Skip to content
Call, 0511 – 47 55 58 11

AI in schools

Procurement does not replace release, and the school remains the controller under the General Data Protection Regulation in every case. That also holds where teachers work with their own accounts.

AI reaches schools from three directions. The school authority provides a platform, the staff room works with private accounts, and in class it turns up in assessed work. The three routes have different controllers.

The authority procures, the head teacher consents

Whoever pays for the licences often considers the matter settled. Whether that holds is decided by section 31(5) of the Lower Saxony School Act. Using a teaching and learning platform requires that it meets the General Data Protection Regulation and that the head teacher has consented. The school remains the controller.

With the school authority

  • Selecting and procuring the platform
  • The contract with the provider, including processing terms
  • Equipment, accounts and technical operation
  • Funding for professional development

With the school

  • The head teacher’s consent to the use
  • Legal basis and record of processing activities
  • Information for parents and for pupils
  • Rules for lessons and for assessed work

What is ruled out and what triggers obligations

Products for schools advertise analyses that are legally out of reach. Article 5(1) of the AI Act prohibits inferring emotions in educational institutions without exception, unless the use is introduced for medical or safety reasons.

Alongside this sits the high-risk category. Under Annex III of the AI Act it covers evaluating learning outcomes and detecting prohibited behaviour during examinations, both with obligations a school cannot meet on its own.

Using your own account is official activity

Whether preparation in a private account stays private is decided by the data that goes into it. No. 1.2 of the circular on private IT systems classifies the processing of school data on private devices as official activity and names the school as the controller.

  1. Step 1: Application by the teacher

    Describing the device, the software and the protective measures.

  2. Step 2: Written undertaking

    It replaces the supervision nobody can exercise in a private setting.

  3. Step 3: Approval by the head teacher

    In writing, valid for five years, with a copy to the data protection officer.

  4. Step 4: Contract with the provider

    For cloud services the circular requires a processing agreement under Article 28(3) GDPR.

Where one of these steps is missing, the breach amounts to a disciplinary matter that must be pursued once it becomes known. The circular expires on 1 January 2028.

Without express permission, AI stays an unauthorised aid

Whether a mark will later hold up is decided by what was said before the assignment. The absence of a rule is often read as permission. The Administrative Court of Hamburg rejected that on 15 December 2025. Candidates must assume, absent any other instruction, that the work is to be produced entirely on their own, and even using AI to check spelling remains impermissible where language is being assessed. For proof, the Administrative Court of Kassel accepts prima facie evidence.

What the class needs to know beforehand

Article 4 of the AI Act obliges deployers to ensure a sufficient level of AI literacy among everyone working with the systems on their behalf. In class, AI is an assistant and at the same time a risk to independent work, and both belong in the same lesson.

How we support you

We review the platform, negotiate the contract and prepare the head teacher’s decision. For the staff room there is the internal instruction, the approval form and training, for lessons the rules on assessment and a version for the classes.

AI at your school?

We set out who decides and what has to be settled before the first lesson.

Discuss your plans

Frequently asked questions

The school authority pays for the licences. Does that make it their decision?

No. Procurement rests with the school authority, consent to the actual use rests with the head teacher under section 31(5) of the Lower Saxony School Act. The school is the controller under the General Data Protection Regulation. For the authority this means agreeing the choice with the head teachers early, because a platform procured without consent stays unused.

A teacher only uses a private account for lesson preparation. Is that permitted?

It depends on the data that goes into it. Without any reference to individual pupils it remains a question of professional duties and diligence. As soon as data from the school's records is processed, it is official activity under no. 1.2 of the Lower Saxony circular on private IT systems, the school is the controller, and written approval by the head teacher as well as a processing agreement with the provider are required.

We have no rules on AI yet. Can we establish deception at all?

Yes. Following the decision of the Administrative Court of Hamburg of 15 December 2025, candidates must assume, absent any other instruction, that they have to produce the work entirely on their own. The absence of a rule is not a permission. Conversely, explicit instructions avoid the dispute about what was allowed, which is why they belong before the next assignment rather than after it.

From what age may pupils work with their own accounts?

Providers set their own age limits in their terms, and those limits bind the school when choosing a tool. The question of the legal basis remains separate: access provided through the school rests on section 31 of the Lower Saxony School Act, not on parental consent. Where consent would be required, it is voluntary, and a refusal must not lead to any disadvantage in class.

Related