A school GenAI incident may require notifying parents, but the district IR plan omits education privacy notification steps. What gap should the auditor cite?

Citing the absence of education privacy notification procedures within AI incident response works because school GenAI incidents can expose student data or sensitive prompts that trigger parent and guardian notice obligations under education privacy expectations and district policy. Generic municipal IR playbooks often cover IT outages and credential theft but omit who notifies whom, within what timeline, and with what content when an AI system is involved. Auditors should treat missing education-privacy steps as a control design gap in the district IR plan, not as an optional communications nicety. An absence of AI vendor incident escalation contacts is a coordination gap, but it identifies who the district calls at the vendor, not who tells parents when a GenAI incident involves their child's data, so it does not close the education-privacy notification gap the audit found. An absence of general consumer breach notification procedures is a compliance gap, but consumer-focused breach steps do not substitute for the education-privacy parent and guardian notification path the district IR plan lacks after a GenAI incident. An absence of internal helpdesk ticket routing steps is an intake concern, but routing tickets internally still leaves the IR plan without the parent or guardian notification procedure the stem is asking about.

Exam caveat: notification triggers depend on what data was actually exposed and applicable education privacy rules; auditors should verify criteria rather than assuming every GenAI glitch requires mass notice. Operational check: add an education-privacy annex to the district AI IR plan naming decision makers, parent/guardian templates, counsel review, logging of notices sent, and a tabletop that injects a student-data GenAI incident to prove the procedure runs end to end.