How can schools use AI responsibly?

Who is responsible for what: school and provider

• Art. 4(7) GDPR
• Art. 28 GDPR

When AI processes personal data, the school or its school authority is the controller under GDPR: it decides whether and why the tool is used. A suitable provider acts as a processor under a DPA pursuant to Article 28 GDPR, follows instructions, and does not use the data for its own purposes.

This allocation of roles is substantive. It determines who reviews the legal basis, informs students and parents, and answers access or deletion requests. Kipti provides a DPA under Article 28 GDPR (version 1.4 dated September 4, 2026) and acts as processor for commissioned data; the school or school authority remains the controller.

German school law determines the legal basis

• Section 31 NSchG
• Section 67 SchulG RLP
• Art. 6 GDPR

In Germany, public schools generally base student-data processing on the school laws of the federal states rather than consent. Their general clauses allow processing when required for the education mandate and school duties, such as Section 31(1) of the Lower Saxony School Act or Section 67(1) of the Rhineland-Palatinate School Act. Each federal state sets its own rules, so the applicable state law controls.

Consent is often a weak basis in the school relationship because the imbalance between a school, parents, and students makes genuine voluntariness difficult. Germany's Data Protection Conference describes assessing voluntariness in classroom settings as extremely difficult. When school law supports the processing, that is the more robust route.

Necessary means required for the school task

• Art. 5 GDPR

General clauses do not permit collecting data just in case. Processing is necessary when a school task requires it and no equally effective, less intrusive method exists. Documentation and discussion about students can be part of that mandate, especially when multidisciplinary and extended-day teams need more coordination across roles.

A protected shared system can also support accountability under Article 5(2) GDPR: access can be controlled and traced instead of information being scattered across private notebooks, inboxes, or ungoverned message groups. Professionals still decide what should be documented in each case; the same standard applies digitally and on paper.

What stays out of general AI chats

Students' personal data should not be entered into tools that are not designed and contractually secured for that purpose. Four questions quickly reveal whether a product is unsuitable for sensitive school data:

• There is no DPA between the provider and the school or school authority.
• Storage and processing locations are unclear or not guaranteed for the relevant data category.
• Inputs may be used for provider purposes, such as improving AI models.
• The product has no role-based access, targeted sharing, or audit trail.

Suitability depends on the product tier, contract, data category, purpose, and the school's approval, not on the brand name. Different tiers from the same provider family may have materially different conditions.

High-risk status depends on intended purpose

• Art. 6(3) EU AI Act
• Annex III(3) EU AI Act

An AI system is not high risk merely because a school uses it. The EU AI Act focuses on the intended purpose. In education, Annex III(3) identifies systems used to decide access or admission, evaluate learning outcomes and steer learning, assess the level of education a person can attain, or monitor prohibited behavior during tests.

The regulation distinguishes preparatory tasks. Under Article 6(3), a system may fall outside the high-risk category when it only performs a preparatory task, such as recording, structuring, summarizing, or searching information without materially influencing a human decision. A system that profiles natural persons is always high risk. Anyone relying on the exception must document the assessment and register the system in the EU database under Articles 6(4) and 49(2).

People decide: human review and Article 22 GDPR

• Art. 22 GDPR

Article 22 GDPR protects people from decisions based solely on automated processing that have legal or similarly significant effects. When a professional meaningfully reviews the substance of an AI result and decides independently, the decision is not solely automated. Merely approving an output is not enough; the review must be genuine.

Human review is not a free pass. It does not replace a legal basis, transparency duties, or data security. Kipti's AI outputs are suggestions that require professional review; automated assessment and profiling are outside the intended use.

Take particular care with health data

• Art. 9 GDPR
• Section 31(10) NSchG

Health data and other special categories of personal data under Article 9 GDPR receive additional protection. German state school laws narrowly define when schools may process this information. Section 31(10) NSchG, for example, lists limited purposes such as school readiness, accommodations, or special-education support.

The same standard applies to digital documentation and a paper file: the professional decides what the task actually requires and omits unrelated information. A product can support special categories technically and contractually, but the school as controller decides what may be entered.

These responsibilities remain with the school

• Art. 13 GDPR
• Art. 15 GDPR
• Art. 32 GDPR
• Art. 35 GDPR

Even with a suitable provider, core data-protection responsibilities remain with the school or school authority. Six steps belong before and after rollout:

1. 01

   Assess whether a DPIA is needed

   Children's data, sensitive content, and new technology regularly indicate a DPIA under Article 35 GDPR. A suitable provider supplies supporting documentation; the school conducts the assessment.

2. 02

   Inform the people concerned

   Students and guardians must receive understandable information under Articles 13 and 14 GDPR, using clear, simple language for children as required by Article 12.

3. 03

   Provide access and export

   People may request access and a copy of their data under Article 15 GDPR. The product should make a practical export possible.

4. 04

   Define a deletion schedule

   Data should remain only while it is needed. German regulators may use the end of the school year in which a student leaves as a reference point, while individual federal states may set more specific requirements.

5. 05

   Review technical and organizational measures

   Access controls, encryption, logs, and regular security testing form part of the Article 32 GDPR standard.

6. 06

   Develop AI literacy

   Article 4 of the EU AI Act calls for AI-literacy measures suited to the people involved, the risk, and the deployment context, without mandating a certificate.

Checklist for choosing a suitable product

A short criteria list helps when comparing tools. A suitable product for sensitive school data should provide:

• A DPA under Article 28 GDPR
• Named EU and EEA storage and processing locations for personal data of documented individuals under the DPA
• Role-based access, targeted sharing, and audit logs
• No use of customer data to train or improve AI models
• Documented technical and organizational measures
• Clear export and deletion periods after the contract ends
• Reviewable AI drafts with visible source context
• Transparent subprocessors
• Support for DPIAs and data-subject rights

How Kipti implements these controls

• Art. 28 GDPR

Kipti provides a DPA under Article 28 GDPR and documented technical and organizational measures. Under DPA version 1.4 dated September 4, 2026, personal data of documented individuals is processed in the EU and EEA: primary hosting is in Germany on BSI C5-certified infrastructure, encrypted backups are in France, and AI inference uses European providers or Kipti infrastructure in Europe.

The DPA states that technical means for access to this data from outside the EU do not exist. Customer data is not used to train or improve AI models. After the contract ends, customers have 30 days to export data, and deletion occurs no later than 90 days afterward, subject to legal obligations. AI outputs remain reviewable drafts with visible source context; professionals make the final judgment.

Frequently asked questions