An AI assistant for schools: using it in line with the GDPR

Schools process data of children and young people, who are particularly vulnerable and often cannot opt out — school attendance is compulsory. The GDPR stresses in its recitals that children merit specific protection with regard to their personal data. On top of that come state school and data protection laws, which govern which data schools may process for which purpose.

An AI assistant sharpens these questions: what pupils type in can be very personal. A model that stores inputs or uses them for training is hard for a school to control. And AI answers can be wrong, inappropriate or unsuitable for a particular age.

The controller under the GDPR is usually the school or its governing body, depending on state law. Using a service that processes data on your behalf requires a data processing agreement under Art. 28 GDPR. Processing needs a legal basis; for schools this is often the fulfilment of their statutory educational mission under state law, in other cases consent — which is subject to special rules for children.

The EU AI Act, Regulation (EU) 2024/1689, contains several rules that directly affect schools. Since 2 February 2025, using AI systems to infer a person's emotions in educational institutions has been prohibited, except for medical or safety reasons (Art. 5(1)(f)). Also since that date, deployers of AI systems must take measures to ensure their staff have sufficient AI literacy (Art. 4).

Annex III point 3 classifies as high-risk those AI systems in education that decide on access or admission, evaluate learning outcomes, determine the appropriate level of education, or monitor prohibited behaviour during tests. Strict obligations apply to such systems, including human oversight. An assistant that explains and sets practice but neither assesses nor decides generally does not fall into this category. The dates from which individual obligations apply should be checked against the current state of the law.

An AI assistant for schools must do more than a general chat program. It should follow the applicable curriculum so that it practises what is required in class. It should work didactically — asking questions and giving hints rather than handing out solutions. And it should suit the pupils' age: in language, content and handling of sensitive topics.

Control by teachers is decisive. They should be able to decide for which subjects, topics and tasks the assistant is used, when it is unavailable — during a class test, for example — and what it must not do.

Before introducing an AI assistant, school leadership, the school authority and the data protection officer should clarify these questions.

With Universe Classroom, Universe plans an AI assistant for schools built on five principles: its own self-hosted models instead of a third-party service; curriculum fidelity through learning objectives from official curricula that a teacher has confirmed; control by teachers, who decide what the assistant does and does not do; a speaking avatar as learning companion; and protection of minors, designed for children and young people.

Age groups, school types, the operating model of the own models, the detailed rules for protecting minors and the launch date are still being clarified. Today the platform serves universities and companies, runs in the EU (Frankfurt) and has fixed guardrails for every AI element.