What the EU AI Act Means for Schools in Ireland

European AI law wasn't on most principals' radar. Neither was GDPR, until suddenly it was. The 2025 National Principals' Forum survey of nearly 400 primary school principals found 94% describe their workload as a challenge and 63% describe it as unsustainable.[1] The EU AI Act has arrived on a list that was already long.

Government guidance has lagged behind the relentless pace of AI development. Only recently has there been any official acknowledgment that parts of the Act apply to schools, and clear pragmatic advice is yet to come.

The Act was amended in July 2026 by the Digital Omnibus on AI. That changed some of the dates below and rewrote one of the obligations; this article reflects the Act as amended.[27]

We'll cover who the Act applies to, who in the school is legally responsible, what's already in effect and what's still to come. There's also discussion on how AI obligations interact with GDPR, what to communicate to parents, and three practical steps for where to start. More detailed pieces on specific topics are linked throughout.

Is my school affected by the EU AI Act?

The short answer: yes, it applies to all schools. The definition of an "AI system" under the Act is broader than many realise. It covers tools like ChatGPT, Gemini, and Claude, as well as AI features built into software schools already use, such as Microsoft 365 (Copilot) or Google Workspace (Gemini).[2]

If staff are using any of these as part of their work, the school is a "deployer" under the Act. The Act distinguishes between providers, who build AI systems, and deployers, who use them. Most Irish schools will already be deployers without realising it.[3]

The Act applies to schools of all sizes. The practical weight of the obligations might change (a small rural primary isn't likely to be running AI-assisted admissions for example), but the baseline requirements around AI literacy, prohibited practices, and transparency apply equally.

Who in the school is legally responsible?

The Board of Management is the legally responsible body in most Irish schools.[4] Under the Education Act 1998, the Board is responsible for the school's operation,[5] and is considered the deployer under the EU AI Act.[6] The principal's role is operational, acting on the Board's behalf.[7]

In practice, three layers of responsibility sit inside the school.

• The Board of Management carries the legal weight. The Board approves policy updates, ratifies the Acceptable Use Policy, and is the decision-maker on any high-risk AI deployment. If the school ever has to demonstrate compliance to a regulator, the Board is the body answering. While most Boards won't need to become AI experts they do need to be in a position to make informed decisions.
• The principal carries the operational work. That means briefing the Board, maintaining visibility over what tools are in use, ensuring staff have had appropriate literacy training, and flagging anything that crosses into high-risk territory.
• Staff carry the day-to-day practice. Teachers, SNAs, and administrative staff using AI in their work need a working understanding of what the tools do and where they fall short. This AI literacy is itself a legal requirement under Article 4 of the Act.

One exception: ETB schools have a different governance structure; speak to your ETB about where the deployer responsibility sits.

Read more: What the Board of Management needs to know about AI →

What parts of the law are already in effect?

Since 2 February 2025, two parts of the EU AI Act have been legally binding for Irish schools.[8]

1. Staff AI literacy (Article 4)

Staff who use AI in their work need a basic understanding of what those tools do. Being AI literate means that staff know what the tools are good at, where they get things wrong, and what information not to put into them.[9]

A school should be able to show three things: that a literacy session took place, that the AUP has been updated to reflect AI use, and that staff have signed off on the new policy. A short session covering how generative AI works, the rule on keeping pupil data out of public tools, and a practical prompting framework will generally meet the obligation.

One prerequisite. A school can only train staff on the right tools if it knows which ones are being used. That's why the first practical step for most schools is an AI inventory, covered later in this article.

2. Prohibited practices (Article 5)

Certain uses of AI are banned outright in educational settings. For Irish schools, these matter the most:

• Emotion recognition in classrooms: AI systems that infer the emotional state of pupils or staff are prohibited.[10]
• Social scoring: AI that builds up a picture of a pupil over time, based on their behaviour or personality, and then uses that to treat them differently in unrelated parts of school life, is prohibited.[11]
• Manipulation of minors: AI systems that exploit children's vulnerabilities to distort their behaviour are prohibited. An AI tutoring tool that builds emotional dependency to drive engagement, or uses pressure tactics to influence choices, would fall here.[12]

Most Irish schools are likely not at risk of crossing these lines. The tools commonly in use, such as Copilot, Gemini, ChatGPT, lesson-planning assistants and admin helpers, don't go near the prohibitions.

Two further prohibitions were added in July 2026 and apply from 2 December 2026. They cover AI systems used to generate non-consensual intimate imagery, sometimes described as nudification apps, and AI systems used to generate child sexual abuse material.

Scope matters here. The prohibition falls on a school only where the school itself uses a system to generate that material. A pupil misusing an app on their own phone does not put the school in breach of Article 5. What that situation does trigger is the school's child protection procedures, its Bí Cineálta procedures, and the Acceptable Use Policy. Those are the instruments that apply.

Read more: Can teachers use AI in Irish schools? What's allowed, what's banned, what needs rules →

What applies now, and what's still to come?

The Act arrived in stages, and in July 2026 those stages changed. The Digital Omnibus on AI amended the AI Act and moved several deadlines. Some of the coverage described this as the EU delaying the AI Act, which is worth unpicking, because what moved and what stayed matters to schools.

Staff AI literacy and prohibited practices have been enforceable since February 2025 and were untouched. The general application date of 2 August 2026 held, bringing the Article 50 transparency obligations into force on schedule. What moved is the set of requirements for high-risk AI systems and the obligations that come with deploying one. Those now apply from 2 December 2027.

The reason given was that the supporting infrastructure was late: the technical standards, the guidance, and the national authorities meant to oversee it. The obligations were postponed but the risks they address were not. [27]

For a school, everything governing everyday AI use is live today. What shifted is the part most primary schools were unlikely to reach in the near term anyway. [13]

What is considered "high-risk" AI in schools?

The Act's Annex III lists four uses of AI in education as high-risk:

• Determining access or admission to a school or programme
• Evaluating learning outcomes, including grading and any system that steers what a pupil learns next
• Assessing the appropriate level of education a pupil should receive
• Monitoring prohibited behaviour during tests (AI proctoring)[14]

The important principle here is that it's how an AI tool is being used that matters, not what the tool is capable of. A numeracy platform used for optional homework practice carries no high-risk associations. The same platform used by a teacher to decide which set a pupil should be placed in is straying into high-risk territory. The exact same tool being used differently leads to an alternative classification.

It's how an AI tool is being used that matters, not what the tool is capable of.

Most primary schools in Ireland are not using high-risk AI. Post-primaries that use AI-assisted grading, adaptive learning platforms, or exam proctoring tools likely will be. The question to ask is whether an AI tool is helping to make decisions about individual pupils and their education.

What do schools need to do if deploying a high-risk system?

Schools deploying a high-risk AI system take on four core obligations. These apply from 2 December 2027:

• Human oversight. A named member of staff responsible for reviewing the AI's outputs and overriding them where necessary.[15]
• Informing those affected. Pupils and parents must be told before or at the point the system is used.[16]
• Record-keeping. The system's logs must be kept for at least six months.[17]
• Incident reporting. If something goes awry, such as a biased assessment or a decision that negatively affects a pupil, the school has to report the incident to the provider and the regulator.[18]

There is also a separate and more substantial obligation: the Fundamental Rights Impact Assessment, or FRIA. The Act requires public bodies, which most Irish schools are, to carry out a FRIA before deploying any high-risk AI system. It sits alongside the Data Protection Impact Assessment schools already know from GDPR, and the July 2026 amendment made that relationship explicit. A FRIA may now cross-reference the relevant sections of a school's DPIA, or incorporate parts of it directly.[19]

The AI Office is required to produce a questionnaire template to support this, including an automated tool. It has not been published as of September 2026. Schools with a high-risk system in prospect have until December 2027, and the sensible sequence in the meantime is the familiar one: complete the DPIA first, then extend it to cover the wider fundamental rights questions.

Read more: High-risk AI in schools — why use matters more than the tool →

Read more: The FRIA for schools — what it is and how to approach it →

How does this connect to GDPR?

GDPR and the EU AI Act apply simultaneously. If AI use involves personal data, GDPR governs how that data is handled and the AI Act governs how the AI system itself is used.[20]

The practical rule for daily use is simple: never enter pupil data into a public AI tool. That means no pupil names, no SEN details, no behavioural records, nothing that could identify a specific child.

Safer methods involve anonymising information before it goes near an AI tool, or using AI features inside a school's existing licensed software, such as Microsoft 365 or Google Workspace. The data protection terms in those environments are stricter and already in place under the school's existing contract. Tools accessed through personal accounts carry more risk than tools accessed through school-managed environments.

A note on consent. Under GDPR and Ireland's Data Protection Act 2018, the digital age of consent is 13. Below that age, a parent or guardian has to consent to personal data being processed through an online service, including an AI tool. This is most relevant where schools are considering tools that pupils interact with directly.[21]

What do schools need to tell parents about AI?

Schools should communicate three things to parents: what AI means in the context of the school, what the school is using AI for, and what the school is not using AI for. The third point is usually the most reassuring. Many parents are concerned about specific things such as grading decisions, data being fed into unknown systems or children being surveilled, things that most schools are not actually doing. Naming those directly is more effective than generic reassurance.

Beyond that voluntary framework, Article 50 of the AI Act sets two specific legal obligations for schools to disclose AI use.

The first covers direct interaction. Where pupils or parents interact with an AI system, such as a tutoring tool, a chatbot, or a reading assessment that speaks back to the child, the school has to inform them. This applies regardless of whether the tool is classified as high-risk, and it is separate from the high-risk informing obligation covered earlier.[22]

The second covers AI-generated content. If the school uses AI to help draft parent correspondence or other public-facing communications, Article 50 requires disclosure. The Act allows one practical exemption: where AI-generated content has been reviewed by a person before publication, the obligation is met. A single paragraph on the school's website or in the AUP is usually sufficient, stating that AI tools are used to support administrative work and that all communications are reviewed by a named staff member before being sent. Individual newsletters do not need to be labelled provided they have been reviewed.[23]

Parents will form their own views on AI, and they do not need to agree with the school's to feel reassured. What they need is evidence that the school is paying attention, has rules in place, and can answer reasonable questions.

Read more: How to explain AI to parents — what to say, when to say it →

Do schools really need to act right now?

Yes, but not because regulators are about to come knocking. The current regulatory focus is more on providers of AI systems rather than schools deploying them. The case for acting now is about three other risks.

High-risk AI deployment rarely starts with a deliberate decision.

The first is trust. Parents are increasingly aware of AI, and a school that cannot answer basic questions about how AI is being used will look inattentive at best.

The second is GDPR exposure. GDPR has been in force since 2018, and the AI Act's literacy and prohibited-practice obligations are already live. A school that has not surfaced what AI tools its staff are using is more likely to have pupil data flowing into public AI tools without oversight, and that is an active GDPR risk regardless.

The third is drift. High-risk AI deployment rarely starts with a deliberate decision. It likely starts with a free tool a teacher finds useful, or an edtech vendor quietly adding an AI assessment module to a product the school already buys. A school not paying attention can find itself with high-risk AI in use without ever having decided to deploy any.

Surfacing AI use that is difficult to see aka "shadow AI" →

Recent ESRI research found that of 51 large post-primary schools studied, none had AI-specific guidelines in their Acceptable Use Policy, and only 10% of school leaders were confident their AUP addressed their school community's needs.[24] The compliance gap is real and widely shared.

Of 51 large post-primary schools studied, none had AI-specific guidelines in their AUP. Only 10% of school leaders were confident their policy addressed their community's needs.

The Act is less about penalties and more about good housekeeping. A school that knows what AI tools are in use, has updated its AUP to reflect that, and has given staff a basic literacy session is in a reasonable position. None of that requires more than a morning's work spread across two or three people, done once, and maintained thereafter.

Where should I start?

These steps will cover most of what a school needs in the short term, and none of them should take much of a principal's time. They are the survey, the AUP review, and the literacy session.

A companion article, Irish Schools and the EU AI Act: Where to Begin, walks through all three in full: what each step involves, who does it, and what "done" looks like.

A short, anonymous staff survey tells the school what AI is actually in use, it's the logical first step, because a school cannot govern, train, or assess what it cannot see. The Acceptable Use Policy is then updated to reflect that use. The Department of Education's position is that no separate AI policy is needed. A staff literacy session, usually about an hour, covers how the tools work, the rule on keeping pupil data out of public AI tools, and a practical prompting framework; that session meets the obligation under Article 4.

These steps will not make a school compliant with every element of the Act. They do however get the school into a reasonable position: visibility over AI use, a policy that reflects that use, and staff who understand the tools they work with.

In a nutshell

The EU AI Act applies to every Irish school. The Board of Management carries the legal responsibility, the principal the operational work, and staff the day-to-day practice. Two obligations have been live since February 2025, the transparency rules joined them in August 2026, and the heavier high-risk requirements arrive in December 2027. None of this requires a rebuild of how the school operates, and most of it sits on top of policies and plans already in place.

Schools absorbed GDPR. The AI Act, it turns out, requires considerably less. Schools that start quietly this term will be in a better position when the next set of obligations arrives than schools that wait for them.