value and the compliance risk. The resolution is to separate two kinds of signal. In-session signals are what a student does within the current activity: the answer they gave, the step they got stuck on, the concept they just practised. Using these to adapt the next question in the same lesson is responsive teaching, not behavioural profiling. Cross-session behavioural signals are what you accumulate by tracking a student over days and weeks to predict and target them, and that is the mechanism the rules prohibit for children.

Build your adaptivity on in-session signals, keep them local or short-lived, and resist the temptation to assemble a long-term behavioural profile. If you need to show progress over time, report it to the teacher and parent as outcomes, not as a marketing profile of the child. Designed this way, a product can be genuinely adaptive and still sit comfortably inside the children's-data rules.

Measuring outcomes that buyers trust

The mandate is about skills, so the evidence that wins trust is learning evidence. Engagement metrics, time on app and streaks, are the wrong measure here, and they pull design toward the screen-time loops the rules discourage. Instead, measure whether students can demonstrate computational thinking and responsible-technology understanding, the outcomes the framework names. Give teachers a clear read on mastery, and give public buyers outcome data they can defend to their own oversight.

Outcome evidence is also your durable advantage. Anyone can claim engagement; few can show that students learned. In a mandatory market where every school must adopt something, the products that show real learning outcomes are the ones that survive procurement scrutiny and renew year after year.

Funding and procurement realities

Selling into Indian schools is not the same as selling to consumers. Government and aided schools buy through public procurement, often via state education departments and platforms such as the Government e-Marketplace, with their own evaluation criteria and price ceilings. Private schools and chains buy faster but still expect curriculum alignment and parent-facing privacy assurances. For a founder, this means two motions: a procurement-ready offering with documentation, compliance evidence, and outcome data for public buyers, and a lighter, faster motion for private schools.

The compliance evidence is part of the sale, not separate from it. A buyer evaluating an EdTech product for children will increasingly ask how you obtain verifiable parental consent, what data you collect, how long you keep it, and whether you profile students. Having clear, documented answers, ideally a short data-protection summary a school can show parents, shortens the sales cycle. Treat your DPDP posture as a go-to-market asset.

Common compliance mistakes

A few mistakes recur in EdTech built before the rules were understood. The first is treating 13, not 18, as the age line, importing a COPPA-shaped design into a country where the child threshold is 18, which leaves most users wrongly classified as adults. The second is consent theatre: a checkbox claiming a parent agreed, with no verification, which does not meet the verifiable-consent bar. The third is behavioural personalisation that quietly profiles students, the exact mechanism the rules prohibit for children. The fourth is unbounded retention, keeping student data indefinitely because storage is cheap, when the rule expects minimisation and short retention.

Each of these is cheaper to avoid than to fix. Retrofitting verifiable consent and stripping behavioural tracking out of a shipped product is far more expensive than designing them in, and the penalty exposure for getting children's data wrong reaches ₹200 crore. The compliance core is not overhead; it is the licence to operate in this market.

A 90-day plan

A focused first quarter beats a broad one. In the first month, map your existing or planned features to specific NCF-SE outcomes and the "AI for Public Good" framing, and cut anything that does not fit, because scope discipline is what makes the rest affordable. In the second month, build the compliance core: a verifiable parental-consent flow, a data inventory that proves minimisation, short retention with automatic deletion, and the removal of any behavioural tracking or ad-tech from student accounts. In the third month, build for the weakest classroom you intend to serve, with an offline mode and low-bandwidth content, and pilot with a small number of real schools that include a low-infrastructure one.

The pilot is the point. Two or three schools that span an affluent private school and a low-resource government school will surface the infrastructure, teacher-readiness, and consent issues that a demo never will. Fix those before scaling, because the mandate guarantees you will be scaling into exactly those conditions.

The opportunity in numbers

The scale is what makes the discipline worth it. The mandate reaches every school from Class 3 in the 2026-27 year, the government is training more than 10 million teachers, and demand is guaranteed rather than speculative. Against that, the constraints are knowable: an under-18 child definition, verifiable parental consent, a ban on behavioural profiling, a penalty ceiling of ₹200 crore, around 15% teacher readiness, and roughly half of schools short on infrastructure. A founder who designs to those numbers from the start is building for the market that actually exists, not the one a pitch deck imagines.

India market context

The demand side is unusually certain, because the curriculum is mandatory across every school from Class 3, which removes the adoption question that most EdTech faces. The risk shifts from "will schools want this" to "can you deliver it compliantly at low cost." That is a favourable trade for a disciplined team, and a trap for one that ships a data-hungry, infrastructure-heavy product built for affluent urban schools and assumes the rest will follow.

The compliance cost is real but bounded, and far smaller than a ₹200 crore penalty or the reputational damage of mishandling children's data. Treating DPDP as a design input from day one is cheaper than retrofitting it after a product is built on behavioural tracking that the law does not allow for children.

FAQ

How eCorpIT can help

eCorpIT (eCorp Information Technologies Private Limited) is a Gurugram-based, CMMI Level 5 technology organisation whose senior engineering teams build education and AI products. We help EdTech founders map products to the NCF-SE curriculum, build verifiable-consent and data-minimisation flows aligned with DPDP requirements, and design offline-first experiences for low-infrastructure schools. Read more about us, or contact our team to plan a compliant classroom-AI rollout.

References

1. Press Information Bureau, AI in Education, Government of India, 2026.

1. TechWire Asia, India makes AI curriculum mandatory for primary schools, November 2025.

1. Convergence Now, India to Integrate AI into School and College Learning by Next Academic Year, 2026.

1. STEMpedia, CBSE Proposes New AI Curriculum in Academic Year 2026-27 for Class 3 Onwards, 2026.

1. Peepul India, AI is coming to every classroom in India from Class 3: are teachers ready?, 2025.

1. The Secretariat, India's schools step into the AI era with a nationwide training plan, 2026.

1. DPDPA.com, Rule 10, Digital Personal Data Protection Rules 2025, 2025.

1. K&S Partners, Children's Data Protection Under India's DPDP Rules, 2025.

1. CyberPeace, Prohibition of Behavioral Tracking and Targeted Advertising for Children Under the DPDP Act, 2023, 2025.

1. The Week, Education in 2026: After AI shook classrooms, rules and skills take centrestage, December 2025.

1. AI for Schools, Artificial Intelligence for Kids in India: What Parents and Schools Need to Know in 2026, 2026.

1. Mondaq, Children's Day Under The DPDP Act 2023 and DPDP Rules 2025: The New Compliance Frontier for EdTech, 2025.

_Last updated: June 22, 2026._