한국어 
日本語 
English 
What makes an AI LMS different
Last updated: 2026-07-15
The question is no longer whether a platform has AI. It is how that AI is verified, controlled and procured. Here are the eight AI control requirements that public-sector RFPs actually ask for, the nine recurring requirement patterns, and an eight-step process for writing an AI LMS RFP.
named in RFPs
requirement patterns
RFP required to be RAG-ready
An AI LMS is not "an LMS with AI bolted on"
An AI LMS organizes internal training material and question banks into a data layer that AI can reference, connects a commercial LLM through a controlled path, and routes every AI draft through human review and approval before it enters the LMS. The test is therefore not "does it have AI?" but "does it answer from our own material, does it cite sources, does a person approve the output, and is the whole chain auditable?" Those are the exact items 2026 public procurement documents ask for.
What follows is drawn from publicly posted requests for proposal for AI on learning platforms, rewritten so that a buying organization can use it directly. It is not a vendor ranking. It is a list of what to require and what evidence to demand. For the TouchClass AI feature list itself, see AI features.
Does it qualify as an AI LMS? — a self-assessment table
“Does it have AI?” is not a test. For each of seven AI capabilities, this table states what to check in the demo and what to require in the RFP.
The verdict column is deliberately blank — it is there to be filled in while watching a candidate’s demo.
| AI capability | What to check (in the demo) | What to require (RFP clause) | Verdict |
|---|---|---|---|
| Answers grounded in internal material (RAG) | Upload an internal document, then ask about a fact that exists only inside it. Does the answer come with the source document and the location within it? Ask something the document does not contain — does it say so, or invent an answer? | Control 5 (source attribution) · 2 (no outbound sensitive data) | □ Meets □ Partial □ Fails |
| Automated content drafting | Hand it one URL or one file and time how long a curriculum and learning-page draft actually takes. Confirm that nothing publishes until a person approves it. | Control 4 (input/output validation) · 8 (permission-based output control) | □ Meets □ Partial □ Fails |
| Personalized recommendation | Look for the reason next to the recommendation — what signal produced it. Learners do not trust a recommendation that cannot explain itself. | Control 3 (scoped invocation) · 5 (source attribution) | □ Meets □ Partial □ Fails |
| Completion prediction & drop-off alerts | Does it stop at a score, or does it carry through to segmenting the at-risk group and firing the reminder? A prediction that only produces a number does not reduce operating effort. | Control 6 (audit logging) | □ Meets □ Partial □ Fails |
| Natural-language queries for admins | Can the answer be reconciled against the underlying aggregate metric? Without a reconciliation path, that number cannot go into a report. | Control 3 (scoped invocation) · 6 (audit logging) | □ Meets □ Partial □ Fails |
| Auto captioning & translation | Can a person edit and approve the output, and is publication blocked before approval? The approval step matters more than the number of supported languages. | Control 4 (input/output validation) · 8 (permission-based output control) | □ Meets □ Partial □ Fails |
| Latency & cost observability | Are AI call volume, latency and cost visible in the admin console? If they are not, there is no way to control spend once usage grows. | Control 6 (audit logging) · 7 (export & deletion evidence) | □ Meets □ Partial □ Fails |
The tests above derive from the 8 AI control requirements, sourced from publicly posted requests for proposal. This table has no vendor column — it is not a ranking, it is an instrument for judging each candidate on its own.
How TouchClass meets these seven is set out in how TouchClass meets these requirements, using published evidence and its verification path only. Where no public document exists, the entry reads “no published evidence.”
What an AI LMS actually changes
-
RAG (retrieval-augmented generation) searches internal documents first and generates an answer grounded in what it finds. Procurement documents do not stop there: they also require document parsing, chunking, metadata design, embeddings, deduplication and re-ranking, search history, and source attribution. So the first gate in an AI LMS review is not the model — it is whether your own material is in a state an AI can read.
A public RFP required roughly 230GB of internal material and 718 exam items to be structured -
A design where AI output goes straight to learners rarely survives review in regulated or public-sector settings. Published requirements ask for generate → compare → revise or regenerate → review comments → expert sign-off → approval → version history as a product feature. A demo that shows a "Generate" button and a demo that shows an approval step with version history are two different products.
Human-in-the-loop: review, revise, regenerate, approve, version -
Documented proof that customer data is excluded from model training when an external LLM API is used, blocking of sensitive data in outbound prompts, limits on what the agent may call, prompt-injection filtering, source attribution, audit logs, and certified deletion at contract end — these are not boilerplate security lines. They are purchase conditions. All eight are listed in the table below.
Eight AI controls become purchase conditions -
An AI tool that sits beside the LMS scores badly in evaluation. What buyers ask for is a set of role-specific agents wired into the question bank, course operations, the admin permission model, and the exports (PDF, Excel). Not one learner chatbot, but task-specific screens with real input and output forms for exam authoring, course planning, operations and learner support.
From learner chatbot → admin and expert work agents -
LLM usage, response time, growth of the RAG corpus, retries and repeated calls all turn into real money after go-live. Published requirements ask for token cost and latency to be managed as explicit operating metrics, and they ask about extensibility too: swapping models, growing the corpus, adding agents, migrating clouds, exporting data, open APIs. Confirm before signing that the architecture does not lock you to one model.
Token cost, latency, and the right to swap models
→ item draft
→ session draft
with source shown
The 8 AI control requirements — ready to paste into an RFP
These controls recur across publicly posted requests for proposal for AI on learning platforms.
For each one, decide the evidence you will accept before you sign, not after.
| Control | What it actually means | Evidence to demand |
|---|---|---|
| 1. Excluded from model training | When an external LLM API is used, customer data must be configured out of model training, with documentation to prove it | API configuration record, contract clause, sub-processor scope |
| 2. No outbound sensitive data | Confidential documents and personal data must be filtered out of prompts and context before any external call | Filtering policy, masking rules, exception handling |
| 3. Limited call scope | The agent's reachable material, functions, APIs and user permissions are constrained | Permission matrix, per-feature AI access settings |
| 4. Input and output validation | Prompt injection, unsafe generation, unsupported answers, and formula or image errors are filtered | Validation rules, blocked examples, hallucination mitigation plan |
| 5. Source attribution | Every generated result carries the reference material and retrieval basis so a human can check it | Attribution UI, path to open the original document |
| 6. History and audit logs | Views, edits, approvals, downloads, API calls and errors are recorded and reviewable | Log schedule, retention period, export method |
| 7. Certified deletion | Source files, processed data, embeddings and outputs are inventoried, then deleted, returned or destroyed at contract end | Data inventory, deletion procedure, disposal certificate template |
| 8. Output control by role | PDF and Excel download rights and approval rights are governed by admin policy | Download permission policy, separated approval rights |
Source: "2026 e-Learning Platform AI Agent Development" request for proposal issued by the Korea Association for Radiation Application (published on the Korea ON-line E-Procurement System), together with a requirements review of seven comparable 2025–2026 notices from Korean universities and public institutions.
What matters is not how many of the eight a vendor says it supports, but how many it can evidence in writing. Anything answered only verbally belongs in the contract as a clause, or it is not a control.
The 9 recurring requirement patterns
Organizations adding AI to a learning platform converge on the same nine asks.
Walking through them one by one surfaces what a feature demo tends to hide.
| Pattern | What it covers | What a buyer should check |
|---|---|---|
| 1. Internal material made RAG-ready | Convert documents, images, tables and formulas into text, Markdown or JSON, then chunk and tag them | Is data onboarding inside the quote, and what happens to files that fail to parse? |
| 2. Domain agents | Separate agents for exam authoring, course planning, operations and learner support | One general chatbot, or task screens with real input and output forms? |
| 3. Grounded generation | Retrieved references, search history and source attribution to minimize hallucination | Can you open the cited source document from the generated answer? |
| 4. Human-in-the-loop | Draft, then review, revise, regenerate, approve and version | Are approval rights separated, and is the review trail retained? |
| 5. Integration with the existing LMS | Question bank, course operations, admin functions, permissions and exports | Does AI output actually land in the existing question bank and courses? |
| 6. Security and governance | Outbound data blocking, API opt-out, permissions, logging, export control, deletion | Can you get written evidence for the eight controls above? |
| 7. Cost and performance management | LLM usage, latency, corpus growth, retries and repeat-call efficiency | Who carries token cost, and how is overage billed? |
| 8. Proof of concept | Scenarios on your own material, an accuracy target, expert review, a working prototype | Did you run the PoC on your own documents and check attribution yourself? |
| 9. Extensibility | Model swap, corpus growth, new agents, cloud migration, export, open APIs | Are you locked to one model or platform, and can you get your data out? |
Source: requirements analysis of publicly posted AI agent requests for proposal for learning platforms. The "what a buyer should check" column restates each requirement from the buying organization's point of view.
Translating the requirements into architecture
Put the eight controls into architectural language and five components fall out.
They work as a checklist both for writing an RFP and for reading the proposals that come back.
AI Gateway
Routes every external LLM call through one place so scope, model and usage stay governed.
RAG Knowledge Base
Parses, chunks and embeds internal material into a searchable knowledge layer.
Policy Engine
Applies sensitive-data filtering, role-based access and input/output validation rules.
Audit Log
Records views, edits, approvals, downloads and API calls so the chain can be inspected later.
Review Workflow
Makes generate → review → approve → version an actual product feature.
What a public RFP actually demanded
Below is the requirement structure of the "2026 e-Learning Platform AI Agent Development" RFP issued by the Korea Association for Radiation Application, published on Korea's public e-procurement system.
The domain is specialized, but the structure transfers directly to enterprise LMS evaluation.
Table A. The RAG corpus — what, and how much
Before asking for any AI feature, the issuing body did one thing first: it inventoried its own material. Format, count, volume and current state. That table is where an AI RFP starts.
| Category | Count / volume | Format and state |
|---|---|---|
| Books | ~20 items / ~10GB | Office documents, PDF |
| Licensing preparation material | ~50 items / ~100GB | Office documents, PDF |
| Specialist training material | ~50 items / ~120GB | Office documents, PDF |
| Question bank | 718 items | Already loaded in the existing LMS |
| Total | ~120 items / ~230GB | Including duplicates |
Source: "2026 e-Learning Platform AI Agent Development" RFP, Korea Association for Radiation Application, published 2026-05 on the national e-procurement system.
Table B. The six functional requirements — defining the AI's job
Of 33 requirements in total, 6 are functional, 4 performance, 1 infrastructure, 4 interface, 6 security, 3 testing, 5 project management and 4 project support. The center of gravity is not a learner chatbot — it is an agent for administrators and subject-matter experts.
| ID | Requirement | Core content |
|---|---|---|
| FUN-001 | AI agent common requirements | Integration with the existing LMS, standard processing structure, modularity, model-change readiness, permissions, logs, review history, deliverables |
| FUN-002 | Collect, clean and structure internal material | Extract from unstructured documents, split into retrievable units, add metadata, manage duplicates, errors and staleness |
| FUN-003 | RAG-based reference | Internal search, embeddings and vector data, metadata filtering, deduplication and re-ranking, source information, search history |
| FUN-004 | Exam authoring support | Subject, unit, difficulty, item count and type as input; item, options, answer key and rationale as output; near-duplicate check; PDF and Excel export; question-bank integration |
| FUN-005 | Course planning support | Audience, course type, objectives and hours as input; category tree, topics, sessions, objectives and outlines as output; comparison with prior plans |
| FUN-006 | Review, revise and approve output | Revise, supplement, regenerate, review comments, version history, expert sign-off, publish the approved result |
Scoring was 80 points technical to 20 points price, and bidders had to demo at least one working prototype — RAG retrieval or draft generation — at the presentation. Source: as above.
Table C. The six requirement packages that recur across notices
Read alongside seven comparable 2025–2026 notices from Korean universities and public institutions, AI requirements converge on six modules. This is a pattern, not one institution's quirk.
| Package | Included capabilities |
|---|---|
| AI Knowledge / RAG | Ingestion, chunking, embedding, retrieval, re-ranking, attribution, original-document access |
| AI Teaching Agent | Lecture summaries, video scripts, item generation, rationales, question-bank storage |
| AI Tutor / Advisor | Q&A grounded in course material, level-adjusted answers, learning-path recommendations |
| AI Diagnosis | Competency diagnostics, auto-grading, gap analysis, individual content recommendations |
| LXP Data Layer | xAPI, LRS, learning-activity capture, dashboards, reports, analytics APIs |
| AI Governance | Opt-out, sensitive-data filtering, permissions, logs, download control, certified deletion |
Source: requirements analysis of seven publicly posted 2025–2026 notices from universities and public institutions. The issuing bodies are named in the public documents; this page cites the requirement structure only.
Writing an AI LMS RFP — 8 steps
Lead with a feature list and the proposals come back as feature lists. Lead with data, controls and verification and the proposals become comparable.
These eight steps rearrange the published requirement structure into the order a buying organization should write it.
This chapter covers the AI requirements only. If you are writing the full LMS request — security, completion tracking, integration and cost included — set the frame with how to write an LMS RFP — a 60-item requirements spec first, then attach this chapter as the separate AI section.
Inventory your own material first
Tabulate format (office documents, PDF, video), count, volume, whether personal data is present, and how current each file is. Without this table, no one can price the RAG work.
Put preprocessing in the scope of work
Text extraction, parsing of tables, formulas and images, splitting into retrievable units, metadata design, and cleanup of duplicate and erroneous files.
Specify RAG in detail, not as a word
Beyond retrieval: metadata filtering, deduplication, re-ranking, search history, source attribution, access to the original document, and exception handling.
Define the AI's job as screens
For each task — exam authoring, course planning, operations Q&A — name the input fields and the deliverables (PDF, Excel, saved to the question bank).
Make review and approval a requirement
Generate → compare → revise or regenerate → expert sign-off → approve → version history, written as a functional requirement with approval rights separated.
Put the eight AI controls in the security section
Training opt-out evidence, outbound blocking, call-scope limits, input/output validation, source attribution, audit logs, certified deletion, and role-based output control — each with the document you will accept as proof.
Contract cost and latency as operating metrics
Name who carries LLM usage and token cost, the response-time standard, how overage is billed, and the procedure for swapping models.
Fix the PoC criteria and the scoring weights
Publish the scenarios to be demonstrated on your own material, the accuracy target, attribution correctness, the review and approval flow, output quality — and the points each carries.
These eight steps rearrange the published requirement structure (6 functional, 4 performance, 1 infrastructure, 4 interface, 6 security, 3 testing, 5 project management, 4 project support — 33 in total) into the order a buying organization writes them.
How TouchClass answers these requirements
No claims about other products. For each of the eight controls, only the published evidence and where to verify it,
and where there is no published evidence, the row says so. Ask other candidates for the same table and the comparison writes itself.
| Control | Published evidence from TouchClass | Where to verify |
|---|---|---|
| 1. Excluded from model training | Knowledge assets created or provided by a customer while using AI services are not used as AI model training data. | /en/security /en/security-enterprise |
| 2. No outbound sensitive data | The AI chatbot answers from internal training material rather than the open internet, and file upload and download can be blocked. | /en/ai-assistant |
| 3. Limited call scope | Answer scope is separated by category. Permission to use the AI chatbot, AI ShortClass and AI QuickMaker can be granted at sub-administrator level (released 2025-11). | /en/ai-assistant /en/ai-admin |
| 4. Input and output validation | Administrators set the AI's answer scope and tone directly through prompts, and per-category scope limits reduce the chance of hallucination. | /en/ai-assistant |
| 5. Source attribution | Course Q&A answers display the training material they were drawn from. | /en/ai-assistant |
| 6. History and audit logs | Access control and operational records are managed within the scope of ISMS-P and ISO/IEC 27001:2022 certification. However, the log schedule, retention period and export method for AI-call-level audit logs are not published. Request them during evaluation. | /en/security |
| 7. Certified deletion | Data is stored in the AWS Seoul region, encrypted with AES-256 at rest and TLS in transit. The deletion and disposal procedure for AI preprocessing data and embeddings is not published. Request the procedure document at contract stage. | /en/security-enterprise |
| 8. Output control by role | Sub-administrator separation and least-privilege access control apply, and screen-capture blocking with watermarking protects assets. | /en/security |
When each TouchClass AI capability shipped
"We have AI" is hard to verify. Release history is not.
The dates below are from the public release notes: 104 releases between April 2021 and March 2026, of which 34 landed in 2025.
| Released | Capability | What it made possible |
|---|---|---|
| 2025-02-17 | AI chatbot | AI chatbot made available in the admin console |
| 2025-04-17 | AI Content QuickMaker | AI-assisted content creation from the admin console |
| 2025-06-09 | AI ShortClass generation | Short lessons generated automatically from video content, with keyword-linked follow-on courses |
| 2025-07-03 | AI authoring tools | AI writing flow inside the editor, available for testing and use in the admin console |
| 2025-08-22 | AI chatbot extensions | File and image attachments, image generation, live web search |
| 2025-11-03 | Sub-administrator AI permissions | AI chatbot, ShortClass and QuickMaker rights delegated to sub-administrators, so AI operations are not bottlenecked on one admin |
Source: TouchClass public product update history. Feature detail: AI features · AI assistant · AI ShortClass · AI admin.
AI-driven learning recommendations have been reported to raise completion rates by 35% (McKinsey, 2024). That is a third-party benchmark, not a measured result from TouchClass customers. Measure the effect on your own organization in a pilot.
Frequently asked questions
The eight questions that come up most often when organizations evaluate an AI LMS.
What is an AI LMS?
An AI LMS is not a learning management system with AI features bolted on. It organizes internal training material and question banks into a data layer that AI can reference, connects a commercial LLM through a controlled path, and makes training operations automatable, reviewable, approvable and auditable. The test is not whether AI is present, but whether it answers from your own material, cites its sources, requires a human to approve, and leaves an auditable trail.
How should I compare AI LMS vendors?
Compare on evidence for eight controls, not on the number of AI features: exclusion from model training, no outbound sensitive data, limited call scope, input and output validation, source attribution, history and audit logs, certified deletion, and output control by role. Separating "we support that" from "here is the document" narrows a shortlist quickly. For choosing the LMS itself, see how to choose an enterprise LMS.
What does RAG mean in an LMS?
RAG retrieves internal documents first and generates an answer grounded in what it finds. In an LMS context it does not stop at search. Published requests for proposal specify document parsing, splitting into retrievable units, metadata design, embeddings and vector data management, deduplication and re-ranking, search history, source attribution and access to the original document. The first gate is therefore not model choice but whether your material is in a state an AI can read.
How do I verify that our training material is not used to train AI models?
When an external LLM API is involved, ask for documented evidence of the training opt-out configuration and check that the same commitment appears as a contract clause. Ask for storage location, processing scope and sub-processor arrangements as well. TouchClass does not use knowledge assets created or provided by customers during AI service use as AI model training data. Details are published at https://www.touchclass.com/en/security
What does AI learning governance require in practice?
Restated as architecture, the published requirements come to five components: an AI Gateway that governs external calls, a RAG Knowledge Base that holds internal material, a Policy Engine for sensitive-data filtering, permissions and input/output validation, an Audit Log covering views, edits, approvals, downloads and API calls, and a Review Workflow covering generation, review, approval and version history. Reading proposals against those five boxes exposes what a feature demo hides.
What belongs in an AI LMS RFP?
Write it in the order data, controls, verification rather than starting from features. Inventory internal material (format, count, volume, presence of personal data); specify preprocessing; detail the RAG requirements including attribution, re-ranking and search history; define agents as task screens; require the review and approval workflow; put the eight AI controls in the security section; contract cost and latency as operating metrics; and fix the PoC criteria and scoring weights. Without the inventory table, no one can price the RAG work.
What did a public-sector AI LMS procurement actually ask for?
The 2026 e-Learning Platform AI Agent Development RFP issued by the Korea Association for Radiation Application, published on Korea's national e-procurement system, required roughly 230GB of internal material and a 718-item question bank to be collected, cleaned and structured for RAG, and required exam and course-planning drafts to be generated but reviewed and approved by staff and subject-matter experts. It listed 33 requirements in total (6 functional, 4 performance, 1 infrastructure, 4 interface, 6 security, 3 testing, 5 project management, 4 project support) and scored bids 80 points technical to 20 points price.
When did TouchClass ship its AI capabilities?
Per the public release notes: the AI chatbot on 17 February 2025, AI Content QuickMaker on 17 April 2025, AI ShortClass generation on 9 June 2025 and AI authoring tools on 3 July 2025. File and image attachments plus web search were added to the chatbot on 22 August 2025, and on 3 November 2025 AI permissions became delegable to sub-administrators. The release notes cover 104 releases from April 2021 to March 2026, 34 of them in 2025.
Next steps
Verifying AI, reviewing the product and passing a security assessment are different stages. Go to the one you are in.
To see the AI features
AI content generation, learning assistant, curation, ShortClass and admin capabilities, shown on real screens.
SecurityIf a security review is next
ISMS-P and ISO/IEC 27001:2022 certification scope, plus a vendor-neutral security checklist.
SelectionIf you are still choosing an LMS
Eight selection criteria and the baselines from 35 months of operating data across 100+ companies.
