AI in schools
Procurement does not replace release, and the school remains the controller under the General Data Protection Regulation in every case. That also holds where teachers work with their own accounts.
AI reaches schools from three directions. The school authority provides a platform, the staff room works with private accounts, and in class it turns up in assessed work. The three routes have different controllers.
The authority procures, the head teacher consents
Whoever pays for the licences often considers the matter settled. Whether that holds is decided by section 31(5) of the Lower Saxony School Act. Using a teaching and learning platform requires that it meets the General Data Protection Regulation and that the head teacher has consented. The school remains the controller.
With the school authority
- Selecting and procuring the platform
- The contract with the provider, including processing terms
- Equipment, accounts and technical operation
- Funding for professional development
With the school
- The head teacher’s consent to the use
- Legal basis and record of processing activities
- Information for parents and for pupils
- Rules for lessons and for assessed work
What is ruled out and what triggers obligations
Products for schools advertise analyses that are legally out of reach. Article 5(1) of the AI Act prohibits inferring emotions in educational institutions without exception, unless the use is introduced for medical or safety reasons.
Alongside this sits the high-risk category. Under Annex III of the AI Act it covers evaluating learning outcomes and detecting prohibited behaviour during examinations, both with obligations a school cannot meet on its own.
Using your own account is official activity
Whether preparation in a private account stays private is decided by the data that goes into it. No. 1.2 of the circular on private IT systems classifies the processing of school data on private devices as official activity and names the school as the controller.
Step 1: Application by the teacher
Describing the device, the software and the protective measures.
Step 2: Written undertaking
It replaces the supervision nobody can exercise in a private setting.
Step 3: Approval by the head teacher
In writing, valid for five years, with a copy to the data protection officer.
Step 4: Contract with the provider
For cloud services the circular requires a processing agreement under Article 28(3) GDPR.
Where one of these steps is missing, the breach amounts to a disciplinary matter that must be pursued once it becomes known. The circular expires on 1 January 2028.
Without express permission, AI stays an unauthorised aid
Whether a mark will later hold up is decided by what was said before the assignment. The absence of a rule is often read as permission. The Administrative Court of Hamburg rejected that on 15 December 2025. Candidates must assume, absent any other instruction, that the work is to be produced entirely on their own, and even using AI to check spelling remains impermissible where language is being assessed. For proof, the Administrative Court of Kassel accepts prima facie evidence.
- What is permitted in this assignment, stated before it is handed out
- Whether and how any use has to be disclosed
- Which parts of the work must be produced independently, such as language and structure
- Who hears the pupil in a suspected case and who decides
- How the indications are recorded before the mark is set
What the class needs to know beforehand
Article 4 of the AI Act obliges deployers to ensure a sufficient level of AI literacy among everyone working with the systems on their behalf. In class, AI is an assistant and at the same time a risk to independent work, and both belong in the same lesson.
- Choosing the toolWhich access is approved, where the data is held, and what the terms say about age.
- Limiting the inputNo names, no health details, nothing about classmates, nothing from home.
- Checking the outputLook up references, spot invention, name sources. The output is a draft, not evidence.
- Knowing the risksSkewed answers, convincingly worded errors, and the pull of accepting the first result.
- Using it wellCollecting ideas, rephrasing explanations, practising vocabulary, seeking feedback on your own text.
- The line to assessmentWhatever the task assesses is produced by the pupil. Where help is allowed, it is disclosed.
How we support you
We review the platform, negotiate the contract and prepare the head teacher’s decision. For the staff room there is the internal instruction, the approval form and training, for lessons the rules on assessment and a version for the classes.
AI at your school?
We set out who decides and what has to be settled before the first lesson.
Discuss your plansFrequently asked questions
The school authority pays for the licences. Does that make it their decision?
No. Procurement rests with the school authority, consent to the actual use rests with the head teacher under section 31(5) of the Lower Saxony School Act. The school is the controller under the General Data Protection Regulation. For the authority this means agreeing the choice with the head teachers early, because a platform procured without consent stays unused.
A teacher only uses a private account for lesson preparation. Is that permitted?
It depends on the data that goes into it. Without any reference to individual pupils it remains a question of professional duties and diligence. As soon as data from the school's records is processed, it is official activity under no. 1.2 of the Lower Saxony circular on private IT systems, the school is the controller, and written approval by the head teacher as well as a processing agreement with the provider are required.
We have no rules on AI yet. Can we establish deception at all?
Yes. Following the decision of the Administrative Court of Hamburg of 15 December 2025, candidates must assume, absent any other instruction, that they have to produce the work entirely on their own. The absence of a rule is not a permission. Conversely, explicit instructions avoid the dispute about what was allowed, which is why they belong before the next assignment rather than after it.
From what age may pupils work with their own accounts?
Providers set their own age limits in their terms, and those limits bind the school when choosing a tool. The question of the legal basis remains separate: access provided through the school rests on section 31 of the Lower Saxony School Act, not on parental consent. Where consent would be required, it is voluntary, and a refusal must not lead to any disadvantage in class.