Teachers Are Already Using AI. The Question Is Whether Schools Know About It.

Your week likely doesn't have much slack, and governing AI use has probably not been a priority. That's understandable: a school runs on what's urgent, and so far this hasn't felt urgent.

Here's why it's worth a few minutes. AI didn't arrive in schools the usual way; it came in by stealth, quickly and quietly. It's increasingly common in the software schools already use, and in the personal accounts of staff who find it genuinely useful. There was no executive decision, no procurement process. It simply arrived.

There's a gap between AI being used and schools knowing about it. Closing that gap is the first step in governing AI well, and it's more manageable than it sounds.

Are teachers in Irish schools already using AI?

Yes. A 2024 survey found that a third of teachers in the Republic of Ireland reported using generative AI, the kind of tool that produces text, images or summaries on request[1]. 

A survey can only count what teachers recognise and name as AI. Two kinds of use stay below the waterline. The first is the AI now built into everyday school software; a teacher using a writing suggestion in Word, or a summary in Google Docs, may not think of it as "using AI" at all. The second is personal use: a teacher drafting a newsletter in ChatGPT at home, on a personal account, on a Sunday evening. This use is real, and it touches school information, but it leaves no trace in anything the school holds.

The survey is from 2024. Since then, generative AI features have been built into Microsoft 365 and Google Workspace, the two platforms many Irish schools already run. Whatever the true figure was two years ago, it's unlikely to have gone down.

The tools arrived faster than anyone could reasonably map them, and that's true of every sector, not only schools. The encouraging part is that the gap is straightforward to close, and principals don't have to close it alone. What's still open is whether a school can see its AI clearly: the tools, the users, and the information it reaches.

What does "shadow AI" actually mean?

Shadow AI is any AI tool used in an organisation without the knowledge or oversight of the people responsible for governing it. The word "shadow" refers to visibility; it’s not an accusation.

The term is borrowed from "shadow IT," which technology teams have used for decades to describe software and devices staff adopt on their own, outside the official setup. It's not unusual. Someone finds a tool that solves a real problem, it works, and they keep using it with no sign-off or record. AI has made this quicker and easier than ever, because the tools cost nothing, take seconds, and need no setup.

Shadow AI in a school often looks routine. A teacher being resourceful with limited time, using something that genuinely helps.

That ordinariness is why it needs attention. A school can only set sensible rules for the tools it can see. Everything below the waterline, the AI a school has no knowledge of, sits outside any data protection check, any guidance for staff, and the school's own picture of itself.

It stays out of view only until someone looks. For many schools, the place to start is the software already in front of them.

Where is AI already running in school systems?

Most of it sits inside the software schools use every day. Microsoft 365 and Google Workspace both come with generative AI built in, much of it enabled by default.

Here's what that includes. In Microsoft 365, Word and Outlook suggest rewrites and tidy up phrasing, PowerPoint offers to lay out slides, and Teams captions meetings live and produces written transcripts[2]. In Google Workspace, Gmail can draft an email or summarise a thread on request, Docs suggests how to finish a sentence, and Meet captions calls in real time[3]. None of this is labelled "AI" on the screen. It's built into the everyday tools, which is exactly why it's so easy to miss.

These features usually arrive switched on, as part of the platform; nobody inside the school decided to use them. There's no single AI setting that turns them all off, and each is managed separately[4].

It's not all the same. A slide layout suggestion is a small thing. A saved meeting transcript can hold names, personal details, even sensitive discussion, so it sits differently. None of it calls for panic. It asks for a clear look at what's there, and a sense of which features carry more weight than others.

The sharpest questions sit with the chatbot. In Microsoft, the Copilot Chat assistant is on by default for staff and for students aged thirteen or over[5]. Google's standalone chatbot is more guarded, staying off for under-eighteens unless an administrator turns it on[6]. A chatbot inside a school's own platform isn't an inherent problem. What matters is how it handles the information people type into it, and whether the free version is safe for schools to rely on.

Is the free Copilot Chat or Gemini safe to use?

Used through a school account, the answer is broadly yes. The free version is safe for everyday work, and both Microsoft and Google commit not to train their AI models on what people type into it[7].

One condition carries all the weight: the account. The same Copilot Chat or Gemini, accessed through a personal Microsoft or Google account, is the ordinary consumer product. The data agreement and the protections that come with a school account do not travel to a personal one.

The scenario is the same regardless of the platform used. The account type is what carries the protection.

Even with a school account, "safe to use" is not the same as "safe to type anything into." Whatever goes into the chatbot is real information sitting on Microsoft's or Google's servers. It's kept there for a time, it can be visible to the school's own administrators, and it falls under the same data protection law as any other record. A prompt with a pupil's name and their learning needs is personal data, wherever it's typed[8]. The rule that follows is simple: keep prompts generic, and leave real names and identifying details out of them.

The safer tool is the one the school already has, and the protection depends on using the school account.

So what happens when a tool has no school account behind it?

What about teachers using ChatGPT on their own?

This is the use a school has least sight of. A personal ChatGPT account, or any consumer AI tool a teacher signs into themselves, sits entirely outside the school's systems, its data protection agreements, and its records.

There are sound reasons a teacher reaches for these tools. They're free, they're good at the job, and they're a click away. On a personal account, though, the protections that come with a school account fall away. Whatever a teacher enters is handled under ordinary consumer terms, accepted by that teacher as an individual, with no agreement involving the school and no record it can see.

The risk here isn't spread evenly. Rewording a generic notice in ChatGPT is one thing. Pasting in a pupil's draft report, name and needs included, is another. The first is harmless enough. The second puts identifiable pupil data into a service the school has no agreement with, and that is the real exposure.

The solution is to use the school's own Copilot Chat or Gemini which does the same work, with the protections attached. A school's responsibility doesn't diminish because a tool sits out of sight; it stays responsible for pupil data wherever that data travels.

A school can be using AI in more than one way: a chatbot it never switched on, or personal tools it hasn't seen. Getting a clear view of all of it now matters, and the EU AI Act is the reason why.

Does the EU AI Act require a school to know what AI it's using?

In effect, yes. The Act places certain duties on the deployer of an AI system. What the EU AI Act Means for Schools in Ireland goes into more detail on deployer status; the short version is that if staff use AI for work, the school is a deployer[9].

The Article 4 requirement for AI literacy has been in force since February 2025. It asks a school to take reasonable steps so that staff have a sufficient understanding of the AI tools they use in their work[10]. Schools need to show they have taken those steps.

This is where shadow AI stops being a housekeeping question. The literacy duty assumes the school knows what AI is being used; anything below the waterline sits outside that view. The gap is not only operational. It runs straight between a school and the law as it stands.

What the Act expects to begin with is modest: know what AI staff are using, and help them understand it

Knowing what AI is in use also brings a second question into view: whether any of it is classified as "high-risk". Most of what runs in a school, such as the drafting tools and the chatbot, is not. The high-risk category applies to AI that assesses pupils, monitors exams, or steers a pupil's path through their learning, and it requires weightier governing[11].

None of this asks anything complicated. What the Act expects to begin with is modest: know what AI staff are using, and help them understand it. That awareness is the first step, and a principal can start it today without writing a single new policy.

How does a principal get a clear view of AI use?

An AI inventory will give a simple, current map of where AI use sits across the school. This should cover the generative AI inside Microsoft 365 or Google Workspace, the chatbot, and a realistic sense of where personal tools are filling gaps. The work suits being handed to someone with the time and the interest: a deputy, a digital learning team, or an IT-confident teacher. The principal sets the direction and reviews what comes back.

In practice it starts with a short staff survey. A companion article, Irish Schools and the EU AI Act: Where to Begin, sets out how to run that survey and what to ask. 

A survey usually shows staff working efficiently with whatever tool was nearest

The guidance is simple: steer staff to the school's own Copilot Chat or Gemini, and give them the one rule that matters. Keep real pupil details out of any prompt.

Two things follow, both covered in full by that same companion article. The school's acceptable use policy (AUP) may need a small update to mention AI; there's no separate AI policy to write. A short staff literacy session then puts the Article 4 duty on record.

A few findings will need a closer look. The high-risk tools flagged earlier are where outside support earns its place, so a school is not building an assessment framework on its own.

In a nutshell

Teachers in Irish schools are already using AI. The key question is whether their schools can see it, and for most, the honest answer is: not fully.

AI is increasingly built into the everyday platforms schools already run, often switched on by default. It's also in personal accounts that leave no record. Much of it arrived without anyone actively deciding it should. The tools built into school accounts are broadly safe when used with care. The real exposure is identifiable pupil data going into a service the school has no agreement with. Under the EU AI Act, a school is the deployer of the AI it uses, and Article 4, the AI literacy duty, has been in force since February 2025[10].

The fix is relatively simple: a clear, current picture of what is in use. A principal sets it in motion and oversees it. A school cannot govern what it cannot see. Knowing begins with looking.