AI in schools
Merely procuring AI tools does not replace releasing them, and the school remains the controller under data protection law. Teachers using their own AI systems carries particular risks.
AI tools matter in schools in a range of contexts. Permitted and impermissible use can be distinguished. Besides the question of how to mark work in which AI was used without permission, schools also have to address AI use by the staff room. AI calls for particular competence. Where schools release AI tools for teachers and pupils, particular obligations follow.
The authority procures, the head teacher consents
Whoever pays for the licences often considers the matter settled. Whether that holds is decided by section 31(5) of the Lower Saxony School Act. Using a teaching and learning platform requires that it meets the General Data Protection Regulation and that the head teacher has consented.
The head teacher is answerable for the use of AI tools. They are responsible for implementing the data protection documentation, set the rules of use, and train and inform pupils and their parents.
Schools and the rules of the AI Act
High-risk AI classes concern educational institutions as well, and them in particular. Schools face particular challenges here, both in choosing a suitable tool and in arranging its use in conformity with the AI Act and meeting the catalogue of obligations it sets out. Even where an AI tool does not fall within the high-risk area, that assessment has to be documented accordingly.
Using your own account is official activity
Whether preparation in a private account stays private is decided by the data that goes into it. No. 1.2 of the circular on processing personal data on teachers’ private IT systems classifies the processing of school data on private devices as official activity and names the school as the controller.
Step 1: Application by the teacher
Describing the device, the software and the protective measures.
Step 2: Written undertaking
It replaces the supervision nobody can exercise in a private setting.
Step 3: Approval by the head teacher
In writing, valid for five years, with a copy to the data protection officer.
Step 4: Contract with the provider
For cloud services the circular requires a processing agreement under Article 28(3) GDPR.
Where one of these steps is missing, the breach amounts to a disciplinary matter that must be pursued once it becomes known. The circular expires on 1 January 2028.
Without express permission, AI stays an unauthorised aid
Marking work produced with AI carries particular risks. As a matter of principle any use of aids is prohibited, even where no express prohibition has been stated. Pupils have to know how and which forms of AI support they may draw on. That includes:
- What is permitted in this assignment, stated before it is handed out
- Whether and how any use has to be disclosed
- Which parts of the work must be produced independently, such as language and structure
- Who hears the pupil in a suspected case and who decides
- How the indications are recorded before the mark is set
What teachers and pupils need to know when working with AI
Article 4 of the AI Act obliges deployers to ensure a sufficient level of AI literacy among everyone working with the systems on their behalf. AI is both an important and a contemporary assistant in the classroom, yet at the same time a risk to pupils’ independent work. Beyond that, AI tools carry a high potential for misuse. Everyone dealing with AI must therefore be trained accordingly in how they handle it. Responsibility for this rests with the school.
- Choosing the toolWhich access is approved, where the data is held, and what the terms say about age.
- Limiting the inputNo names, no health details, nothing about classmates, nothing from home.
- Checking the outputLook up references, spot invention, name sources. The output is a draft, not evidence.
- Knowing the risksSkewed answers, convincingly worded errors, and the pull of accepting the first result.
- Using it wellCollecting ideas, rephrasing explanations, practising vocabulary, seeking feedback on your own text.
- The line to assessmentWhatever the task assesses is produced by the pupil. Where help is allowed, it is disclosed.
How we support you
We review platforms and tools, advise on the documentation needed and support lawful use. We also train the staff room and the pupils.
AI at your school?
We set out who decides and what has to be settled before the first lesson.
Discuss your plansFrequently asked questions
The school authority pays for the licences. Does that make it their decision?
No. Procurement rests with the school authority, consent to the actual use rests with the head teacher under section 31(5) of the Lower Saxony School Act. The school is the controller under the General Data Protection Regulation. For the authority this means agreeing the choice with the head teachers early, because a platform procured without consent stays unused.
Our tool does not fall under Annex III. Do we still have to record anything?
Yes. The classification belongs in the documentation even where it comes out against the high-risk category. Whether the fundamental rights impact assessment under Article 27(1) of the AI Act is due depends on it. An assessment by the provider does not replace it, because schools rarely have it and it is cut to the provider's intended purpose rather than to use in the classroom. A note with a date and a reference is enough.
A teacher only uses a private account for lesson preparation. Is that permitted?
It depends on the data that goes into it. Without any reference to individual pupils it remains a question of professional duties and diligence. As soon as data from the school's records is processed, it is official activity under no. 1.2 of the Lower Saxony circular on private IT systems, the school is the controller, and written approval by the head teacher as well as a processing agreement with the provider are required.
We have no rules on AI yet. Can we establish deception at all?
Yes. Following the decision of the Administrative Court of Hamburg of 15 December 2025, candidates must assume, absent any other instruction, that they have to produce the work entirely on their own. The absence of a rule is not a permission. Conversely, explicit instructions avoid the dispute about what was allowed, which is why they belong before the next assignment rather than after it.
From what age may pupils work with their own accounts?
Providers set their own age limits in their terms, and those limits bind the school when choosing a tool. The question of the legal basis remains separate: access provided through the school rests on section 31 of the Lower Saxony School Act, not on parental consent. Where consent would be required, it is voluntary, and a refusal must not lead to any disadvantage in class.