AI used to draft course information, support a student request or assess learning can raise different legal questions. Record the intended purpose and data flow before selecting tools. A human approval step or an EU-hosted server does not by itself establish compliance.
Map the Personal-Data Processing
Identify the purpose, lawful basis, data categories, affected people, recipients and retention. Assess whether special-category data or significant automated decisions introduce additional requirements. Determine controller and processor roles from the actual service, including any suppliers and subprocessors.
Use only data needed for the task and control access appropriately. Establish how the institution can respond to data-subject requests, taking account of applicable conditions and exceptions; erasure is not an unconditional right to delete every academic record.
Assess Location and Transfers
Record where data is stored and accessed, including support and connected services. GDPR does not require all processing to remain in the EU. International transfers need assessment under the relevant rules and safeguards. Conversely, EU hosting does not remove obligations concerning purpose, access, retention and security.
A data-protection impact assessment may be required where processing is likely to create a high risk to people’s rights and freedoms. The institution should involve its data-protection officer and relevant legal specialists in the assessment.
Classify the AI Use
Annex III of the AI Act covers specified educational uses, including admission, evaluation of learning outcomes, assignment of educational level and certain examination monitoring. Article 6 contains the classification routes and qualified exceptions. Human review does not automatically take a system outside high-risk use.
Identify whether the institution is a deployer, a provider of a system it commissions or modifies, or holds different roles for different components. The roles guide explains why this affects the duties.
Apply the Relevant Transparency Rules
Article 50 contains duties for specified interactions and generated content, with conditions and exceptions. It does not create one universal rule that every use of AI assistance in a teaching document must carry the same label. An institutional teaching policy may set additional disclosure expectations for academic integrity.
Explain to students and staff how the system is used, what they can rely on and how to obtain human review where appropriate. Keep legally required notices distinct from optional educational disclosure rules.
For dates, use the AI Act timetable and transitional provisions alongside the current legal text. A policy proposal or discussion is not evidence that an adopted legal deadline has changed.
Build Controls into the Workflow
Define permissions, source ownership, review steps, logging and a route for complaints or corrections. Test incorrect output, unavailable source material and failed integrations. Logs can support accountability, but do not prove all legal requirements have been met.
Include applicable accessibility requirements in the interface, documents and messages. Evaluate the complete user task with appropriate technical and user checks. See university cybersecurity for operational controls and recovery.
Agree Responsibilities Before Development
Q-Dev can develop software for a defined university workflow. Integrations, access, deployment conditions, acceptance criteria, price and schedule are agreed for the project. An application that follows an audit belongs to the second stage of Q-Journey, including when AI is not part of that application.
The university’s accountable teams must reach the relevant legal and governance conclusions. A software supplier can implement and test agreed controls without claiming to certify the institution’s compliance.
Primary Sources
GDPR and the AI Act, including the applicable national rules and current guidance for the institution.
Frequently Asked Questions
Is every educational AI system high-risk?
No. Classification depends on the intended use and the applicable provisions, including Article 6 and Annex III. Human review alone does not remove a system from high-risk scope.
Does every AI-assisted teaching document need an AI Act label?
Article 50 has specific duties, conditions and exceptions; it is not a blanket labelling rule for all assistance. University academic-integrity policies may set additional disclosure requirements.
Must student data remain in the EU?
GDPR does not impose a blanket EU-only processing rule. The institution must assess the processing and any international transfers under the applicable requirements. EU hosting alone is not proof of compliance.
Can a software supplier guarantee legal compliance?
A supplier can implement and test agreed technical controls. Legal classification, governance and institutional responsibilities still require assessment by the accountable parties.