The main risk of building software with AI is not that the code fails, but that it works while nobody can explain how. A scan of 5,600 production applications built with AI tools found more than 2,000 high-impact vulnerabilities, over 400 exposed secrets, and 175 cases of leaked personal data including medical and bank details (Escape, 2026). Better prompting does not close this gap, because the failures are judgment calls rather than missing instructions, so the practical move is to identify which parts of your system a named person can actually explain and treat the rest as risk.

FERPA lacks a fixed identifier removal list for de-identification. Under § 99.31(b)(1), de-identification requires stripping PII and determining that a student is reasonably unidentifiable across single or multiple releases, accounting for other accessible information. Under 34 CFR § 99.31(b)(1), records count as de-identified only when the releasing party makes a reasonable determination that a student's identity is not personally identifiable, judged across single or multiple releases and against other reasonably available information. A 2019 Nature Communications study modeled re-identification risk and reported that 15 demographic attributes could correctly re-identify 99.98% of Americans in its analysis. The study concerned broader demographic datasets, not FERPA records specifically, so use it as a privacy-risk illustration rather than as proof that every student dataset can be re-identified.

The FTC's amended COPPA Rule reached its compliance date on April 22, 2026, ending a transition period that began when the amendments took effect on June 23, 2025. Among the most important new requirements are separate verifiable parental consent before disclosing a child’s personal information to non-integral third parties, a written retention policy disclosed in the online notice, and expanded coverage of biometric and government-issued identifiers. COPPA violations may result in civil penalties of up to $53,088 per violation, although the number of violations and final penalty amount depend on the facts and the court’s determination.

With a partner that has pre-vetted, available talent, staff-augmentation onboarding can take roughly 2 to 4 weeks from signed agreement to an active sprint. Timing varies by role seniority, interview availability, security-access requirements, jurisdiction, and whether the partner is staffing from an existing bench or launching a new search. Many U.S. K–12 systems operate on July 1–June 30 fiscal years, but district and university budget cycles, board calendars, and procurement schedules vary by state and institution. Confirm the timeline for each target customer rather than planning around a presumed national buying calendar. If you hire offshore developers who have never shipped FERPA-aware, LTI-integrated, accessible software, you pay for that gap later, at the worst possible moment.

AI-generated apps break in production because AI coding tools optimize for code that works once, and every property that matters at scale (batched queries, indexes, connection reuse, backpressure) is invisible in a single-user test. New Relic's 2026 State of AI Coding report found 94% of technology leaders rate AI-generated code as higher quality than human-written code at review time, while 82% experienced at least one production failure tied to AI-generated code in the previous six months (New Relic, June 2026). The failures cluster in four places: the database, the request path, the perimeter, and the codebase's own ability to be repaired.

An offshore EdTech team in the Philippines needs four capability zones, not one: platform engineering, learning design, compliance and accessibility, and learning data. Beyond developers, the roles that decide whether an EdTech product actually sells are instructional designers (₱440,277 to ₱755,830 per year), LMS administrators (₱533,796 to ₱938,957 per year), and accessibility QA specialists, per 2026 ERI SalaryExpert survey data. Two U.S. regulatory dates now govern what that team has to ship: the amended COPPA Rule's compliance deadline passed on April 22, 2026, and ADA Title II entities must meet WCAG 2.1 Level AA by April 26, 2027.

EdTech UX design shapes educational software so instructional value reaches the learner instead of being spent on interface friction. U.S. districts accessed an average of 2,982 distinct edtech tools in 2024-25, while the average student used 48 and the average teacher 50 (LearnPlatform by Instructure, 2025). Seven principles decide which side of that gap you land on: user-centricity, consistency, progressive disclosure, environmental context, reversibility, accessibility, and learnability.

A SOC 2 Type II report does not satisfy HECVAT, because the two documents do different jobs: SOC 2 is an independent CPA attestation of security controls, while HECVAT 4 (current version 4.1.6) is a self-reported questionnaire that EDUCAUSE describes as covering cybersecurity, privacy, IT accessibility, and compliance in one workbook. Your audit maps onto the security questions and leaves four domains thin: privacy, IT accessibility, AI, and regulatory compliance. North Carolina's Department of Public Instruction makes the distinction explicit, requiring EdTech vendors to submit both a self-assessment tool such as HECVAT Lite and a separate third-party report such as a SOC 2 Type 2 executive summary.

No, vibe-coded applications aren't safe to launch by default. Veracode tested more than 100 large language models and found that AI introduced a known OWASP Top 10 flaw in 45% of coding tasks, and the most widely reported vibe-coding failures share one root cause: a security control that ran where the user could reach it. This vibe coding security checklist covers four trust boundaries (bundle, database, endpoint, input) with a runtime test you can run yourself before you take a paying user.

Adaptive learning platform development requires three decoupled components: an Expert Model that maps the domain, a Learner Model that estimates mastery, and a Tutor Model that decides what to serve next. Most platforms marketed as adaptive ship only the first plus a rules engine, which is why learners still receive content that is too easy or too hard. The decision that determines everything downstream is which learner model your data volume can actually support: Bayesian Knowledge Tracing, Deep Knowledge Tracing, or neither one yet.