The regulation is already here
The EU AI Act (European Artificial Intelligence Regulation) entered into force in August 2024 and is being rolled out in phases until 2027. Many European educational institutions do not yet know that it affects them directly — and some that do know have not yet taken action.
This is not an alarm article. It is a practical guide for leadership teams to understand what the EU AI Act means for their institution and how to respond in an orderly way.
Why it affects educational institutions
The EU AI Act classifies AI systems according to the risk they represent. AI systems used in education can fall into the high-risk category when used for:
- Assessment of academic performance
- Determining access to educational programmes
- Monitoring student behaviour
- Detecting AI use or plagiarism in student work
This includes AI-based plagiarism detection tools, adaptive assessment platforms, learning pathway recommendation systems, and in some cases proctoring tools (online exam surveillance).
What the EU AI Act requires from institutions
For high-risk AI systems, the regulation requires:
1. Conformity assessment
Before deploying a high-risk AI system, the institution must verify that the provider has completed the required conformity assessment. A good tool is not enough — it must be certified.
2. Usage register
Institutions must maintain a register of which high-risk AI systems they use, for what purpose, and under what conditions. This register must be available to competent authorities.
3. Human oversight
AI systems cannot make decisions affecting students in a fully autonomous way. There must always be a responsible person who can review, question, and override the system's decisions.
4. Transparency towards students
Students must be informed when they interact with an AI system or when their data is processed by one. This directly affects how digital tool policies are communicated.
5. Data protection (GDPR)
The EU AI Act overlaps with GDPR. The use of AI involving processing of minors' data requires additional safeguards.
What most institutions are getting wrong
Mistake 1: Treating the EU AI Act as the vendor's problem Institutions assume responsibility lies with the tool manufacturer. But the regulation establishes obligations also for the deployer (the institution using the system).
Mistake 2: Not having an AI tool inventory Most institutions do not know exactly what AI tools their teachers are using or in what contexts. Without this inventory, regulatory compliance is impossible.
Mistake 3: Not distinguishing between limited-risk and high-risk systems Not all AI tools require the same level of compliance. ChatGPT used as a writing assistant has a very different risk profile from an automated adaptive assessment system.
A four-step action plan
Step 1: Inventory (week 1–2)
List all AI tools your institution uses: contracted platforms, free tools used by teachers, known student apps. Classify them by function.
Step 2: Risk classification (week 3–4)
For each tool, determine whether it falls into the high-risk category under the EU AI Act. Your legal counsel or a specialist consultant can help with this classification.
Step 3: Usage policy (month 2)
Draft an institutional AI usage policy that includes: which tools are authorised, in what contexts, who is responsible for human oversight, and how students and families are informed.
Step 4: Training and communication (month 3)
Train teachers on the key aspects of the regulation and communicate the usage policy to the school community. Transparency is both a legal obligation and a reputational advantage.
Compliance as competitive advantage
Institutions that manage the EU AI Act well will not only avoid sanctions (which can reach 3% of global turnover for the most serious violations). They will also:
- Build trust with families and students
- Be able to justify responsible AI governance to accreditors and auditors
- Be better positioned to attract public funding linked to responsible innovation
Regulatory compliance is not the ceiling of ambition. It is the floor on which to build a trustworthy AI strategy.
Where to start
If you do not know where your institution stands on compliance, the first step is a diagnostic. At BeTalent we include regulatory risk assessment as part of our initial AI maturity diagnostic. You can request it free of charge through our contact form.
