Product-level review
AI Vendor Due Diligence for Schools
Before a school adopts, renews or expands an AI tool, its reviewers need evidence about the intended use, student information, vendor access and contract controls. Due diligence organizes that evidence and the unresolved questions so the school's authorized decision-makers can decide what happens next.
A vendor's marketing statement is not the same as a reviewed approval record. See the K–12 AI governance hub for related school guidance.
What should a school check before approving an AI tool?
A 1 minute 11 second briefing on intended use, vendor evidence and school review, with a school-key analogy and illustrative example.
Read the full transcript
What should a school check before approving an AI tool?
Think of it like giving someone a school key. Before handing it over, you need to know which doors it opens, who can use it, and when access ends. For AI, those doors are the information and systems the tool can reach.
Start with the intended use, then request written answers about data use, access, security, retention, and deletion. Connect them to the product and contract.
For example, a staff drafting tool might add student accounts. That change needs review, not an automatic yes. Record missing answers as unresolved.
The U.S. Department of Education advises teachers to check school or district approval before using classroom tools. Applicable privacy requirements need qualified review.
NeuralEdge can help organize vendor evidence and review questions. Your school decides. This is general information, not legal advice.
Request a consultation at neuraledgeconsulting.ai or call 703-750-8132 to discuss your review and state requirements with your team.
General information, not legal advice.
What information will the tool receive?
Map the proposed workflow: who will use the tool, what goes in, which systems it connects to, and which outputs people will rely on. Separate staff-only drafting from student accounts and student records.
Ask whether accommodation information or special-education records could enter the tool. Do not use real student information in an unapproved demonstration.
What will the vendor do with the information?
Request documented permitted uses, model-improvement terms, access, subprocessors, retention and deletion. Connect each answer to the actual product and contract.
Answers the vendor cannot provide stay unresolved. They are not passes, and they are not proven failures.
Which evidence belongs in the approval record?
This is an informational planning matrix. It is not a form, and it does not collect student data.
| # | Review area | Evidence to request | School record to complete |
|---|---|---|---|
| 01 | Purpose and data | Evidence to request: Proposed users, input categories and integrations | School record to complete: Scope and reviewer: To complete |
| 02 | Use and model improvement | Evidence to request: Written permitted-use and training terms | School record to complete: Evidence reference and open questions: To complete |
| 03 | Access and subprocessors | Evidence to request: Access roles and third-party handling | School record to complete: Responsible reviewer and conditions: To complete |
| 04 | Security and incidents | Evidence to request: Relevant controls and notification process | School record to complete: Findings and escalation owner: To complete |
| 05 | Retention and deletion | Evidence to request: Retention terms and deletion procedure | School record to complete: Follow-up and evidence reference: To complete |
| 06 | Contracts and renewal | Evidence to request: Terms, changes and renewal dates | School record to complete: Qualified review and decision date: To complete |
| 07 | Human escalation | Evidence to request: How staff challenge outputs and report concerns | School record to complete: Named owner and next action: To complete |
Does funding or a public recommendation approve an AI vendor?
No. Funding eligibility, purchasing rules and school approval answer different questions. A program may cover a defined category of equipment or services without deciding whether a particular AI use is appropriate for your students or records.
| Question | What to check | What it answers |
|---|---|---|
| Funding | What to check: Current official program rules, permitted costs and dates | What it answers: Whether the applicant and the purchase fit the program |
| Vendor and data | What to check: Uses, retention, access, subprocessors and contract terms | What it answers: Whether the proposed handling passes the school's review |
| Educational use | What to check: Purpose, accessibility, staff training and human review | What it answers: Whether this school approves this specific use |
For a tool proposed to summarize support documentation, “the vendor serves schools” is not enough. Identify the information involved and the vendor's permitted uses. Missing answers remain unresolved, with a responsible reviewer and next step. The Department of Education's FERPA FAQ on online classroom tools frames the approval question, and the FERPA and COPPA AI privacy guide covers the privacy review.
Who decides whether an exception is acceptable?
The school's designated authority decides, within its own governance and procurement structure. Document missing evidence, proposed limits and the escalation route. A pilot can have a narrower scope than a full rollout.
Who holds that authority is set out in AI governance for school districts, and the rules staff follow once a tool is approved belong in the school's AI policy. Where a decision turns on how much exposure a use carries, a school AI risk assessment can help.
Proceed
Evidence supports the use as described and the oversight already exists. The reasoning is recorded.
Proceed with conditions
Adoption goes ahead with named configuration limits, a narrower scope, or a review date attached.
Defer
Evidence is incomplete. The request pauses pending specific documentation, not an indefinite wait.
Decline
The use or the data handling does not fit what the school is prepared to oversee. The reason is written down.
How should schools evaluate AI tools used in special education?
Begin with the intended task, accessibility, data handling, evidence of suitability and human review. General best-tool lists cannot establish whether a tool fits a particular learner or school.
Involve the school's designated special-education, privacy and instructional specialists in the review.
NeuralEdge can structure the evidence request, facilitate the review, document findings and advise on next steps. We do not approve or certify vendors, and this work does not substitute for review by your own counsel or local policy authority.
Frequently asked questions
- What is school AI vendor due diligence?
- It is an organized review of evidence about a specific AI tool's intended use, student information, vendor access and contract controls, so the school's authorized decision-makers can decide whether to adopt, renew or expand it.
- Is a vendor's compliance statement enough?
- No. A marketing or compliance statement is not a reviewed approval record. Connect each answer to the actual product and contract, and have qualified reviewers assess it.
- What if evidence is missing?
- Record the question as unresolved, not as a pass or a proven failure. The school's designated authority can defer, narrow the scope or set conditions while it is answered.
- Does renewal need another review?
- Review again when terms, features, data use or student access have changed since the last decision. The original record shows what was agreed and what to compare.
Request a consultation
Tell us which tool is under consideration and whether the decision is a purchase, a renewal, or an expansion.
What happens next: a member of our client team reviews your inquiry and follows up to arrange a conversation.
The information on this page is general information about AI vendor review and governance practices. It is not legal advice, and it does not create a professional or attorney-client relationship. Consult your own counsel about obligations and agreements that apply to your organization.
LEADERSHIP
Led by Helena J. Rush
NeuralEdge co founder and principal consultant. Helena brings 25 years of cybersecurity experience to practical AI risk and governance planning for schools and other regulated organizations. Her professional education includes HarvardX’s Cybersecurity: Managing Risk in the Information Age.
Professional Education · HarvardX
Cybersecurity: Managing Risk in the Information Age
Certificate of Completion, issued January 19, 2024
View Helena’s verified credentialSources and limits
The U.S. Department of Education's FERPA FAQ on online tools and the FTC's COPPA frequently asked questions are general reference points, not blanket legal approval. The FTC page notes an amended rule. Requirements depend on context and qualified review.
For related privacy planning, see FERPA and COPPA AI compliance. This page is general information, not legal advice.