Artificial intelligence has become a permanent fixture in lecture halls, admission systems and dean’s offices, and since 2 August 2026 universities must treat it as a legal compliance issue. The EU AI Act has moved beyond tech giants, and Polish institutions are now expected to train staff, audit their tools and, in some cases, redesign recruitment procedures.
Faber warns that many universities still do not see how widely the rules affect daily operations. The regulation, which applies directly across the EU, leaves no room for national delay. The Information Security Centre director at AGH University of Science and Technology says the obligations cover every university using AI, including institutions that do not conduct advanced artificial intelligence research.
– The AI Act applies at EU level and is applied without the need for separate implementation into national law. This means its provisions will also apply to Polish universities – Dr Łukasz Faber told WNP.
– This is not limited to technical universities. In practice, every university that uses AI tools in any way is subject to the AI Act. The regulation imposes an obligation to ensure an adequate level of knowledge and competence for people using such systems – Faber said.
Article 4 is the core of this obligation. Both providers and deployers of AI systems must show that their personnel understand how the tools work, what their limits are, and how to use them responsibly. The rules do not require a single mandatory training or certification scheme, but they do require evidence that staff competence is in place.
Faber recommends starting work before the final deadline because university-wide changes require coordination between departments. He also notes that early planning helps spread out the costs and allows for testing of new procedures.
Compliance costs and EU deadlines
The second phase of the AI Act is already in force: since 2 August 2026, transparency requirements and most remaining provisions apply. The strictest duties for high-risk systems used in education are delayed until 2 December 2027, but Faber warns against postponing preparation.
– A large part of universities will rather be users of AI systems, so a narrow scope of requirements applies to them. These requirements – mainly training and supervision of high-risk systems – still force universities to prepare and change processes, such as those related to public procurement. Experience shows that such changes are not easy and require the involvement of many people from different departments. I would recommend starting work earlier than at the last minute – said the director.
Audits of AI tools, new documentation, procedures and employee training will all generate expenditure. Faber argues, however, that universities which already took the NIS2/KSC2 cybersecurity law seriously should find the AI Act easier to absorb. At AGH, cybersecurity training already includes guidance on working with AI systems and related threats.
– I would risk saying that these costs will not be huge if the university has previously approached the implementation of requirements arising from NIS2/KSC2 well. Identification of high-risk AI systems is really an element of the ICT product supply chain management process that appears in KSC2. Similarly, training – at AGH we already include information about working with AI systems and the related threats in cybersecurity training – explained Faber.
Universities will have a chance to discuss these practical issues on 25-26 November in Warsaw, during the Science. Development. Business conference (Nauka. Rozwój. Biznes) devoted to cooperation between higher education and business.
The high-risk trap in education
An academic using ChatGPT to prepare lectures or texts is not automatically running a high-risk system. The high-risk category in Annex III, point 3, covers AI used for student recruitment, placing students in specific programmes, assessing learning outcomes and setting education levels.
When such tools are deployed, Article 26 of the AI Act demands human oversight by competent persons, continuous monitoring and event logs. Faber warns about Article 25(1) as a hidden trap: a university that adds its own name or trademark to a high-risk system becomes the provider, with extra registration and conformity assessment duties.
– Article 25(1) contains a trap: the deployer, for example our university, if it puts its name or trademark in a high-risk AI system, automatically becomes the provider of such a system. That causes a series of extra requirements – registration in the EU database, conformity assessment, implementation of a risk management system etc. – warned Faber.
Źródło: WNP.PL, Fot. Gorodenkoff / Shutterstock
