Here is a bit more info from the AOPA site:
“The new rule requires every school and every freelance flight instructor to register with TSA. It puts the onus on the flight school and individual flight instructors to determine if a flight student is a foreign national. If so, the school or flight instructor must notify TSA that a non-U.S. citizen has requested flight training.
For a foreign national to receive training in an aircraft weighing less than 12,500 pounds, the school or flight instructor must send TSA a photo of the student after he or she first arrives for training. The student has to send TSA passport and visa data, fingerprints, and training details, among other things. In an illustration of the confusion over the rule, the student also must supply a "unique identification number assigned by TSA." TSA will charge the student $130 to process the application.
Training in aircraft weighing less than 12,500 pounds can start without TSA approval, as long as TSA has been notified and sent the applicant's information. Of course, if TSA determines the student is a threat, training must stop.
The rules requires that schools or flight instructors retain applicant information and TSA approval records for five years, and the records are subject to TSA audit.
awareness training program" for each flight school or independent flight instructor, regardless of whether they are training foreign students. Schools must maintain a record of such training for one year after the employee leaves the school. It doesn't say how long independent instructors have to keep records of their security training. Again, these records are subject to TSA and FAA audit.
Flight schools and instructors have to comply with the new rule starting October 5 for training in large aircraft, October 20 for training in aircraft weighing less than 12,500 pounds.”