🔄 Note update — This article is updated whenever there are relevant changes in the application of the EU Regulation 2024/1689 (AI Act). Last review: June 21, 2026, after the approval of the packet bus digital by the European Parliament on June 15, 2026 (pending confirmation by the Council). Article 4 (obligation literacy AI) is NOT affected and remains in force from February 2025. |
The European Regulation of Artificial Intelligence already has dates. It is not a regulation of the future: the part of their obligations to carry into effect from February 2025. And the deadlines for systems of IA in high-risk are already defined after the approval of the packet bus digital by the European Parliament on June 15, 2026.
If your center uses AI in some process that is affecting the student body (evaluation, access, orientation, and supervision of examinations), this concerns you directly.
This guide explains what exactly the AI Act for schools, what deadlines you have, what you have to do and where to start.
The AI Act does not demand that you stop using the AI. Asks what to do with documentation, human oversight and discretion. That is exactly what many centres still do not have. |
What is the AI Act and why it affects education
The European Regulation of Artificial Intelligence (AI Act, Regulation (EU 2024/1689) is the first regulatory framework integral over AI in the world. Approved by 2024, it applies to any organisation who use, develop, or distribute systems of AI in the Eu, regardless of where it has its headquarters.
It is not optional. Does not require transposition in Spain. It is application direct.
Its central structure is based on a classification of the systems of AI by level of risk. And educational centers appear explicitly in the most demanding category.
Data | Source |
85% of the Spanish companies has invested or plans to invest in AI | KPMG / CEOE, 2025 |
75% of young spaniards have used AI generative | Eurostat, 2025 |
45% of teachers have not worked AI in the classroom | CSIC / Action Aid, 2025 |
35M€ maximum penalty for serious violation of the AI Act | Chapter XII AI Act |
The classification of risk: where it fits your centre
The AI Act classifies the systems of AI into four categories. The higher the risk, the more obligations requires. And in education, the high-risk category is the one that more centers were not expecting to find.
Risk category | Description | Examples in education | Obligations |
Unacceptable risk | Prohibited practices since February 2025 | Scoring systems social students. Manipulation subliminal. Generation nude fake AI (since dec. 2026). | Absolute prohibition. Can’t be used. |
High risk | AI that affects the rights and opportunities of people | Admission and evaluation of students. Proctoring online. Professional guidance automated. | Technical documentation, human oversight, evaluation of conformity, registration in the EU. |
Limited risk | AI that interacts with people without critical decisions | Chatbots care to the student body. Wizards of writing. | Obligations of transparency: inform the user that interacts with AI. |
Minimal risk | Uses that do not affect rights or safety | Spam filters. Recommender educational content. | Without additional obligations under the AI Act. |
The time-bound: what applied already and what comes
The AI Act is implemented in a staggered manner. These are the terms in force after the approval of the packet bus digital by the European Parliament on June 15, 2026 (pending confirmation by the Council):
Date | What enters into force | Who does it affect in education | Urgency |
Feb. 2025 ✓ ALREADY | Prohibition of practices of unacceptable risk (art. 5). Obligation of literacy in AI for all personnel operating systems AI (art. 4). | Any center that use systems of AI with teaching or administrative staff. | IMMEDIATE |
Aug. 2025 ✓ ALREADY | Obligations of transparency and governance models of AI for general use (GPAI). Code of conduct for suppliers. | Centers that use tools based on GPT-4, Gemini, Claude, or other models of general purpose. | IN PROGRESS |
Dec. 2026 | Prohibition of systems of AI to generate nudes fake and material child sexual abuse. Obligation of the watermark in the content generated by the IA. | All providers and facilities. | TERM OF ADAPTATION |
Dec. 2027 → NEXT | Obligations in full for systems of IA in high-risk self-employed already deployed. Conformity assessment and record in database EU. | Centers that use AI in assessment of students, admission, proctoring, or counseling professional automated. | PREPARE NOW |
Aug. 2028 | Obligations in full for systems of IA in high-risk integrated as components of safety in the products covered by sectoral legislation. | The centres themselves, if they use these systems. | IN REVIEW |
Terms approved by the European Parliament on June 15, 2026 as part of the package omnibus digital, pending confirmation by the Council. Article 4 (literacy AI) and the prohibitions in article 5 have not been affected by this change. | |||
⚠️ What is already required from February 2025 — article 4 of The AI Act requires all organizations that use systems of AI to ensure that their staff have the skills enough to operate them and monitor them. This means that if your center uses AI in any process (even if it is only for generation of content management), the staff involved need real training and documented, not just informative. | |||
What systems of AI are high risk at your centre
This is the question that the more confusion it generates. Not all the use of AI in an educational facility is high-risk. But there are specific categories that are, and that many schools are already using without even knowing it.
System or tool | Do high risk? | Why | Specific obligations |
Platforms proctoring online exams monitored by IA) | YES | Affects the evaluation of students by means of analysis of behavior | Technical documentation + student information + human oversight on decisions |
Systems of admission and selection of students with AI | YES | Affects access to education, a fundamental right | Conformity assessment + record in database EU |
Platforms LMS that generate scores automatic (no human review) | YES | Assessment of learning in automated unattended | Human oversight mandatory in all rating action |
| DEPENDS | If it is used to punish without human review: high-risk | Human oversight before any disciplinary action |
ChatGPT/Gemini to generate learning content (use in teaching) | NO | It does not directly affect the evaluation of or access of the students | Basic transparency to the students on the use of AI in materials |
Chatbot of care and information to students | NO | Interaction information without access decisions or evaluation | Inform the user that interacts with an AI system |
Guidance systems professional/academic, automated | YES | Affects career choices that impact the future of the students | Conformity assessment + documentation + human oversight |
The four core obligations for high-risk systems
If your school has a system of IA in high-risk, these are the specific duties of the AI Act. They are not recommendations: are the legal requirements to date.
1. Technical documentation (article 11)
Every AI system at high risk should have documentation that describes: what the system does, how it was designed, with what data it was trained, what are their limitations and known risks, and how to monitor your usage.
If you want to buy the system to an external provider, the provider must provide that documentation. If the supplier does not have it or it will not be shared, the system does not comply with the AI Act.
2. Human oversight (article 14)
No significant decision affecting a student may be purely automated. The AI Act requires that there is always a person who can understand, intervene, correct, or to disable the system.
In practical terms: if an assessment platform generates a score automatically, a teacher has to review and validate that rating before it is final. Always.
3. Transparency with the student body (article 13)
Students have a right to know when an AI system is being used in processes that affect them: if your exam is monitored by AI, if a platform generates recommendations about your academic itinerary or if your work is analyzed by automated systems.
This information must be clear, understandable, and prior to the use of the system. You can not be buried in the terms and conditions.
4. Evaluation of conformity and registration (articles 43 and 71)
For the systems of higher risk, the AI Act requires a conformity assessment prior to their deployment and the system log in the public database of the EU for systems of IA in high-risk.
In practice, if the system provider is the one who unfolds, he is the one who has the obligation to register. But the center, as a user, you must verify that the system is registered before using it for the process of evaluation and / or admission.
GDPR and AI Act: how they interact in the educational context
The General Regulation of Data Protection (GDPR) has been in force since 2018, and is still the main rule that protects the personal data of individuals. In the context of the IA, educational, AI Act and GDPR are overlapping and mutually reinforcing.
Situation | Obligation GDPR | Obligation AI Act |
Use tool with AI with data of the student body (grades, behavior, personal data) | Legal basis for adequate + DPA with the supplier + student information | Human oversight if it affects the assessment or access |
Students under 18 years of age in tools of AI external | Consent of guardian + enhanced protection of data of minors | Transparency on the use of AI + ban handling systems |
Proctoring online exams | Evaluation of the impact of privacy (DPIA) + minimum necessary data | Conformity assessment as a system of high-risk |
AI for qualifying or for automatic evaluation | Pupil’s right to not be subject to decisions purely automated (art. 22 GDPR) | Human oversight mandatory + technical documentation |
🔑 The most important right that your students already have — article 22 of The GDPR sets out the right to not be subject to decisions based solely on automated processing. This means that any grade, admission decision or academic can be taken exclusively by an AI system without human review. This right exists since 2018 and is reinforced with the AI Act. | ||
International framework: what says the UNESCO and the European Commission
The AI Act is not the only frame of reference. The European Commission and UNESCO have published specific guidance for the education sector that complement the regulation and offer practical guide.
Source | Document | What to set for education |
European Commission | Ethical guidelines on AI for educators (2026, update) | Framework for integrating the AI in an ethical manner in teaching. Emphasis on critical thinking, monitoring, and teaching digital literacy of the students. |
UNESCO | Guidelines for AI generative in education and research (2023) | Recommendations for governments and institutions to ensure that the AI in education respects human rights, equity and critical thinking. |
AEPD (Spain) | Guide on AI and data protection (2020 updated) | Guidelines for the processing of personal data in systems, AI, applicable to educational institutions that use AI with data of students. |
European Commission | Regulation (EU 2024/1689 — AI Act | Regulatory framework binding obligations, deadlines and penalties for all sectors, including education. Of direct application in Spain. |
The five questions that your school needs to respond
Before we talk about compliance, there is a previous diagnosis that every center should do. There are five specific questions that reveal where is your institution with respect to the AI Act:
What systems of AI uses your center? Do you have an updated inventory of all the tools of AI that uses the center, teachers and the administrative staff? No inventory no compliance as possible.
Do any of these systems affects evaluation, access or data of the students? If the answer is yes in any of the cases, you are faced with systems potentially high risk that require specific analysis.
Do you have your center a DPA signed with each provider of AI that processes data of the students? Without DPA, the processing of personal data of students in external tools may be a violation of the GDPR.
How is your staff trained to operate and monitor the systems of AI that uses? Article 4 of the AI Act required from February 2025. The training must be documented.
What informs the center of the pupil when to use AI in processes that affect them? Transparency is an obligation under the GDPR and under the AI Act.
Where to start: the plan minimum viable for your centre
The good news is that you don’t need to solve it all at once. The new time limits approved by the European Parliament to give more room for the high-risk systems (December 2027 for the self-employed). But article 4 on staff training has been in force since February of 2025, and there is no extension.
Priority | Action | Term | Responsible usual |
🔴 IMMEDIATE | Take an inventory of all the systems of AI in use in the center (teachers + administration + students). | This week | Coordination ICT / Innovation |
🔴 IMMEDIATE | Check if there is DPA signed with all providers of digital tools that address data of the students. | Month 1 | Secretariat / DPO |
🟡 URGENT | Classify what systems are a high-risk according to the AI Act and if they have the technical documentation, as required. | Month 1-2 | Address + legal Advice |
🟡 URGENT | Design and deliver training to staff on skills to operate and monitor AI (art. 4) | Month 2-3 | Address +teaching team |
🟡 URGENT | Review the processes of assessment and admission to guarantee human oversight in all decisions that involve AI. | Month 2-4 | Teaching team + Address |
🟢 BEFORE DEC. 2027 | For high-risk systems: obtain documentation of compliance of the supplier and verify record in the database EU. | Before December 2027 | Address + Provider |
🟢 BEFORE DEC. 2027 | Build the institutional position of the center before the AI: usage policy, pedagogical criteria and protocol update. | Month 3-6 | Cloister + Address |
Frequently asked questions
Does the AI Act applies to public schools as well?
Yes. The AI Act applies to any organization that uses systems of AI in the EU, regardless of whether it is public or private. Public schools have the same obligation to guarantee human oversight, transparency, and training of personnel private. The only difference may be in how to finance adaptation measures.
Does my facility need to register in any organization?
The AI Act establishes a public database of systems of IA in high-risk, but the registration is done by the provider of the system, not the center that uses it. The obligation of the center is to verify that the provider has complied with this obligation prior to using the system in the process of evaluation and / or admission.
What happens to the students who use ChatGPT on your own?
The AI Act does not regulate the personal use of the tools of AI on the part of individual users. What governs is the institutional use by the schools. Students use ChatGPT is a challenge of teaching and academic integrity, is not a direct obligation of the AI Act.
Does the training of AI CEFIRE complies with article 4 of the AI Act?
It depends on your content. Article 4 requires skills to operate and monitor the systems AI-specific that your organization uses. A generic training on tools for AI is not sufficient, if not complete understanding of the limitations and risks of the specific systems used by the center.
How much does it cost to adapt to the AI Act in an educational center?
The cost depends on the starting point of each center and in the number of high-risk systems that have deployed. An initial diagnosis and the construction of the institutional position basic it can be done in a process of 3 to 6 months, with external support specialist. The cost of not to adapt, in terms of sanctions and reputational risk, is significantly higher.
Conclusion: the regulation as an opportunity
It is easy to see the AI Act as an administrative burden. But there is another reading is possible.
The centers that build now your frames criterion to the IA, with documentation, staff training and institutional position clear, will be that in two or three years to be able to say that they did come forth. That will be part of the good practice that others will want to replicate. Which will appeal to teachers who want to work in institutions that think.
The regulation asks what should happen anyway: that schools have discretion on how to use technology with their students.
The AI Act does not demand that you stop using the AI. Calls for the use with criterion. And that, in reality, is exactly what I have needed to do. |
Sources cited: Regulation (EU 2024/1689 (AI Act) · Package omnibus digital, adopted by the European Parliament on June 15, 2026 · Guidelines for ethical AI for educators, European Commission · UNESCO, IA generative in education · AEPD, Guide AI and data protection.
