Risk Tier Rubric — Appendix D (p. 134)

Why Risk Tiers Are the Rule That Does the Work

A simple three-tier model stops governance from becoming emotional. You are not deciding whether you like a tool. You are classifying impact and selecting safeguards accordingly. Risk tier determines the required safeguards, approvals, and documentation for every AI tool and use case in your district.

When in doubt, default to the higher tier.

---

LOW RISK — Allowed with Standard Controls

Definition: Internal drafts; no student identifiers; no student-facing output without human review.

Examples: Internal emails and agendas, lesson draft ideas (non-specific), rubric and feedback templates, public document summaries, general translations.

Required controls:

• No student PII or sensitive student information in unapproved tools
• 60-Second Human Review before sharing any output
• Approved tools list only

---

MODERATE RISK — Human Review Required + Documentation

Definition: Student-facing materials; district communications; instructional content that shapes student outcomes or public perception.

Examples: Family newsletters, student feedback language, website content, instructional materials.

Required controls:

• Named Human Review accountable — documented before sharing
• Approvals Register entry required
• Escalate to AI Review Team if data sensitivity is unclear

---

HIGH RISK — AI Review Team Approval + Full Safeguards

Definition: Tools or use cases that process education records or sensitive student information; influence interventions, placement, discipline, or services; include predictive scoring or surveillance-like capabilities.

Examples: SPED documentation support, discipline or placement decision tools, predictive dashboards, counseling record tools.

Default to High when any of these are true:

• Tool processes student identifiers or sensitive student information
• Output influences interventions, placement, discipline, or student services
• Vendor cannot answer basic questions about data retention, access controls, or auditability
• Use case involves predictive scoring or automated recommendations about students

Required controls:

• Formal AI Review Team approval before any use
• Documented conditions of use and restricted access
• Monitoring cadence and named accountability owner
• Legal and privacy review where applicable

---

High risk does not always mean never. It means formal review, documented safeguards, restricted use, and named accountability — before anything scales.