EU AI Act deadlines.

In force since 2 Feb 2025

Emotion recognition in educational institutions is prohibited

Systems that infer the emotions of students or staff in educational institutions are a prohibited practice (Art. 5), except for medical or safety reasons.

In force since 2 Feb 2025

AI literacy for staff

Anyone using AI must take measures to support the AI literacy of their staff (Art. 4). Since the Omnibus, a specific level does not have to be guaranteed, but you do need to be able to show what you have done.

What training it requires →

In force since 2 Aug 2026

Transparency

People must be told when they are talking to an AI, for example a chatbot for families, and generated or manipulated content that is published must be labelled (Art. 50).

Technical marking of that content is the tool provider's obligation, not the institution's. Tools already on the market before 2 August 2026 have until 2 December 2026: it is worth asking the provider to confirm it.

From 2 Dec 2027

High risk in education (Annex III, point 3)

It covers education and vocational training at every level: schools, vocational colleges and universities. High-risk AI is AI used for:

• Deciding access or admission, or assigning students to schools.
• Assessing learning outcomes, including to steer the learning process.
• Determining the appropriate level of education for a person.
• Monitoring and detecting prohibited behaviour during exams.

Those using them will have to follow the provider's instructions, assign competent human oversight, monitor how they work, keep logs and inform the people affected (Art. 26). A private body providing a public service may also have to assess the impact on fundamental rights (Art. 27).

From 2 Dec 2027

Employment and people management

Using AI to select or filter candidates, decide promotions or dismissals, allocate tasks or evaluate performance is high-risk. Staff must be informed before it is used.

From 2 Dec 2027

Credit and insurance

Assessing people's creditworthiness or pricing life and health insurance is also high-risk, except for fraud detection.

In force since 2 Feb 2025

Who it applies to

Every organisation that uses AI in a professional capacity, with no exemption by size. It covers staff and anyone using AI on the organisation's behalf, such as contractors or partners.

Measures are tailored to what each person already knows, how they use AI and who it is used on. In schools and vocational colleges, that includes students under 18.

What it does not require

No guaranteed level, no certificate

• No specific level has to be guaranteed for any individual.
• Staff knowledge does not have to be measured.
• No certificate is required: an internal record of training and other measures is enough.
• There is no official syllabus or number of hours.

Commission guidance

What to cover

• What AI is and which AI the organisation uses.
• The organisation's role: whether it develops AI or uses other people's.
• The risks of each tool, such as made-up answers.
• Different training for different roles and contexts of use.

Asking staff to read the instructions for use is usually not enough.

Supervised since 2 Aug 2026

How to show it

National market surveillance authorities have supervised Art. 4 since August 2026. It is worth recording which measure was taken, for whom, when and for which tool.

Art. 4 has no fine of its own in the AI Act. Penalties depend on each Member State, and in Spain the law that was to set them has lapsed (see below).

From 2 Dec 2027

Stricter for high risk

Anyone using a high-risk system, for example to assess students, must assign human oversight to people with the necessary competence, training and authority (Art. 26(2)). Here the point is to prepare specific people for that system.

Data protection

The DPO's role

The GDPR does not require an AI course, but the data protection officer's tasks include awareness-raising and training of staff involved in processing (Art. 39(1)(b)). When an AI tool processes student data, the two kinds of training overlap.