What makes an AI kosher?

No one certifies software the way they certify food. Here is the standard worth applying instead, and the questions that separate a filtered AI from one that merely promises to behave.

There is no hechsher for software, and anyone offering one should be treated with suspicion. Kashrus is a system of supervision applied to a physical process. Software is not that. But the instinct behind the question is exactly right: before something enters a home or a classroom, someone responsible should have checked it against a known standard, and you should be able to find out what that standard was.

So the useful question is not "is this AI kosher" but "what is checked, who set the rules, and what happens when the check fails". Those three questions separate a genuinely filtered tool from one that is simply well-behaved most of the time.

1. Where does the filtering run?

This is the single most important question, and the easiest to get a straight answer to. Filtering that runs on the device — a browser extension, a kiosk mode, a managed profile — protects that device. A student who picks up a phone, uses a friend's laptop, or uninstalls the extension is outside it entirely.

Filtering that runs on the server is a property of the account, not the machine. The same rules apply on a school Chromebook at 10am and a phone at 11pm, because the check happens before the request ever reaches a model.

Ask a vendor plainly: if a student signs in from a device you have never seen, what still applies? If the answer involves installing something, the protection has a hole in it by design.

2. Who sets the standard — and can you see it?

A general-purpose AI has a safety policy written by its vendor for a global audience. It will refuse the obvious things. It will not refuse everything a frum school would want refused, because it was never asked to.

What matters for a school is whether the standard is yours: whether you can state the topics that are off limits for your talmidim, whether that list is applied to every tool and not only to chat, and whether you can read back what it did. A filter you cannot inspect is a promise, not a control.

3. What happens when the check cannot run?

This is the question almost nobody asks, and it is where the real difference shows. Every content filter depends on something — a model, an API, a network call. That dependency will occasionally be unavailable.

There are only two possible behaviours. The system can fail open, letting the request through unchecked so the product keeps working. Or it can fail closed, refusing the request until the check is available again.

A filter that fails open is not a filter. It is a filter-shaped feature that switches itself off exactly when nobody is watching.

Failing closed costs something real: during an outage, students cannot work. That is the correct trade for a tool aimed at children, and it is worth asking any vendor to state their answer in writing.

4. Does it cover every tool, or only the chat box?

Filtering is usually built for text first, because text is easiest. Image generation, video, voice and story tools often get added later, and the filter does not always follow them.

The gap is not theoretical. A student blocked from discussing a topic in chat, who can generate a picture of it, has not been protected — they have been redirected. When you evaluate a platform, test the same restricted subject in every tool it offers, not just the one on the front page.

5. Can a parent or menahel see what happened?

Oversight is not surveillance of every keystroke, and a system that reads like a wiretap will not be adopted. What a responsible adult needs is narrower: was anything blocked, roughly what category was it, and is there a pattern worth a conversation.

A platform that blocks silently and keeps no record leaves the adult with nothing to act on. One that stores every prompt in full creates a different problem. The useful middle is a record of decisions, with enough context to be meaningful and not so much that it becomes a copy of every child's private questions.

A short checklist

Does the filter run on the server, so it follows the student off the school's devices?
Can the school define its own blocked topics, above the vendor's baseline?
Do those rules apply to images and video, not only to chat?
Does the system fail closed when the safety check is unavailable?
Can a parent or administrator see what was blocked, without reading everything?
Are the categories that must never be switched off actually locked, or just unchecked by default?

Any vendor should be able to answer all six in a sentence each. If a question produces a long detour, that is your answer.

Navōn was built around these six answers.

Common questions

Is there a hechsher or kosher certification for AI software?

No. Kashrus certification applies to a physical production process and there is no equivalent body certifying software. The practical alternative is to check specific properties: where the filtering runs, who sets the standard, whether it covers every tool, and what happens when the check fails.

Is ChatGPT kosher for students?

General-purpose assistants apply a safety policy written by their vendor for a global audience. They refuse obviously harmful content but were never asked to apply a particular community's standards, and a school cannot add its own blocked topics or see what was refused.

What is the most important thing to check?

Where the filtering runs. Device-based filtering protects a device; server-side filtering is a property of the account and applies wherever the student signs in.

Published by Navōn. How these guides are written and checked.