Europe’s AI Transparency Rules Are Already in Force. What They Mean for Schools and AI Companies 

Much of the coverage of Europe's AI Act this year has been about delay. In July, the EU enacted its "Digital Omnibus," Regulation (EU) 2026/1744, which pushed back the strictest rules for AI that admits, grades, places or proctors students from Aug. 2, 2026 to Dec. 2, 2027.

What the Omnibus did not delay matters more to most schools and edtech companies today. Since Aug. 2, 2026, AI tutors and chatbots used in the EU must tell people they are AI, generative tools must mark what they produce, and schools and universities must label deepfakes and some AI-written text (Usercentrics). Two other duties, AI literacy for staff and a ban on emotion recognition in education, have applied since February 2025.

The law reaches beyond Europe. It covers providers anywhere that sell AI systems in the EU, and providers and deployers outside the EU whose AI output "is used in the Union" (Article 2). A U.S. edtech company with European customers is in scope.

What changed in 2026

The European Commission proposed the Omnibus on Nov. 19, 2025. Negotiators agreed on it in May 2026, the European Parliament approved it June 16 by 423 votes to 57 with 174 abstentions, and the Council gave final approval June 29 (Council). It has been in force since July 27, 2026 (artificialintelligenceact.eu).

The Omnibus replaced the Commission's proposed standards-linked trigger with fixed dates. High-risk systems listed in the Act's Annex III, which include every education use, now face their obligations from Dec. 2, 2027 (Gibson Dunn). The Omnibus left penalties and the law's territorial reach unchanged. It also added new bans, from Dec. 2, 2026, on AI that generates non-consensual intimate images or child sexual abuse material (Orrick).

What AI and edtech companies must do now

Tell users they are talking to AI. Under Article 50(1), a system that interacts with people must tell them it is AI, at the latest at the first interaction, unless that is obvious. The Commission's guidelines on Article 50, finalized July 20, 2026, say a line in the terms and conditions does not count and that the system must disclose it is AI whenever asked (Pearl Cohen; McCann FitzGerald). For a tutor used by children, a single splash screen is unlikely to be enough: the guidelines call for disclosure suited to vulnerable users, and reminders in riskier settings.

Mark generated content. Article 50(2) requires generative AI to mark synthetic audio, images, video and text so that machines can detect it. Products launched on or after Aug. 2, 2026 must comply now. Generative systems already on the market before then have until Dec. 2, 2026 (Council).

Building on someone else's model does not shift the duty. A company that wraps GPT, Gemini or Claude in its own branded tutor is the provider under Article 50. It can use the model-maker's watermark, but the guidelines say "compliance responsibility stays with the provider" (McCann FitzGerald). The guidelines also ask providers to give educational and research institutions free access to detection tools, PPC Land reports.

The labelling code is the practical route. The Commission published a voluntary Code of Practice on marking and labelling AI-generated content on June 10, 2026. By Sept. 24 it had 95 provider and 192 deployer signatories, including Google, Microsoft, OpenAI, Anthropic and Mistral (Commission). The Commission lists education among signatories' sectors, but we found no named edtech company among them. Authorities will "likely" ask non-signatories for more detailed evidence of compliance, Morrison Foerster says. Model-makers are pairing watermarks with C2PA content credentials; Google cites SynthID and C2PA, and Anthropic says future Claude models will carry a watermark (same source).

The large model-makers have had separate obligations since Aug. 2, 2025. Amazon, Anthropic, Google, IBM, Microsoft, OpenAI, Mistral and Aleph Alpha signed the 2025 code for general-purpose models; Meta declined (Politico Europe). The Commission's power to fine those providers took effect Aug. 2, 2026 (Wilson Sonsini). We found no public reports of a fine under either regime as of Oct. 31.

What schools and universities must do now

Under the Act, the school or university that uses an AI system is the "deployer." Three duties already apply.

AI literacy. Since Feb. 2, 2025, deployers must take measures to build their staff's AI literacy. The Omnibus softened the wording and says no specific level is required, but kept the duty (artificialintelligenceact.eu). The Commission's AI literacy Q&A, updated Oct. 20, 2026, says staff using ChatGPT for writing or translation trigger it and "should be informed about the specific risks, for example hallucination." No certificate is needed, and an internal record of training is enough. National authorities have enforced the duty since Aug. 2, 2026.

No emotion recognition. Since Feb. 2, 2025, AI that infers students' emotions from biometric data, such as webcam "attention" or "engagement" scores, has been banned in education at every level, including admissions, except for strictly medical or safety reasons (Future of Privacy Forum). Breaches carry the Act's highest fines: up to €35 million or 7% of worldwide turnover (Article 99).

Label deepfakes and some AI text. Under Article 50(4), anyone who publishes a realistic AI-generated image, audio or video of real people, places or events must say so. AI-generated text "published with the purpose of informing the public on matters of public interest" must be labelled too, unless a person with editorial responsibility has reviewed it. The guidelines set a high bar for that review: fact-checking at minimum, not a quick approval. Labels must appear at first exposure, at the top of text and the start of a video (PPC Land).

In practice, by our reading, an AI avatar of a university president in a recruitment video needs a label. So does a cloned lecturer voice. An AI-drafted press release needs one unless the communications office can show real expert review. Internal worksheets are probably not "published to inform the public." Breaches of Article 50 can bring fines of up to €15 million or 3% of turnover, though each EU country decides whether and how fines apply to its own public bodies, including state schools and public universities (Article 99).

Grading, admissions and proctoring: December 2027

Annex III makes four education uses high-risk: deciding admission or placement, evaluating learning outcomes, assessing the level of education a person will receive, and monitoring students for prohibited behavior during tests. General writing assistants are not on the list, and Utrecht University's guidance expects the number of high-risk systems in education to be "limited" (Utrecht University).

From Dec. 2, 2027, vendors of these systems must run risk management and bias checks, keep technical documentation and logs, design for human oversight, pass a conformity assessment and register in an EU database (AI Act). Schools that use them must follow the instructions, assign trained staff to oversee them, keep logs for at least six months and tell students when the system is used to make decisions about them (Article 26). Public schools and universities must also complete a fundamental-rights impact assessment before first use (Article 27). The Omnibus lets that assessment reuse an existing GDPR data-protection impact assessment (Orrick).

There is a trap in the line between vendor and school. Under Article 25, a deployer that turns a general-purpose system into one of these high-risk uses becomes its provider (AI Act). A university that builds an exam-grading pipeline on a general chatbot could take on the full vendor regime. No Commission guidance yet applies this to education, so treat it as a risk, not a settled reading.

Watch for outdated guidance

Several vendor blogs still say the high-risk education rules started Aug. 2, 2026. Ireland's official October 2025 guidance on AI in schools says the Act "will apply in full from 2 August 2027," which was wrong even under the original law. Check dates against the Commission or the regulation before relying on them.