Diagnostic field guide
AI Risk Assessment for Schools
A risk assessment takes the AI a school is actually using, or about to use, and works out what could go wrong, which of those things matter most, and what the school intends to do about each one.
Request a consultationWatch what a school AI risk assessment should produce
What should a school AI risk assessment give you? Identify a specific use, the information involved, possible errors, human review and an owner for the next step.
Read the full transcript
What should a school AI risk assessment actually give you? Think of it like a building inspection. A useful report does more than list concerns. It explains what needs attention, who owns the next step, and what happens next. Start with a specific AI use, not just a product name. What information goes in? Who sees the output? What could happen if it is wrong? Here is an illustrative example. Staff use AI to draft a general family announcement. The concern is inaccurate information reaching families. Check the tool's approval and the human review step. Record what is verified, what is unresolved, and who will follow up. The Department of Education advises checking school or district approval before using classroom tools. Applicable privacy questions need qualified review. NeuralEdge can help organize assessment questions and next steps. An assessment is not a compliance certificate. This is general information, not legal advice. Request a consultation at neuraledgeconsulting.ai or call 703-750-8132 to discuss your school's priorities and state requirements.
General information, not legal advice.
How an entry is traced
Each entry follows one line, from the use to the person responsible for what happens next.
1
Use
What the school is doing or proposing with AI.
2
Possible consequence
What could happen to a person if it goes wrong.
3
Evidence
What the school can verify about the use and its controls.
4
Owner and follow-up
Who the school assigns, and what happens next.
Six areas to review
Not every concern deserves the same attention. These six areas are a practical place to start; your school may add others.
- Use-level risk
- A specific use, such as grading support or family communication, carries different exposure than the tool itself does in the abstract.
- Data handling
- What student, family, and staff information reaches a tool, whether it should, and what happens to it afterward.
- Output reliability
- Where wrong or biased output would reach a student or a family before anyone checks it.
- Vendor dependency
- Features that change without notice, unclear sub-processors, and what happens if the tool disappears mid-year.
- Oversight gaps
- Uses nobody owns, requests approved informally, and decisions no one can locate six months later.
- Implementation
- Default settings, access scope, and the gap between how a tool was approved and how it is actually being used.
The Complaint That Changed Everything
Use this fictional story as a discussion prompt about IEP and Section 504 oversight, evidence and escalation. It is not an example of an AI-caused incident.
A fictional story about IEP implementation, documentation and school leadership accountability. Approximately 4 minutes 38 seconds.
Educational dramatization, not a real family's case or legal advice. IDEA and Section 504 have distinct requirements and procedures.
Watch the IEP and Section 504 story on YouTubeAn illustrative assessment approach
One sequence a school can use. It is illustrative, not a proprietary or proven methodology.
Inventory the uses
Start with uses rather than products. One tool may carry several uses with very different exposure.
Describe what could go wrong
Write each risk as a plain sentence about a consequence to a person, not as a category label.
Assess likelihood and impact
Use a simple, consistent scale and apply the same scale to everything.
Note existing controls
Some risks are already reduced by practice or configuration. Record what is genuinely in place, not what is intended.
Rate what remains
The residual rating, after existing controls, helps set the order of work.
Evidence notes
Who takes part and what they bring both shape what an assessment can see.
Evidence to gather
Tool inventories, vendor documentation, current configurations, existing policies, and anything already logged about incidents or complaints.
Who to involve
Technology and data staff, instructional leaders, a privacy or records owner, and staff who actually use the tools day to day.
What to watch for
Uses that were never formally requested can be missed if staff closest to the work are not consulted.
Where an entry concerns a specific product, the evidence recorded in an AI vendor due diligence review for schools can feed the register. Privacy questions can be planned with FERPA and COPPA AI compliance support.
What public help should a school evaluate?
Separate cybersecurity support, student privacy guidance and funding. They solve different problems.
- Cybersecurity
- CISA K-12 resources: cyber planning materials, including ransomware preparation.
- Student privacy
- U.S. Department of Education Student Privacy resources: questions about how student data is handled.
- Funding
- The official program administrator, for example USAC: applicant, covered cost, date and purchasing checks.
None of these resources is a pass certificate for an AI tool. If funding appears relevant, verify current applicant criteria, covered costs, application dates and purchasing requirements. Do not assume AI consulting or every cybersecurity service is covered.
The school's risk record still needs the gap, affected process, evidence, responsible owner and next action even when no external funding is available.
Comparing treatment options
Every rated risk gets a decision, a named owner and a review date.
| Option | What it means |
|---|---|
| Reduce | Change configuration, narrow access, add a review step, or train the people closest to the use. |
| Accept | Some low-rated risks may be reasonable to carry. The designated school authority accepts any residual risk deliberately, with a named owner. |
| Avoid | Stop or decline the use. Appropriate where sensitive data or student-facing output cannot be adequately overseen. |
| Share | Contract terms or vendor commitments can share part of the exposure, reviewed by your own counsel. Contracts do not remove obligations the school retains. |
Risk register and how this differs from other work
A usable register holds, for each entry: the use it relates to, a plain description of what could go wrong, the rating before and after existing controls, the treatment chosen, the person accountable, and the date it is next reviewed. Schools already maintaining a broader register can add AI entries to it rather than starting a parallel one.
A readiness assessment asks whether the school is positioned to move. Governance work, such as setting out district AI decision authority, sets who decides and how often, and school AI policy records the rules. A risk assessment takes real uses and produces rated, owned, documented decisions about specific exposure. It can stand alone when a particular use is already under scrutiny. More K–12 guidance is on the education hub.
NeuralEdge can facilitate the assessment, document findings, and advise on treatment and next steps. We do not guarantee outcomes or compliance determinations, and this work does not substitute for review by your own counsel or local policy authority.
Frequently asked questions
Four questions to settle before starting an assessment.
- How is a risk assessment different from a readiness assessment?
- A readiness assessment asks whether the school is positioned to adopt AI and produces a starting path. A risk assessment takes specific current or proposed uses and asks what could go wrong, how likely it is, and what the school will do about it.
- What belongs in a risk register?
- For each entry: the use, a plain description of what could go wrong, the rating before and after existing controls, the treatment chosen, the accountable person, and the next review date.
- Who accepts a risk?
- The designated school authority. NeuralEdge can document options and advise on treatment, but the decision to accept residual risk belongs to the school.
- Does a risk assessment certify compliance?
- No. It identifies, documents and prioritizes risks. Determinations about legal obligations belong to your own counsel and policy authority.
Request a consultation
Tell us which AI uses are in scope and whether you already maintain a risk register.
What happens next: a member of our client team reviews your inquiry and follows up to arrange a conversation.
The information on this page is general information about AI risk assessment practices. It is not legal advice, and it does not create a professional or attorney-client relationship. Consult your own counsel about obligations that apply to your organization.
LEADERSHIP
Led by Helena J. Rush
NeuralEdge co founder and principal consultant. Helena brings 25 years of cybersecurity experience to practical AI risk and governance planning for schools and other regulated organizations. Her professional education includes HarvardX’s Cybersecurity: Managing Risk in the Information Age.
Professional Education · HarvardX
Cybersecurity: Managing Risk in the Information Age
Certificate of Completion, issued January 19, 2024
View Helena’s verified credential