{"id":53209,"date":"2026-11-10T10:01:37","date_gmt":"2026-11-10T09:01:37","guid":{"rendered":"https:\/\/impulseducacio.org\/?p=53209"},"modified":"2026-11-10T10:03:05","modified_gmt":"2026-11-10T09:03:05","slug":"eu-ai-act-schools","status":"publish","type":"post","link":"https:\/\/impulseducacio.org\/en\/eu-ai-act-schools\/","title":{"rendered":"The EU AI Act: what is already binding and what has been postponed"},"content":{"rendered":"

<\/div>
<\/div>
<\/div>

The Rules in Force<\/h1><\/h1><\/div>
<\/div><\/div><\/div>

Share<\/h4>
<\/i><\/a><\/span><\/i><\/a><\/span><\/i><\/a><\/span><\/i><\/a><\/span><\/div><\/div>
<\/div><\/div><\/div>
<\/div>
<\/div>
<\/div>
<\/path><\/svg><\/div>
<\/div><\/div><\/div>
<\/div><\/div><\/div><\/div><\/div>

10 November 2026<\/p>\n<\/div>

<\/div><\/div><\/div><\/div>

The EU AI Act: what is already binding and what has been postponed<\/h2>\n<\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/span><\/a><\/span>
<\/a><\/span><\/div>
<\/div>
<\/i>Register now<\/span><\/a><\/div><\/div><\/div>

Judgement Cannot Be Delegated \u00b7 11 of 12<\/p>\n<\/div><\/div><\/div><\/div>

Most of the time schools lag behind the law, artificial intelligence is no exception, and by the time the European rules really reach a school they have long been expected. It is a reassuring idea, since it places the urgency in some indeterminate future, but in this case it is exactly the other way round.<\/h5>\n<\/div>
<\/div><\/div><\/div><\/div>

The European Artificial Intelligence Act was approved in June 2024 with a staggered timetable (1). In July 2026, a second regulation known as the Digital Omnibus moved the dates: the systems most discussed in education, those that decide admissions or assess learning, will not be enforceable until 2 December 2027 (2). In many places that postponement was received as a general reprieve. But it really is not, because the obligation that most directly affects a school was not postponed, and it has been in force since 2 February 2025.<\/p>\n

A school is governed on three planes: what the law decides for it, what is signed at the door and what is written inside.<\/p>\n<\/div>

<\/div>
\"EU<\/span><\/div><\/div><\/div><\/div>

Two different clocks<\/h3>\n

The European regulation does not classify tools: it classifies uses. One and the same application can be irrelevant in one context and subject to strict controls in another, depending on what is decided on the basis of it. That is why the question for a teaching staff is not \u2018can we use this application?\u2019, but \u2018what are we going to use it for?\u2019.<\/p>\n

In education, Annex III of the regulation places four specific uses at the high-risk level: determining access or admission to a school, evaluating learning outcomes, determining the appropriate level of education for a person, and monitoring and detecting prohibited behaviour during examinations (1). High risk does not mean prohibited. It means permitted with full obligations of human oversight, data quality, traceability and documentation, and it means that responsibility does not disappear because a machine proposed the decision.<\/p>\n

There is also a prohibition with no deadline and no qualification, in force since February 2025: AI may not be used to infer students\u2019 emotions in educational settings, except on medical or safety grounds (1). Any product offering to \u2018measure the attention\u2019 of a class is outside European law, regardless of how well it works.<\/p>\n

This is where the two clocks diverge. The Digital Omnibus, in force since 27 July 2026, postponed until December 2027 the obligations relating to those high-risk uses (2). But it did not touch Article 4, which requires providers of AI systems and also deployers to take measures to ensure their staff have a sufficient level of AI literacy (1).<\/p>\n

That distinction decides whether the article applies to a school, and it is worth reading slowly. A school that contracts a tool developed by someone else is not a provider: it is a deployer. The Omnibus softened the wording, which moved from ensuring a certain level to taking measures to promote it, so that the school is no longer answerable for the outcome, but it is answerable for having done something (2). Alongside that obligation it is worth placing one figure: according to the TALIS 2024 results reported in the AILit Framework of the OECD and the European Commission, three out of four teachers say they lack the knowledge they need to teach with AI (3).<\/p>\n

The technology clock has stopped until December 2027. The clock for people has been running for more than a year.<\/p>\n<\/div><\/div><\/div><\/div>

While technological regulation is postponed, the requirement to promote digital literacy among the faculty is already in effect.<\/h6>\n<\/div><\/div><\/div>
\"EU<\/span><\/div><\/div><\/div><\/div>

Nobody gives a tool away<\/h3>\n

There is one finding in the Digital Promise report on AI literacy that will be familiar to any leadership team: many AI tools are deliberately marketed to teachers in order to bypass those who administer the school (5). It is not a commercial anecdote. It is the mechanism by which a school ends up with twelve applications in use and no shared criterion about any of them.<\/p>\n

The same report proposes four factors for deciding whether to adopt a tool: accessibility and equity, data ownership and privacy, transparency and impact (5). And it adds an uncomfortable reminder: the school controls the technology it provides, but far less the technology students bring from home (5).<\/p>\n

On data, Carles Sierra, director of the Artificial Intelligence Research Institute of the CSIC and former president of the European Association for Artificial Intelligence, is specific. Complying with the General Data Protection Regulation and with Spain\u2019s Organic Law 3\/2018 requires informing the whole school community of five things: what data are collected, for what purpose, who processes them, for how long and what rights people have over them (4). Five questions a supplier should answer in writing before anyone signs anything. And when those data belong to minors the requirement increases. Arlet Brufau i Centelles and Albert Sabater Coll, of the Observatori d\u2019\u00c8tica en Intel\u00b7lig\u00e8ncia Artificial de Catalunya, recall that those data may be the property of minors, which calls for especially reinforced safeguards (4).<\/p>\n

It sounds demanding, doesn\u2019t it? Well, some are already meeting it. The Finnish project Generation AI, led by Professor Matti Tedre of the University of Eastern Finland, won the 2026 European Digital Skills Award, presented in Brussels on 30 June (6). Its applications run locally, in the user\u2019s browser, they do not track whoever uses them, they meet GDPR requirements and they do not transfer data outside the classroom (6).<\/p>\n

None of those four safeguards is a technical feat. They are design decisions taken because someone made them a condition, and the project describes itself as designed from children\u2019s rights (7). The question when choosing a tool is not whether it is good. It is what it takes away in exchange.<\/p>\n<\/div><\/div><\/div><\/div>

\"EU<\/span><\/div><\/div><\/div>
The protection of minors’ data requires auditing any application before procuring it.<\/h6>\n<\/div><\/div><\/div><\/div>

A document that can be complied with<\/h3>\n

The natural next step is to write a school policy, and that is where most documents come to grief, because they are drafted like a disciplinary code and end up being a dead letter.<\/p>\n

Jos\u00e9 Antonio Bowen and C. Edward Watson, in their guide to teaching with AI, list six minimum points: when use is permitted and why, whether the instructions given to the machine must be handed in, how that assistance is credited, a warning about the limits of AI, transparency about the use of detectors, and the student\u2019s ultimate accountability for their work (8). As it is designed for a university course, applying it in primary and secondary education requires adaptation.<\/p>\n

Their two warnings, on the other hand, hold at any stage. The first: \u2018An outright ban on AI is unlikely to work\u2019, just as calculators did not eliminate the need to learn to multiply, although they did make it necessary to explain better why it had to be learned (8). The second, more subtle: a policy that only lists what is allowed and what is prohibited is unmotivating, misses opportunities and increases inequity (8). As an institutional skeleton, the five principles agreed in July 2023 by the twenty-four British universities of the Russell Group will serve: supporting students and staff to become AI-literate; equipping staff to support that use; adapting teaching and assessment while ensuring equal access; upholding academic rigour; and sharing best practice (8).<\/p>\n

From principles to a real document there is a leap, and the corpus has one documented school case. The Iowa City Community School District set up a working group of district leaders, school leaders and teachers, and drew up responsible use guidelines that include definitions, permitted uses, prohibited uses, responsibilities of students and staff, response to violations, and considerations of transparency and communication (5). They plan to align them with the academic code of conduct and with board policies, and to identify one teacher per building to champion the work (5). There is the complete architecture: what the document says, who it is written with, what it is articulated with and who sustains it afterwards.<\/p>\n

To find out whether a particular tool complies, there is an instrument in Spanish. The PIO Education Model, standing for principles, indicators and observables, published by the Observatory of Ethics in Artificial Intelligence of Catalonia in June 2025, is a self-assessment applicable to any AI system in use or under consideration in the school (4). It is a questionnaire with binary answers, with a \u2018not applicable\u2019 option, running through seven principles: transparency, justice and equity, safety, responsibility, autonomy, privacy and sustainability (4). Its cycle of observation, debate and action turns on a three-word question, \u2018have we done it?\u2019, and three secondary schools in the province of Girona are already using it to draw up their AI protocol (4).<\/p>\n

Miquel F. Oliver Trobat and his colleagues at the University of the Balearic Islands, whose experience appeared in the ninth article<\/a><\/span> in this series, reach the conclusion that puts the rest in order: the principles that guide the use of AI cannot be imposed from outside, but have to be built from practice, dialogue and professional consensus (4). The document is not the end of the process. It is the minutes of a debate that has already been held.<\/p>\n<\/div><\/div><\/div><\/div>

School policies must stem from professional consensus rather than prohibitions.<\/h6>\n<\/div><\/div><\/div>
\"Reglament<\/span><\/div><\/div><\/div><\/div>

To take into the school<\/h3>\n

For the leadership team: a script for choosing tools<\/strong>. Ten questions. From Digital Promise, the four decision factors: accessibility and equity, data ownership and privacy, transparency and impact (5). From Sierra, the five on data, to be requested from the supplier in writing: what data, for what, who processes them, for how long and what rights apply to them (4). And the tenth, which the law imposes and which is not negotiable: does this use fall within any of the four high-risk cases of Annex III, or does it infer students\u2019 emotions? (1)<\/p>\n

For the leadership team: the sections of the school document<\/strong>. Start with the six from Iowa City, explicitly separating what the law fixes, which is not up for debate, from what the community decides, which is (5). And set the review date from the outset, because a timetable that has moved once can move again.<\/p>\n

For the teaching staff: a self-assessment session<\/strong>. Choose a tool already in use, run it through the PIO Model questionnaire and discuss as a group the indicators where the answer is \u2018no\u2019 (4). Sierra points out that a survey or a minimal record is enough to begin with, and that teachers have to be turned into researchers, into \u2018the Tycho Brahes of AI\u2019 (4).<\/p>\n<\/div><\/div><\/div><\/div>

The leadership team must evaluate the ethical impact of each tool before adopting it.<\/h6>\n<\/div><\/div><\/div>
\"EU<\/span><\/div><\/div><\/div><\/div>

To close<\/h3>\n

Governing AI in a school does not consist in waiting until the law obliges you to. The postponement exempts nobody from anything, because the uses remain the same and so do the risks. The AILit Framework condenses it in a sentence that works as a criterion: AI systems \u2018must be understood, audited, and regulated\u2019 (3). Understanding is training, auditing is adoption, regulating is school policy. All three are leadership decisions, and none of them can be subcontracted to the supplier.<\/p>\n

If a family asked in writing which AI tools the school uses with their children, what data those tools collect and who authorised it, how long would it take to answer, and who would sign that answer?<\/p>\n<\/div><\/div><\/div><\/div>

Glossary<\/h4>\n