Use-case guide

AI in Education

Education is where 'AI for kids' meets the most protective legal regimes on earth. AI tutors, automated grading, proctoring, admissions algorithms, and chatbots aimed at minors all simultaneously trigger (1) the EU AI Act's high-risk classification for education, (2) FERPA + state student-data-privacy laws in the US, (3) child-data rules (COPPA, GDPR-K, Article 14 UK age-appropriate design code), and (4) sector-specific equality law. Regulators are also moving fast on AI-generated academic misconduct, deepfake nude images of students, and emotion-recognition in classrooms.

For: K-12 districts, university administrators, edtech founders, AI tutoring product teams

What's at stake

Education is high-risk under the EU AI Act

Annex III §3 lists 'AI systems intended to determine access to, or admission, or assignment of natural persons to educational institutions', and 'AI systems intended to evaluate learning outcomes including for the purpose of steering the learning process'. Full Annex III obligations apply.

Emotion recognition in classrooms is banned outright

EU AI Act Article 5(1)(f) prohibits AI systems for emotion recognition in educational institutions, except for medical or safety reasons. This bites webcam-based attention-tracking tools that became common during remote schooling.

Student data has its own privacy regime

FERPA in the US, GDPR's special protection for children's data in the EU, and state student-data-protection laws (CA SOPIPA, NY EDUC §2-d, IL SOPPA) all overlap with AI-specific rules. The combined effect is that even 'training the model' is regulated, not just inference.

Equity gaps in educational AI have civil-rights consequences

The US Office for Civil Rights has been explicit that Title VI and Title IX cover AI in education. If your tool has materially different outcomes for protected groups, that's a Department of Education complaint waiting to happen.

Regulations that apply

EU AI Act

Law
→

Admission, assessment, and emotion-recognition AI in schools are high-risk or prohibited. Full duty stack for high-risk; outright ban for classroom emotion-recognition.

Where in the text: Article 5(1)(f); Annex III §3; Articles 9-15.

US FERPA + state student-privacy laws

Law
→

Restricts disclosure of student education records to AI vendors without consent. State overlays (CA, NY, IL) impose vendor-contracting and data-deletion duties.

Where in the text: 20 USC §1232g (FERPA); CA Educ. Code 22580 (SOPIPA); NY Educ. Law §2-d.

Illinois SOPPA + AI rules

Law
→

Student Online Personal Protection Act + the new AI employment rules apply to staff hiring AI in schools.

Where in the text: Illinois SOPPA (105 ILCS 85/); IHRA as amended by HB 3773.

US Title VI / Title IX civil-rights overlay

Law
→

An AI tool that produces differential outcomes for a protected group can trigger Department of Education investigations even without intent.

Where in the text: OCR Dear-Colleague letters on AI; Title VI; Title IX.

Do

  • ✓Map every place AI touches a student decision — admissions, grading, financial aid, attendance, discipline — and run a written impact assessment per location.
  • ✓Get parental consent under your local children's-data regime BEFORE you train on or process student data with an AI vendor.
  • ✓Build an explicit opt-out: a non-AI route for any student or family who objects, with no penalty for opting out.
  • ✓Use age-appropriate AI design — chatbots aimed at under-18s should have stronger safety filters, no persuasive UX patterns, and clear human-handoff for distress.
  • ✓Maintain a register of any AI used in disciplinary or attendance decisions — and have a human review every adverse outcome.

Don't

  • ✗Don't deploy webcam-based 'engagement detection' or emotion recognition in EU classrooms. It's banned outright (Article 5).
  • ✗Don't use AI to flag students for academic misconduct without a human-review step — false positives are common and the reputational harm is severe.
  • ✗Don't ship a generative-AI tutor without an age-gate and content filters tuned to your target age range. Regulators view this as foreseeable harm.
  • ✗Don't reuse data collected for one educational AI feature to train a different model — minimisation and purpose-limitation apply.
  • ✗Don't bury vendor data-flows in 100-page click-through privacy notices for parents. Several state AGs have flagged this as an unfair practice.

Also worth knowing

For higher-education admissions: ABA Standard 206 (US law schools), AACSB on business schools, and several state attorneys-general are scrutinising algorithmic admissions for race-conscious effects post-SFFA v. Harvard. For US K-12: COPPA still applies to anyone targeting under-13s commercially — and FTC enforcement of COPPA against edtech vendors has intensified since 2023.

Want a tailored answer?

The wizard takes your jurisdiction, AI use case, and data types and gives you the top-3 regulations to focus on — in 60 seconds.

Start the wizard →

Educational guide. Not legal advice. For specific compliance decisions, consult qualified counsel in the relevant jurisdiction.

Note: this guide was drafted with AI assistance — Anthropic Claude.