A risk register turns vague worry into something manageable. For AI in primary schools, most settings find five to eight risks cover the vast majority of real situations — you don't need fifty rows to look thorough.
Risks worth registering
- Staff entering identifiable pupil data into a public AI tool
- Inaccurate AI-generated content reaching parents or pupils unchecked
- Pupils accessing unfiltered AI tools outside of supervised use
- Over-reliance reducing staff's own subject or pedagogical judgement
- Inconsistent use across the school undermining a consistent pupil experience
- A paid AI tool being procured without a data protection impact assessment
How to score them
Use the same likelihood/impact scoring your school already uses for health and safety or safeguarding risk assessments — there's no need to invent a new scale. What matters more than the scoring method is that each risk has an owner, a mitigation, and a review date.
A worked example
Take "staff entering identifiable pupil data into a public AI tool." Likelihood: medium, if no training has happened yet. Impact: high, given the data protection implications. Mitigation: staff briefing plus a one-page do/don't guide, reviewed termly. Owner: DSL or data protection lead. That's a complete risk register row — repeat the pattern for each risk on your list.
Reviewing it
Bring the register back at least termly, or sooner if a new tool is introduced school-wide. A stale risk register that hasn't been touched since it was written is arguably worse than not having one, because it creates a false sense of assurance.
Key takeaways
- Five to eight risks usually cover the real exposure for a primary school.
- Every risk needs an owner, a mitigation, and a review date.
- Review at least termly — a stale register is worse than none at all.