AI governance for international schools

School leaders need to understand where AI is used, what information it handles and how its outputs influence decisions. A review should cover teaching, assessment, admissions and administration, including tools introduced by individual members of staff.

The steps below provide a starting point for that review. Legal requirements depend on the school, the system and its use.

The EU AI Act and education

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. The main high-risk obligations for systems listed in Annex III of the AI Act apply from 2 December 2027. This is not a postponement of every AI Act provision (European Commission, 27 July 2026).

Annex III covers specified educational uses, including admissions, assessment of learning outcomes, decisions about educational level and detection of prohibited behaviour during tests. Classification depends on intended use and Article 6, including its exceptions. Providers and deployers have different obligations, and a school can sometimes have both roles, depending on what it develops or changes (AI Act, Articles 3, 6 and 25 and Annex III, consolidated text).

Does this apply to your school?

The Act covers providers supplying AI in the EU and deployers established or located there. It can also cover providers and deployers outside the EU where system outputs are used within it. EU nationality among pupils does not, by itself, establish that a school is in scope (AI Act, Article 2).

A school operating internationally should assess its position with its legal adviser, alongside local requirements and the information supplied by its technology providers.

Questions for governors

Governors can ask which systems the school uses, why they were chosen and who reviews their outputs. They should also understand how staff raise concerns and how leaders decide whether a tool remains suitable. These questions can be included in the school's existing arrangements for reviewing educational provision and operational risk.

Five practical steps for school leaders

1. Record the tools in use. Identify the purpose of each tool, its users, the information entered and the decisions it supports. Include tools used informally as well as those purchased by the school.

2. Review each use. Examine the consequences of an incorrect output, the handling of information and the checks needed before anyone relies on it. Obtain specialist advice where classification or legal responsibilities are unclear.

3. Set clear expectations. Explain permitted uses, restrictions on entering information, assessment rules and routes for reporting concerns. Make these understandable to staff, students and families.

4. Prepare staff. Provide training relevant to their responsibilities, including checking outputs and recognising when a task requires professional judgement. Keep a record of what has been covered and identify further support needed. Where the Act applies, providers and deployers already have a duty to take measures supporting the development of staff AI literacy. The amended duty does not require them to guarantee a particular level for each individual (Regulation (EU) 2026/1744, amendment to Article 4).

5. Agree oversight. Allocate responsibility for reviewing tools, incidents and changes in use. Decide what leaders should report to governors and when the arrangements will be reviewed.

Where to start

Begin by reviewing the tools in use and the decisions they support. Education Options can help schools work through their policies and governance arrangements as part of school improvement work.

Education Options also publishes AI Policy Packs, available separately through The Head's Companion. Schools seeking consultancy can arrange a complimentary consultation.

This article provides general information. A school's legal obligations require assessment of its circumstances and the applicable law.