Algorithms used to admit students, chatbots serving future applicants and software that evaluates coursework are now firmly within the scope of EU law. On 2 August 2026, most provisions of the AI Act started to apply directly to universities across Poland, bringing new duties in staff training, system audits and admissions procedures.
Dr. Łukasz Faber, director of AGH’s Information Security Centre, says universities should not wait for the next deadline. Under Article 4 of the AI Act, providers and deployers of AI systems must ensure that people using them have the right level of competence. The rule does not force universities to issue certificates or run one mandatory training course, but it does require them to show that staff understand the systems’ possibilities and limitations.
– The AI Act is binding at EU level and is applied without the need for separate implementation into national law. This means that its provisions will also apply to Polish universities – said Dr. Faber.
Many schools have not yet estimated how broadly the regulation will affect daily operations. Chatbots, text generators and data-analysis tools are already present in dean’s offices and lecture halls, so the impact reaches far beyond laboratories working on AI research.
– It is not just technical universities. In practice, every university that in any way uses AI tools is subject to the AI Act. The regulation imposes, among others, an obligation to ensure an appropriate level of knowledge and competence among people using such systems – said the expert.
Compliance dates and the cost question
Transparency requirements for AI systems and most remaining AI Act rules took effect on 2 August 2026. The heaviest obligations for high-risk AI systems used in education will follow on 2 December 2027. Faber warns against treating the later date as permission to postpone preparatory work.
– As experience shows, changes of this type at universities are not easy and require the involvement of many people from various departments. Therefore, I would recommend starting work earlier rather than at the last minute. Earlier work also allows for better planning of the costs of these changes and proper testing of solutions – said the director of AGH Information Security Centre.
Universities will have to pay for audits of AI tools, preparation of procedures and documentation, and employee training. In Faber’s assessment, these costs should be moderate for campuses that have already gone through cybersecurity compliance under NIS2, the Polish act on the national cybersecurity system, or the updated KSC2 rules.
– I would risk saying that these costs will not be very large if the university has previously approached the implementation of requirements arising, for example, from NIS2/KSC2 well. Identifying high-risk AI systems is really an element of the ICT product supply chain management process that appears in KSC2. Similarly with training – at AGH we already include information about working with AI systems and related threats in cybersecurity training – said Dr. Łukasz Faber.
High-risk AI in education and a legal trap
A lecturer using ChatGPT or a similar generative tool does not automatically put the entire university in the high-risk category. The AI Act is more precise. Annex III point 3 lists educational applications that may count as high-risk: recruiting candidates for studies, assigning students to programmes, assessing learning outcomes, and determining the level of education.
For such systems, Article 26 applies. Universities must ensure human oversight by competent persons, continuous monitoring of the system’s operation, and records of incidents. Faber also points to an often-overlooked consequence of Article 25(1).
– There is a trap in Art. 25(1) of the AI Act – a deploying entity, for example our university, if it puts 'its name or trademark on a high-risk AI system’ becomes automatically the provider of such a system. That results in many additional requirements – registering the system in the EU database, conformity assessment, implementing a risk management system, etc. – warned Dr. Faber.
A conference named Nauka. Rozwój. Biznes, devoted to university-business cooperation, is scheduled for 25-26 November in Warsaw.
Source: WNP.PL, Photo: Gorodenkoff / Shutterstock
