Priscillar McMillanPRISCILLAR'S BLOG
One idea at a time

The archive.

All the essays, from newest to oldest.

October 2026

The EU AI Act in five sentences.
I'm a compliance specialist going all-in on AI governance. Here's why.
What federal grants compliance taught me about AI audits.
Start With the Requirements, Not the Tool

September 2026

Don't Automate Chaos Applies to Data Too
Give Your AI Setup a Six-Month Checkup
Teach the Tool, Then Trust the Student
Your Audit-Ready Checklist
Your First 90 Days of AI Governance
Start With an Inventory. Everything Else Follows.
Your First 90 Days With an AI Management System
Don't Automate a Biased Process
Your AI Inventory Is Step Zero
Shared Responsibility, Like Matching Funds
The EU AI Act Wants You to Govern Your Data
When Not to Use AI at All
The First-Week-of-School Test for Every AI Policy

August 2026

Myth: Documentation Slows You Down
Myth: Nobody Regulates AI in America
High-Risk Means Human Oversight, Not Human Rubber-Stamping
Myth: ISO 42001 Is Only for Big Tech
The NIST AI Playbook's Fairness Lens, in Plain English
Tabletop Exercises Aren't Just for Big Companies
In Plain English: Residual Risk
Data Lineage: Where Did This Number Come From?
Teach One Good Prompt, Not One Platform
Literacy Before Licenses
Revisit Your AI Docs Once a Year
The Small-Business Version of the NIST Framework
Don't Automate Chaos: A Compliance Translation

July 2026

Change Management: AI Systems Don't Sit Still
Why the EU AI Act Calls Some AI 'High-Risk'
The DPA Conversation, Translated
What a Site Visit Taught Me About AI
Myth: Deleting the App Deletes Your Data
The Quiet Cost of Free AI Tools
Ask Your AI Vendor Where the Data Sleeps
The Pre-Deployment Risk Check
You Already Use More AI Than You Think
Three Regulators, Three Philosophies
Measure What Matters: Picking AI Metrics That Mean Something
Build It With the People It Affects
Severity Levels for AI Incidents, in Plain English
Boring Controls Save You

June 2026

Start Small, Collect Less: Data Advice for Small Businesses
Your Vendor's AI Is Your Responsibility Too
Write Your AI Policy This Summer
Documentation Debt Is Real
If AI Helped Make the Decision, Say So
Regulatory Sandboxes: Practice Fields for AI Rules
When Something Goes Wrong: Corrective Action for AI
Fairness Isn't a One-Time Test
How Often Should You Re-Check an AI Vendor?
Check the Debarment List
The DPIA, in Plain English
One Password, One Owner, One Log
What 'Trained On' Means for Your Students

May 2026

Who Approved That? Documenting Human Oversight
Try to Break Your AI on Purpose
The Act Rolls Out in Phases. Here's the Order.
Management Review: The Meeting Where AI Gets Honest
'Our AI Is Unbiased.' Ask These Questions Anyway.
What My Grants Days Taught Me About Vendor Oversight
No Surprises
Employee Data Deserves the Same Care as Customer Data
The 80-Percent Rule
Small Schools, Same Rules
Continuous Monitoring, Explained Like a Smoke Detector
Bias Testing, Translated
Your Vendor's AI Is Your Problem Too

April 2026

Internal Audit: Check Your Own Homework First
Write Down Your Fairness Decisions Like an Auditor Will Read Them
Red Flags in AI Vendor Pitches
Change Control: Lessons from Budget Modifications
Document Your Datasets Like You'd Document a Grant
Start With the Task Everyone Hates
The Audit Trail Is a Lesson Plan
Keep a Log of Your Fairness Checks
AI Is Only as Good as the Data You Feed It
Myth: The EU AI Act Kills Small Business AI
Third-Party AI Still Counts as Your AI
What My Worst-Behaved Class Taught Me About Labels
The Exit Plan: Leaving Your AI Vendor

March 2026

The Indirect Costs of AI
Withdrawing Consent Should Be as Easy as Giving It
You Don't Need an AI Expert. You Need a Translator.
Bias in the Gradebook
What ISO 42001 Asks You to Write Down
Write Your AI Incident Plan Before You Need It
Education AI Is High-Risk Under the Act
Transparency: Say What the AI Does, in Words People Understand
Training Data Is a Mirror, Not a Window
Vetting AI Vendors When You're a Team of Five
Performance Reports, but for AI
Your Vendor's AI Was Trained on Something. Ask What.
The Notebook Method for AI Guardrails

February 2026

Your AI Tutor Doesn't Know Your Students
The Change Log: Boring, Until It Saves You
A Human in the Loop Is Not a Decoration
Real-Time Biometrics: Banned, With Exceptions
Human Oversight Is a Feature, Not a Bottleneck
When Your Tool Treats Groups Differently
What to Put in an AI Incident Report
Take Inventory of Your Models
Duplicates, Typos, and Stale Records
Feed It Your Best Work, Not Your Average Work
Consent Is a Process, Not a Checkbox
Documenting Your Vendors' AI

January 2026

Five Questions to Ask Before You Buy an AI Tool
Manipulative AI Is Banned. Here's What That Means.
Data Is the Fuel. Steward It Like It Matters.
Ethics Is a Process, Not a Poster
Risk Scores Are Opinions, Not Facts
Show Your Work
A Privacy Review in One Page
AI Won't Fix a Rude Reply
Give Your Classroom Chatbot a Job Description
Myth: If Nobody Complains, We're Fine
Your AI Audit Trail Starts With a List
Social Scoring and the Line You Don't Cross
The AI Lifecycle Is Longer Than You Think

December 2025

The Bias You Encoded Without Knowing: Proxy Variables
The Question Nobody Asks Their AI Vendor
Closeout: Retiring an AI System
The Classroom Roster Rule for Data Retention
Cancel the Tool Nobody Uses
What Schools Can Steal from the NIST AI Risk Framework
Version Control for AI, Without the Jargon
Reasonable Care: The Two Words Behind Every AI Rule
What Grants Compliance Taught Me About AI Documentation
Operational Controls: Guardrails for Everyday AI Use

November 2025

Fairness Testing on a Small-Business Budget
AI Incident Response, Step by Step
Who Watches the Watchers?
Personal Data vs. Sensitive Data, in Plain English
The Friday Afternoon Test
Don't Automate Chaos in the Classroom
Write Down Where Your Data Came From
Your Loan Algorithm Still Has to Be Fair
Brussels Wrote Rules. Washington Wrote a Playbook.
Documented Information: Write It Down or It Didn't Happen

October 2025

Who Gets to Say the System Is Fair?
Your Risk Register Is a Living Document
The Pre-Award Risk Assessment, Translated
Myth: We Got Consent, So We're Done
Your Spreadsheet Is Already Automation
Student Data Has a Lifecycle. Map It.
What 'Assurance' Means in Plain English
AI in Healthcare Has Its Own Rulebook
My Classroom Had Tiers Too
Competence: Your Team Can't Govern What It Doesn't Understand
Disparate Impact, in Plain English
The Subcontractor You Didn't Know You Had
Automate the Process, Not the Mess
What Happens to Your Data When You Cancel the Tool?

September 2025

Ask What Problem It Solves. Then Ask Again.
Explain It Like I'm a Busy Principal
Start With One Page
AI in Hiring: The Rules Are Already Here
High-Risk AI Comes With Homework
Who Are Your Interested Parties? Everyone Touched by Your AI
No, the AI Is Not Neutral
What 'We Take Security Seriously' Actually Means
Procurement Rules Were AI Governance Before AI
The Data Inventory: Know What You Have
You Don't Need an AI Strategy Document
The Contract Clause Your School Keeps Skipping
Who Owns the Documentation on a Small Team?

August 2025

Tell People When They're Talking to AI
A Five-Question EU AI Act Checklist for Your Team
Risk Assessment for AI, Minus the Jargon
Five Ethics Questions Before You Launch
Don't Buy the Demo. Buy the Documentation.
Keep the Receipts
Myth: Public Data Is Free for AI to Use
Give Every AI Tool an Owner
AI Detectors Don't Work. Teach Instead.
The Five Questions an Auditor Will Ask You
When AI Decides Who Gets the Job (or the Loan)
AI Literacy Is Now a Legal Requirement
Objectives: What 'Good AI' Means at Your Company

July 2025

Inclusive Design Starts With Who's in the Room
A One-Page Incident Plan for AI Gone Wrong
Findings Aren't Failures
Consent Is a Conversation, Not a Checkbox
Teach the Why Before the How
What My Worst-Behaved Class Taught Me About AI Rules
My Classroom Gradebook Was an Audit Trail
Your State Probably Has an AI Law Already
You're Not in the EU. The Act May Still Apply to You.
Write the AI Policy Before You Need It
The Eligibility Checklist That Quietly Excluded People
Who's Liable When the AI Gets It Wrong?
Three Questions for Every AI Purchase

June 2025

What My Federal Grants Compliance Days Taught Me About Data Minimization
What Goes Into the AI Stays in the AI
What 'De-identified' Actually Means
What to Write Down When AI Gets It Wrong
The US Doesn't Have One AI Law. It Has Something Else.
The Fines Are Real. The Math Is Simple.
Context of the Organization: Start With Your Reality
Garbage In, Gospel Out
Your Vendor Updated Their Model Overnight. Now What?
Time-and-Effort Reporting for the AI Age
Garbage In, Garbage Out: Data Quality and AI
The Two-Hour Rule for AI Experiments
The Permission Slip Test for AI Tools

May 2025

Documentation Is a Daily Habit, Not a Fire Drill
How Much AI Risk Is Okay? (That's Risk Tolerance)
What General-Purpose AI Has to Do Now
You Don't Need a Second System. You Need One That Talks to the First.
What 'Human in the Loop' Really Requires
Risk Management Is Just Organized Worrying
Your AI Vendor Is Your Subrecipient
How Long Should an AI System Keep Your Data?
Pick Boring Tools That Do One Thing Well
Your Lesson Plans Are Training Data Now
Model Cards in Plain English
NIST Wrote a Playbook Just for Generative AI
Most AI Is Minimal Risk. That's the Point.

April 2025

Continual Improvement Is Just a Fancy Way of Saying 'Keep Learning'
Test It on the People It Will Actually Serve
The Contract Clause That Matters Most in AI Deals
Separation of Duties, for Algorithms Too
Who Owns the Data? The Question Nobody Asked
Your Team Isn't Afraid of AI. They're Afraid of Looking Foolish.
Who Owns the Essay? Rethinking Cheating in the AI Age
The Paper Trail Test
Manage: What Happens When AI Goes Wrong
The Transparency Tier Nobody Talks About
Certified Is Not the Same as Compliant
Fairness Has More Than One Definition
What Happens When Your AI Tool Makes a Mistake?

March 2025

The Myth of the One-Time Audit
The Five Questions Before You Start Any AI Project
Write the Process Down Before You Automate It
AI Literacy Is Not Coding Class
Audit Trails in Plain English
Measure: Test Your AI Before Your Customers Do
Providers, Deployers, and Why the Labels Matter
Your AI Needs an Owner, Not Just a User
The Hiring Tool That Learned Your Company's Old Habits
Five Questions to Ask Before You Buy Any AI Tool
In Plain English: Allowable
Myth: If We Anonymized It, We're Fine
The Cheapest AI Pilot Costs Nothing

February 2025

Don't Feed the Machine Your Students' Names
Myth: Audits Are Only for Big Companies
Map: Know What Your AI Is Actually Doing
Who Decides Your AI Is 'High-Risk'?
Plan, Do, Check, Act: The Loop That Runs Every Good System
Bias Is a Data Problem, Not a Robot Problem
Your AI Vendor Is Not Your Friend
Eligibility Checks Are Pre-Deployment Reviews
Collect Less: Data Minimization Explained
Don't Automate Chaos
Five Questions to Ask Before Your School Buys an AI Tool
An Audit Trail Is an Audit Trail

January 2025

Govern: Who Decides How Your Team Uses AI?
The EU AI Act Banned a Short List of AI. Here's What's On It.
What an AI Management System Actually Is
What 'Bias in AI' Actually Means
What Is an AI Risk Register? In Plain English
Write It Down Like Someone Will Audit It
Training Data, in Plain English
Start With One Job, Not One Tool
What FERPA Means When Your School Uses AI
What an AI Audit Actually Checks
The NIST AI Risk Management Framework in Plain English
Risk-Based Is Just Triage With Fancier Paperwork