Education · Readiness Assessment
Higher-Ed GLBA & AI Readiness
Are your AI tools putting your Title IV funding at risk?
0
of 36
Ad HocDevelopingDefinedManagedOptimized
No score yet
Answer the questions below
What you get, and what it costs. Your score, readiness level, and highest-priority gap appear immediately, free. Enter your email at the end for the complete section-by-section report and action plan.
For a Title IV institution, financial-aid data is GLBA "customer information," and any AI tool that touches it is in scope for the Safeguards Rule. This self-check scores your GLBA program, AI data handling, vendor oversight, research and IRB practice, and breach readiness.
Scoring: 0 = Not in place · 1 = Partial · 2 = Fully in place. Your answers stay in your browser.
Your Institution (optional)
For your report1. GLBA Safeguards program
1.1
A written information-security program exists with a designated Qualified Individual.
1.2
A written risk assessment covers financial-aid data and the AI tools that touch it.
1.3
The Qualified Individual reports to the board or a senior officer at least annually.
2. AI data handling
2.1
No financial-aid, education, research, or Title IX data is entered into public or consumer AI tools.
2.2
AI tools touching regulated data are inventoried and risk-tiered.
2.3
Consequential decisions about people are not made by AI without human review.
3. Vendors & service providers
3.1
AI and edtech vendors are under GLBA service-provider terms requiring equivalent safeguards, and are assessed periodically.
3.2
Contracts prohibit training the vendor's models on institutional data.
3.3
FERPA school-official and data-deletion terms are in place.
4. Research & IRB
4.1
AI used with human-subjects data is reviewed by the IRB.
4.2
Consent language addresses AI use and data handling.
4.3
No identifiable subject data goes into public AI tools.
5. Breach readiness
5.1
A breach runbook exists with the Federal Student Aid and FTC notification timelines.
5.2
Staff know to report a suspected breach immediately, and know to whom.
5.3
State individual-notice obligations are accounted for, based on where your students reside.
6. Policy & training
6.1
A governance-adopted institutional AI and data policy is in force.
6.2
Faculty and staff who use AI are trained before use and annually after.
6.3
The program is reviewed at least annually and on material change.