Governing AI in Education: Mapping the Regulatory Gap Between Algorithmic Deployment and Student Data Protection in Asia-Pacific Jurisdictions

Abstract

The rapid deployment of artificial intelligence systems in educational settings across Asia-Pacific jurisdictions has outpaced the development of regulatory frameworks capable of addressing the distinctive risks these systems pose to student data. This article provides a systematic literature review and descriptive comparative institutional analysis of six major regulatory frameworks — the EU General Data Protection Regulation and AI Act, China's Personal Information Protection Law and algorithmic regulation, the ASEAN national PDPA series, the ASEAN Model Contractual Clauses, and the US FERPA/COPPA reference framework — mapping their coverage against the documented realities of AI education deployment. Four structural dimensions of regulatory gap are identified: (1) the absence of educational context-specificity in platform-neutral regulatory designs; (2) a temporal mismatch between dynamic AI system updates and static compliance mechanisms; (3) the fragmentation of cross-border accountability when student data traverses jurisdictional boundaries; and (4) the diffusion of responsibility across multi-actor deployment chains. This article provides the descriptive and empirical foundation for a three-paper research series. It does not propose solutions or normative prescriptions; those normative and design dimensions are addressed in companion work and constitute directions for future research.