A school district is addressing intellectual-property risk from a GenAI tool used by students that may reproduce copyrighted material in its output. How should district leadership classify and respond to this risk?

Enterprise risk management distinguishes between a guideline, which relies on individual compliance, and a control, which is a built-in mechanism that actively reduces the chance of harm occurring. IP exposure from GenAI output that may reproduce copyrighted material is a real enterprise risk because it can create legal and reputational consequences for the district regardless of whether any individual student intended to violate a guideline. Treating it as a minor style concern trivializes a genuine legal exposure into a cosmetic issue, missing that copyright reproduction has real consequences independent of how the writing reads. Assuming the vendor alone bears legal responsibility misunderstands how liability and reputational risk work; the district deploying the tool in an educational setting still owns responsibility for how it is used within its own institution. Confining the issue to the technology department separates it from academic policy, when in fact effective mitigation usually requires both a technical control and an academic-integrity policy working together. A scope caveat: no output filter is perfect, so mitigation should be paired with staff and student education rather than treated as a complete solution on its own. A concrete operational check is to require a documented review step, such as a similarity or citation check, before GenAI-assisted student work is submitted for grading.