Incident Response Protocol

[N]% of students were exposed to AI-related incidents (deepfakes, inappropriate content, data breaches) in 2024–2025. Most districts have no protocol. This changes that.

Level Classification — At a Glance

LEVEL 1
Minor Incident⏱ 24-Hour Response
Single student, limited exposure, no lasting harm
LEVEL 2
Moderate Incident⏱ 12-Hour Response
Multiple students, potential harm, requires investigation
LEVEL 3
Severe Incident⏱ 4-Hour Response
Widespread harm, legal liability, media risk

1 — Incident Classification System

Criteria	Level 1 — Minor	Level 2 — Moderate	Level 3 — Severe
Examples	AI chatbot gave inappropriate joke (1 student) · Tool bug lost assignment · False plagiarism accusation (quickly resolved)	AI exposed student emails to classmates · Biased output targeting group (5+ students) · Inappropriate images shown to class	Deepfake imagery of students · Mass data breach (100+ records) · Suicide/self-harm AI content · Vendor selling student data
Response Timeline	24 hours	12 hours	4 hours
Notify	Affected parents · School principal · Tech coach	All affected parents (individual letters) · Principal + district admin · Legal review · Board (48 hrs)	All parents (certified mail) · Superintendent + entire board · External legal counsel · Law enforcement · State education dept. · Media response
Documentation	Internal log only	Formal report + parent letters	Comprehensive report + legal filing + board resolution

2 — Response Playbooks

Level 1 Response Checklist

Single student · 24 hours

Immediate Actions (0–2 hours)

Document incident (screenshots, logs)
Suspend tool for affected students (not district-wide)
Notify principal
Identify affected students (count, names)

Investigation (2–8 hours)

Interview teacher who discovered the incident
Interview affected students (if age-appropriate)
Review tool logs
Contact vendor support (if tool-related)

Parent Notification (8–24 hours)

Send individual email to affected parents
Include: what happened, impact, response, prevention
Offer: opt-out, alternative assignment, meeting

Remediation & Prevention (24–48 hours)

Provide alternative assignment
Counsel affected students if needed
Update tool settings (if configuration issue)
Add to incident log & review at next PLC meeting

Level 2 Response Checklist

Multiple students · 12 hours

Immediate Actions (0–1 hour)

Document incident (screenshots, logs, witness statements)
Suspend tool district-wide (pending investigation)
Notify principal + district admin
Preserve evidence (do not delete logs)
Identify ALL affected students

Investigation (1–4 hours)

Form incident team (admin, tech, legal, counselor)
Interview all witnesses
Contact vendor — escalate to legal/privacy officer
Determine scope (how many students, what data)

Legal Review (4–8 hours)

FERPA compliance assessment
State law requirements (mandatory reporting?)
Vendor contract review (liability clauses)
Determine if law enforcement is needed

Parent Notification (8–12 hours)

Send individual certified letters to all affected parents
Include: factual description, timeline, impact, response
Offer: counseling, opt-out, meeting with admin
Establish hotline for parent questions

Board Notification (12–48 hours)

Brief board president
Prepare executive session briefing
Schedule board discussion (if policy revision needed)
Vendor meeting — demand corrective action
Update vendor scorecard (major deduction)

Level 3 Response Checklist

Severe / Widespread · 4 hours

Immediate Actions (0–30 minutes)

Document everything (screenshots, logs, student roster)
Suspend ALL AI tools district-wide
Notify superintendent (direct call — not email)
Legal hold on all evidence (do not delete anything)
Identify ALL affected students (complete roster)

Emergency Response Team (30 min–2 hours)

Superintendent activates crisis team
External legal counsel engaged immediately
Communications director prepares holding statement
Counselors deployed to ALL affected schools
Law enforcement contacted (if criminal activity)

Investigation (2–4 hours)

Forensic data collection (preserve chain of custody)
All witness interviews recorded
Vendor legal team contacted (preserve evidence)
State education department notified (mandatory reporting)

Parent Notification (4–12 hours)

Certified mail to ALL affected parents
Individual meetings offered
Counseling provided immediately
24/7 hotline staffed for 2 weeks
Translation services for all languages

Media Response (12–24 hours)

Press release prepared (factual, no minimization)
Press conference scheduled (superintendent presents)
Social media monitoring — respond to misinformation
Board public statement coordinated

Long-Term Remediation (1–4 weeks)

Ongoing counseling for affected students
Policy overhaul complete
Vendor contract terminated (if applicable)
Third-party audit commissioned
Annual incident drill scheduled
Comprehensive public report published
Insurance claim filed (if applicable)

3 — Incident Report Form

AI Incident Report Form

Incident ID: __________ Date/Time Discovered: __________ Date/Time Occurred: __________

School: __________________________ Grade/Class: __________ Staff Who Discovered: __________________________

Incident Classification:

Level 1 (Minor) — Single student, limited harm

Level 2 (Moderate) — Multiple students, investigation needed

Level 3 (Severe) — Widespread harm, legal liability

Incident Type (check all that apply):

Inappropriate content (sexual, violent, hate)

Data breach / FERPA violation

Bias / Discrimination (targeted demographic)

Academic dishonesty (false accusation)

Deepfake / Non-Consensual Intimate Imagery

Self-harm / Suicide content

Vendor misconduct (data sale, terms violation)

Technical malfunction (data loss, corruption)

Total Students Affected: __________ Grade Levels: __________ IEP/504 Students: ☐ Yes ☐ No

Description (factual, no minimization): _____________________________________________

Evidence Preserved:

Screenshots (count: ___)

System logs (preserved: ___)

Witness statements (count: ___)

Vendor communication

Notification Timeline:

Parents notified: __________ Principal: __________ District admin: __________ Legal: __________ Board: __________ Law enforcement: __________

Vendor contacted: __________ Vendor response: __________________________ Contract status: ☐ Continue ☐ Suspend ☐ Terminate

Reported By: __________________________ Title: __________________________ Date: __________

Reviewed By (Admin): __________________________ Date: __________

4 — Communication Templates

Internal Memo — Staff → Admin

TO: [Superintendent/Principal] FROM: [Staff Name] DATE: [Date] SUBJECT: AI Incident Report — Level [1/2/3]

An AI incident occurred on [date] at [school]. WHAT HAPPENED: [Factual description, no minimization]

STUDENTS AFFECTED: [Count, grade levels] IMMEDIATE ACTIONS: [Actions taken]

NOTIFICATION STATUS: Parents: [Yes/No] · Legal: [Yes/Pending] · Board: [Yes/Scheduled]

RECOMMENDATION: [Next steps requested] Evidence attached: [list]

External Letter — Parents (Level 1)

[School Letterhead] · [Date]

Dear [Parent Name], I'm writing to inform you of an incident involving [AI Tool Name] that affected your child on [date].

WHAT HAPPENED: [Clear, factual description] IMPACT ON YOUR CHILD: [Specific impact]

OUR RESPONSE: (1) Tool suspended immediately (2) Alternative assignment provided (3) Counseling offered if needed

YOUR OPTIONS: Opt-out of this tool: [URL] · Request meeting: [contact] · Review AI policy: [URL]

Sincerely, [Principal Name] / [School]

External Letter — Parents (Level 2/3) — URGENT

[District Letterhead] · [DATE] · URGENT: AI Incident Notification

Dear Families, We're writing to inform you of a [Level 2/3] incident involving [AI Tool Name] that affected [number] students at [school(s)].

WHAT HAPPENED: [Factual, detailed description — no minimization or euphemisms]

YOUR CHILD'S STATUS: ☐ Your child WAS affected ☐ Your child was NOT affected

OUR IMMEDIATE RESPONSE: (1) Tool suspended (2) Investigation launched (3) All affected students identified (4) Support resources provided

YOUR RIGHTS: Review incident report: [URL] · Request meeting: [contact] · Opt-out of all AI tools: [URL] · File complaint: [URL]

Sincerely, [Superintendent Name] / [Contact Information]

Press Statement (Level 3 Only)

FOR IMMEDIATE RELEASE · [Date]

[District Name] is addressing an AI-related incident at [school] that affected [number] students on [date].

FACTS: [Clear, factual description — no minimization or euphemisms]

RESPONSE: Tool immediately suspended · All affected families notified within [X] hours · Counseling provided · Investigation underway · Policy review initiated

CONTACT: [Communications Director] · [Phone] · [Email]

5 — Legal Review Checklists

FERPA Compliance Checklist

Was data disclosed to unauthorized parties?
Was vendor under "school official" FERPA exception?
Was data used for educational purpose only?
Was data sold or marketed? (violation if yes)
Were parents notified within required timeline?
Were parents offered inspection of records?
Data deletion demanded from vendor?
Audit trail preserved?

State Law Compliance Checklist

Incident type requires state notification?
Timeline: [X] hours/days per state law
State student privacy statute applies?
Parent consent required for AI tool use?
Data retention limits per state law?
Teacher liability exposure?
Union notification required?
Vendor terms violate state consumer law?

Incident Metrics Dashboard

Metric	Target	Track
Incidents per 100 students (annual)	<1	___
Level 3 incidents per year	0	___
Response time — Level 1	<24 hours	___
Response time — Level 2	<12 hours	___
Response time — Level 3	<4 hours	___
Parent notification time	<24 hours	___
Parent satisfaction post-incident	4.0 / 5+	___
Repeat incidents (same root cause)	0	___
Policy revisions per year	1+	___

AI Incident Response Protocol

Minor Incident

Moderate Incident

Severe Incident

Level 1 Response Checklist

Level 2 Response Checklist

Level 3 Response Checklist