Judgement Cannot Be Delegated · 11 of 12

Most of the time schools lag behind the law, artificial intelligence is no exception, and by the time the European rules really reach a school they have long been expected. It is a reassuring idea, since it places the urgency in some indeterminate future, but in this case it is exactly the other way round.

The European Artificial Intelligence Act was approved in June 2024 with a staggered timetable (1). In July 2026, a second regulation known as the Digital Omnibus moved the dates: the systems most discussed in education, those that decide admissions or assess learning, will not be enforceable until 2 December 2027 (2). In many places that postponement was received as a general reprieve. But it really is not, because the obligation that most directly affects a school was not postponed, and it has been in force since 2 February 2025.

A school is governed on three planes: what the law decides for it, what is signed at the door and what is written inside.

Two different clocks

The European regulation does not classify tools: it classifies uses. One and the same application can be irrelevant in one context and subject to strict controls in another, depending on what is decided on the basis of it. That is why the question for a teaching staff is not ‘can we use this application?’, but ‘what are we going to use it for?’.

In education, Annex III of the regulation places four specific uses at the high-risk level: determining access or admission to a school, evaluating learning outcomes, determining the appropriate level of education for a person, and monitoring and detecting prohibited behaviour during examinations (1). High risk does not mean prohibited. It means permitted with full obligations of human oversight, data quality, traceability and documentation, and it means that responsibility does not disappear because a machine proposed the decision.

There is also a prohibition with no deadline and no qualification, in force since February 2025: AI may not be used to infer students’ emotions in educational settings, except on medical or safety grounds (1). Any product offering to ‘measure the attention’ of a class is outside European law, regardless of how well it works.

This is where the two clocks diverge. The Digital Omnibus, in force since 27 July 2026, postponed until December 2027 the obligations relating to those high-risk uses (2). But it did not touch Article 4, which requires providers of AI systems and also deployers to take measures to ensure their staff have a sufficient level of AI literacy (1).

That distinction decides whether the article applies to a school, and it is worth reading slowly. A school that contracts a tool developed by someone else is not a provider: it is a deployer. The Omnibus softened the wording, which moved from ensuring a certain level to taking measures to promote it, so that the school is no longer answerable for the outcome, but it is answerable for having done something (2). Alongside that obligation it is worth placing one figure: according to the TALIS 2024 results reported in the AILit Framework of the OECD and the European Commission, three out of four teachers say they lack the knowledge they need to teach with AI (3).

The technology clock has stopped until December 2027. The clock for people has been running for more than a year.

Nobody gives a tool away

There is one finding in the Digital Promise report on AI literacy that will be familiar to any leadership team: many AI tools are deliberately marketed to teachers in order to bypass those who administer the school (5). It is not a commercial anecdote. It is the mechanism by which a school ends up with twelve applications in use and no shared criterion about any of them.

The same report proposes four factors for deciding whether to adopt a tool: accessibility and equity, data ownership and privacy, transparency and impact (5). And it adds an uncomfortable reminder: the school controls the technology it provides, but far less the technology students bring from home (5).

On data, Carles Sierra, director of the Artificial Intelligence Research Institute of the CSIC and former president of the European Association for Artificial Intelligence, is specific. Complying with the General Data Protection Regulation and with Spain’s Organic Law 3/2018 requires informing the whole school community of five things: what data are collected, for what purpose, who processes them, for how long and what rights people have over them (4). Five questions a supplier should answer in writing before anyone signs anything. And when those data belong to minors the requirement increases. Arlet Brufau i Centelles and Albert Sabater Coll, of the Observatori d’Ètica en Intel·ligència Artificial de Catalunya, recall that those data may be the property of minors, which calls for especially reinforced safeguards (4).

It sounds demanding, doesn’t it? Well, some are already meeting it. The Finnish project Generation AI, led by Professor Matti Tedre of the University of Eastern Finland, won the 2026 European Digital Skills Award, presented in Brussels on 30 June (6). Its applications run locally, in the user’s browser, they do not track whoever uses them, they meet GDPR requirements and they do not transfer data outside the classroom (6).

None of those four safeguards is a technical feat. They are design decisions taken because someone made them a condition, and the project describes itself as designed from children’s rights (7). The question when choosing a tool is not whether it is good. It is what it takes away in exchange.

A document that can be complied with

The natural next step is to write a school policy, and that is where most documents come to grief, because they are drafted like a disciplinary code and end up being a dead letter.

José Antonio Bowen and C. Edward Watson, in their guide to teaching with AI, list six minimum points: when use is permitted and why, whether the instructions given to the machine must be handed in, how that assistance is credited, a warning about the limits of AI, transparency about the use of detectors, and the student’s ultimate accountability for their work (8). As it is designed for a university course, applying it in primary and secondary education requires adaptation.

Their two warnings, on the other hand, hold at any stage. The first: ‘An outright ban on AI is unlikely to work’, just as calculators did not eliminate the need to learn to multiply, although they did make it necessary to explain better why it had to be learned (8). The second, more subtle: a policy that only lists what is allowed and what is prohibited is unmotivating, misses opportunities and increases inequity (8). As an institutional skeleton, the five principles agreed in July 2023 by the twenty-four British universities of the Russell Group will serve: supporting students and staff to become AI-literate; equipping staff to support that use; adapting teaching and assessment while ensuring equal access; upholding academic rigour; and sharing best practice (8).

From principles to a real document there is a leap, and the corpus has one documented school case. The Iowa City Community School District set up a working group of district leaders, school leaders and teachers, and drew up responsible use guidelines that include definitions, permitted uses, prohibited uses, responsibilities of students and staff, response to violations, and considerations of transparency and communication (5). They plan to align them with the academic code of conduct and with board policies, and to identify one teacher per building to champion the work (5). There is the complete architecture: what the document says, who it is written with, what it is articulated with and who sustains it afterwards.

To find out whether a particular tool complies, there is an instrument in Spanish. The PIO Education Model, standing for principles, indicators and observables, published by the Observatory of Ethics in Artificial Intelligence of Catalonia in June 2025, is a self-assessment applicable to any AI system in use or under consideration in the school (4). It is a questionnaire with binary answers, with a ‘not applicable’ option, running through seven principles: transparency, justice and equity, safety, responsibility, autonomy, privacy and sustainability (4). Its cycle of observation, debate and action turns on a three-word question, ‘have we done it?’, and three secondary schools in the province of Girona are already using it to draw up their AI protocol (4).

Miquel F. Oliver Trobat and his colleagues at the University of the Balearic Islands, whose experience appeared in the ninth article in this series, reach the conclusion that puts the rest in order: the principles that guide the use of AI cannot be imposed from outside, but have to be built from practice, dialogue and professional consensus (4). The document is not the end of the process. It is the minutes of a debate that has already been held.

To take into the school

For the leadership team: a script for choosing tools. Ten questions. From Digital Promise, the four decision factors: accessibility and equity, data ownership and privacy, transparency and impact (5). From Sierra, the five on data, to be requested from the supplier in writing: what data, for what, who processes them, for how long and what rights apply to them (4). And the tenth, which the law imposes and which is not negotiable: does this use fall within any of the four high-risk cases of Annex III, or does it infer students’ emotions? (1)

For the leadership team: the sections of the school document. Start with the six from Iowa City, explicitly separating what the law fixes, which is not up for debate, from what the community decides, which is (5). And set the review date from the outset, because a timetable that has moved once can move again.

For the teaching staff: a self-assessment session. Choose a tool already in use, run it through the PIO Model questionnaire and discuss as a group the indicators where the answer is ‘no’ (4). Sierra points out that a survey or a minimal record is enough to begin with, and that teachers have to be turned into researchers, into ‘the Tycho Brahes of AI’ (4).

To close

Governing AI in a school does not consist in waiting until the law obliges you to. The postponement exempts nobody from anything, because the uses remain the same and so do the risks. The AILit Framework condenses it in a sentence that works as a criterion: AI systems ‘must be understood, audited, and regulated’ (3). Understanding is training, auditing is adoption, regulating is school policy. All three are leadership decisions, and none of them can be subcontracted to the supplier.

If a family asked in writing which AI tools the school uses with their children, what data those tools collect and who authorised it, how long would it take to answer, and who would sign that answer?

Glossary

• AI Act. Regulation (EU) 2024/1689, the first general law on artificial intelligence in the European Union. It organises obligations according to the risk of the use, not according to the technology.
• High-risk system. A permitted use, but one subject to full obligations of human oversight, data quality and documentation. In education it includes admission, assessment of learning, determination of educational level and examination monitoring.
• Deployer. An organisation that uses an AI system developed by someone else for professional purposes. A school that contracts an educational tool occupies this position, not that of provider.
• AI literacy obligation (Article 4). The duty of providers and deployers to take measures that promote a sufficient level of AI literacy among those who use these systems. In force since February 2025.
• GDPR. The European Union’s General Data Protection Regulation, of 2016, implemented in Spain by Organic Law 3/2018. It regulates what personal data may be collected, for what purpose and with what rights for the people concerned.
• PIO Model. An instrument for the ethical and legal self-assessment of AI systems, drawn up by the Observatory of Ethics in Artificial Intelligence of Catalonia. Its initials stand for principles, indicators and observables.
• Acceptable use policy. A school document that defines which uses of a technology are permitted, which are prohibited, who is answerable for what and how the agreement is reviewed.

References

1. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. Official Journal of the European Union, L 202. http://data.europa.eu/eli/reg/2024/1689/oj
2. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 of 8 July 2026 amending Regulation (EU) 2024/1689 (Digital Omnibus on AI). Official Journal of the European Union, 24 July 2026.
3. OECD and European Union (2026). Cómo preparar a los alumnos para la era de la IA: Marco de competencias sobre IA para la educación primaria y secundaria (Marco AILit) [Empowering learners for the age of AI: AI literacy framework for primary and secondary education (AILit Framework)]. OECD Publishing, Paris. https://doi.org/10.1787/65cd27d4-en
4. Muñoz, J. M., Lorenzo, N., Suñé, X., Prats, M. À., and López, C. (Coords.) (2026). Informe ODITE 2026: Claves para una nueva educación. Tendencias, retos y propuestas en la era de la IA [ODITE Report 2026: Keys for a new education. Trends, challenges and proposals in the age of AI]. ODITE, Asociación Espiral, Educación y Tecnología. https://ciberespiral.org/es/odite/
5. Mills, K., Ruiz, P., Lee, K., Coenraad, M., Fusco, J., Roschelle, J., and Weisgrau, J. (2024). AI Literacy: A Framework to Understand, Evaluate, and Use Emerging Technology. Digital Promise. Strategy 1, ‘Provide Guidance for Adoption and Evaluation’. https://doi.org/10.51388/20.500.12265/218
6. University of Helsinki (2026). Europe’s best AI literacy initiative for education comes from Finland [Institutional news item, 1 July 2026]. https://www.helsinki.fi/en/news/artificial-intelligence/europes-best-ai-literacy-initiative-education-comes-finland
7. Generation AI (2022–2026). AI education for children and young people [Project website, ‘For teachers’ section]. https://generation-ai-stn.fi/en/
8. Bowen, J. A., and Watson, C. E. (2024). Teaching with AI: A Practical Guide to a New Era of Human Learning. Johns Hopkins University Press.