10 Things Schools Should Be Thinking About Now Thanks to the EU AI Act
– and 3 They Still Aren’t
Last week, I found myself in a room full of lawyers, regulators and civil servants at William Frye’s annual AI summit – and not many people mentioned education. And yet, I still felt oddly at home.
Why? Because everything they discussed – high‑risk AI, sectoral regulation, forbearance around children, operational resilience – lands squarely in our world too. If businesses need to act now because of the EU AI Act, then so do schools.
Below are 10 things schools should be thinking about now, thanks to the EU AI Act, and 3 they largely aren’t – but really should be.
1. Putting “doing the right thing” first, not last
Let’s start where, in my view, everyone should start: ethics before enforcement.
The EU AI Act gives us a legal and regulatory frame, but schools cannot outsource their moral compass. We need:
- A responsible AI mindset at whole‑school level
- Leadership that talks openly about *values*
- A clear expectation that if something feels wrong for children, learning or equity, we pause – even if it’s technically allowed If we focus only on “What can we get away with?” rather than “What is the right thing to do?”, we’ve already lost the plot.
2. Identifying where “high‑risk AI” actually lives in your school
The summit conversation around “high‑risk” AI was framed for business, but the translation for schools is straightforward and urgent:
- Where is AI embedded in assessment, admissions, behaviour analytics, safeguarding, wellbeing monitoring, or special educational needs?
- Which tools are profiling, predicting or ranking students?
- Where are you effectively making consequential decisions (placement, intervention, opportunities) based on AI outputs?
The EU AI Act pushes organisations to map and mitigate high‑risk uses. Schools should be doing the same: inventory first, response second. You cannot manage what you cannot see.
3. Naming people who are responsible for AI, regulation, and governance
One of the strongest messages from the summit was the need for dedicated people*who wake up thinking about AI governance.
In schools, that means moving towards:
- A named lead (or small team) for AI policy, practice, and risk
- Regular agenda time at SLT meetings, governor/board meetings and safeguarding committees
- Channels where staff can actually say, “I’m not comfortable with this tool/contract/feature – can we talk about it?”
If everyone is responsible, often no one is. The EU AI Act environment rewards institutions that can show their homework. Schools must be able to say: “These are our people. This is our process.”
4. Expanding the school’s AI “playbook”
Businesses at the summit talked about expanding their “playbooks”. Schools need the same, but with education‑specific scenarios, such as:
- A generative AI vendor suddenly changes terms and starts training on student data
- A tool used for learning analytics begins surfacing biased or harmful patterns
- A parent discovers their child’s data in an AI system the school didn’t know was using it
A playbook answers:
- What do we do first?
- Who do we involve?
- How do we communicate with parents, students, staff, and regulators?
- When do we stop using a tool, and who has the authority to decide?
5. Getting legal advice before you’re uncomfortable
One of the clearest takeaways: don’t wait until you’re in trouble to talk to a lawyer.
Schools sign contracts with AI‑enabled edtech providers all the time. The EU AI Act sits on top of existing GDPR and sectoral legislation – it does not replace them. If you’re:
- Unsure what a vendor is actually doing with student data
- Relying on vague phrases like “industry‑standard security”
- Seeing AI features appear in platforms you already use, without a proper DPIA or review
…that’s a signal to **get legal eyes on the situation now**, not after a complaint, breach, or press story.
Legal advice can be part of designing better partnerships with providers who also want to get this right.
6. Understanding that the EU AI Act is an add‑on, not a parallel universe
Another powerful thread at the summit: the EU AI Act is an extension of an existing orbit. For schools this means:
- You already have GDPR, PII protections, safeguarding duties and child protection frameworks
- The AI conversation belongs inside those structures, not bolted on the side as “something IT looks after”
So rather than asking, “What is our AI policy?” in isolation, ask:
- How does AI sit within our data protection policy?
- How does it interact with our safeguarding responsibilities?
- How do we audit vendors and tools as part of existing quality assurance?
AI simply turns up the volume on your current obligations.
7. Looking across the whole system – Eblana’s “6Ps” lens
At the summit, there was a constant reminder that AI has implications across multiple dimensions. In Eblana Learning we often talk about the 6Ps as a practical lens for schools: People, process, preparation, protections, policies and pedagogy.
The EU AI Act is an invitation to look at how AI touches every part of school life – from timetable construction and behaviour logs to creative projects and pastoral care.
8. Committing to ongoing monitoring and impact assessment
A phrase that echoed through the summit was the need for continuous assessment, not one‑off audits.
For schools, this could mean:
- Regularly asking: *What impact is this AI tool having on learning? On workload? On inclusion?*
- Looking for signs of bias, over‑reliance or erosion of professional judgement
- Reviewing student and parent feedback about AI‑mediated experiences
We are good, in education, at “pilot and forget”: we try something, announce success, then move on. AI demands a different posture: **check, learn, adjust, repeat**.
9. Getting crystal clear on AI governance and policies
Every school needs clarity on:
- Who approves new AI‑enabled tools
- How staff are expected (or not expected) to use AI in planning, marking, feedback
- What students may and may not do with AI in their learning
- How breaches, misuse, or harms are recorded and responded to
Clear, accessible policies also build trust with parents who are increasingly asking, “What is my child’s school doing with AI?” You should be able to answer that confidently, not reluctantly.
10. Building operational resilience – keeping the work going
Finally, schools need to think seriously about operational resilience:
- What happens if a major AI‑enabled platform you rely on fails, changes terms or is found non‑compliant?
- How do you avoid becoming so dependent on a tool that you can’t teach or assess without it?
- How do you sustain AI governance work when staff change, leadership rotates, or budgets tighten?
At the summit, cooperation and collaboration were framed as hard, necessary work. The same is true in schools: **responsible AI doesn’t run on enthusiasm alone**. It needs structures, partnerships, and time.
And now, 3 things schools *still* aren’t really thinking about – but should be
Alongside these ten, there were three big ideas that, in my experience, are still under‑discussed in schools.
1. Forbearance in emotionally sensitive domains
The term forbearance came up in relation to toys and AI around children – essentially, regulators choosing to hold back, to move cautiously where emotional and developmental risk is high.
Education is *full* of emotionally sensitive domains:
- Mental health check‑ins
- Behaviour tracking and escalation
- Early identification of “risk” or “potential”
Forbearance is a powerful concept for schools: sometimes the ethical move is to not automate, not predict, not quantify.
2. The slide from edtech to ad‑tech
At one point I misheard “ad tech” as “edtech” – and then realised how painfully close the two can be.
Our concerns about edtech are not just about screen time or distraction; they are increasingly about commodification of student data:
- Platforms building detailed profiles of children over years
- Data being repurposed for marketing, personalisation, or “engagement”
- The risk that we are raising students as **a market for life**, not as learners with rights
The EU AI Act takes a stance on certain manipulative and exploitative uses of AI. Schools need to examine whether their tools, contracts, and data flows are edging towards **ad‑tech logic** under an edtech badge.
Dependency is one issue. Lifetime access to our students as consumers is another level of concern entirely.
3. Ex ante arrangements – acting before harm is visible
Another new term for me at the summit was ex ante arrangements: proactive, pre‑emptive regulatory structures.
Translated into school practice, this might look like:
- Conducting impact assessments before adoption, not after a scandal
- Setting red lines: things we won’t do with student data or AI, even if offered for free
- Collaborating across schools and systems to set shared expectations for vendors
We are very used to post‑hoc conversations in education – we notice a problem, then patch around it. Ex ante thinking asks: *How do we design so that the most serious harms are unlikely to arise in the first place?*
Where I’m finding hope
Despite language like “threat level penetration assistance” (which frankly sends me to a dark place when I think about its implications for children and learning), I left the summit more hopeful than I expected.
Why?
Because I saw thoughtful, serious people doing serious work to protect not just markets but also fundamental protections around cognition, creativity and democratic life.
Our task in education is to:
- Bring those conversations explicitly into schools and systems
- Translate regulatory language into **practical steps for teachers and leaders**
- Insist that children’s rights, learning, and wellbeing are at the centre of everything we do - not an afterthought
If the EU AI Act is prompting businesses to get their house in order, we should seize this moment to do the same in schools – out of a deep commitment to doing the right thing, visibly, and together.