The background material compiles the knowledge base for AI recommendations and supports education providers and teachers in developing AI competence and utilizing AI locally.

The background material covers various themes and should be used as a whole.

The EU Artificial Intelligence Act (AI Act) is a comprehensive legal framework for AI. Its objective is to ensure that the AI systems used in the EU are safe, transparent, ethical, objective and human-controlled. The AI Act creates rules for the use and sustainability of AI and classifies AI systems according to their risks.  

The AI Act lays the foundation for functional, safe and fair digital operating environments in education. It also mitigates the risks posed by an increasingly digital environment.    

When planning the deployment of an AI system, the deploying organisation must assess whether the system meets the definition for AI system provided in the EU AI Act. If the system meets the definition provided in the Act, the deploying organisation must assess whether it is subject to deployer obligations, and if so, what these obligations are (e.g. prohibition on the use of certain AI practices, requirements concerning high-risk AI systems or general-purpose AI models, transparency obligations).  The obligations also depend on the role of the education provider according to the AI Act (e.g. provider, deployer). 

According to the AI Act, AI system means “a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.”  

The AI Act applies to all systems that meet the definition provided in the Act.  

The AI Act prescribes a risk-based approach to AI systems. The Act divides AI practices into the following categories:  

  • prohibited AI practices  
  • high-risk AI systems  
  • limited risk AI systems,  
  • minimal risk AI systems.  

The Act also imposes requirements for providers of general-purpose AI models regarding documentation and the description of the training data used, among other things.

Furthermore, the AI Act states that providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. 

Back to top

Prohibited AI systems include systems that exploit or  

manipulate the vulnerabilities of an individual or group of persons and are at least reasonably likely to cause significant harm to that person or another person. All prohibited AI practices are listed in Article 5 of the Act. For example, using AI systems to infer the emotions of individual people at workplaces and educational institutions is generally prohibited. Other examples include:

  • systems that deploy subliminal techniques or purposefully manipulative or deceptive techniques beyond a person’s consciousness that cause or are reasonably likely to cause that person, another person or group of persons to take a decision that causes significant harm  
  • systems exploiting the vulnerabilities of a natural person or a specific group of persons related to age, disability or specific social or financial situation to materially distort their behaviour in a manner that is at least reasonably likely to cause significant harm to that person or another person    
  • social scoring systems that evaluate and classify people or predict their behaviour on the basis of factors such as the person's personality or behaviour, leading to the harmful or unfavourable treatment of a person or group of persons.
Back to top

High-risk AI systems are systems that, in light of their intended purpose, pose a high risk of harm to the health and safety or the fundamental rights of persons when used in the specifically pre-defined areas specified in the Act. All high-risk AI systems are listed in Annex III to the Act. The AI Act does not prohibit high-risk AI systems. Instead, it imposes restrictions and obligations on their use and operation, including in relation to risk and data management and documentation. Before deploying them, the deployer must carry out a review of fundamental rights, for example.    

According to Annex III, high-risk AI systems include:

  • AI systems intended to be used to determine access or admission or to assign natural persons to early childhood education and care (ECEC) and education at all levels;
  • AI systems intended to be used to evaluate learning outcomes, including when those outcomes are used to steer the learning process of natural persons in ECEC and education at all levels;
  • AI systems intended to be used for the purpose of assessing the appropriate level of education that an individual will receive or will be able to access, in the context of or within ECEC and education at all levels;
  • AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within education at all levels.

However, an AI system referred to in Annex III is not considered to be high-risk and not considered to materially influence the outcome of decision-making if any of the following conditions is fulfilled:    

  • The AI system performs only a narrow procedural task, such as categorises incoming documents.
  • The AI system improves the result of a previously completed human activity, such as develops the language used in documents previously prepared by humans.
  • The AI system is intended to detect decision-making patterns or deviations from prior decision-making patterns, such as retroactively check based on a teacher’s assessment methods whether the teacher in question has deviated from their assessment methods. However, the system should not be meant to replace or influence the previously completed human assessment without proper human review.
  • The AI system is intended to only perform a preparatory task, which means that the potential impact of the outputs of the system is very limited in terms of the task to be performed. In this case, humans remain responsible for decision-making, for example.      

However, notwithstanding the above, an AI system is always considered to be high-risk if it performs profiling as referred to in the General Data Protection Regulation. More information on profiling is available on the website of the Office of the Data Protection Ombudsman.

Back to top

Chapter IV of the AI Act lays down openness and transparency obligations on deployers and providers of limited risk AI systems. Limited risk AI systems include systems that interact directly with people, systems that generate synthetic audio, image, video or text content, or systems that generate or manipulate image, audio or video content to create deep fakes.

Back to top

Minimal or no risk AI systems include video games and spam filters that utilise AI. As far as the AI Act is concerned, AI systems belonging to this category may be freely used and developed within the European Union.

Back to top

A general-purpose AI model “displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and can be integrated into a variety of downstream systems or applications”. General-purpose AI models are separately mentioned in Chapter V of the Act and do not directly fall under any risk category as such.  

If an AI model is considered to pose systemic risks for reasons such as its efficiency or extensive use, the Act imposes obligations on its providers in relation to risk management, testing, information security and environmental impacts, for example.

According to the Act, general-purpose AI systems can be high-risk AI systems by themselves or be components of other high-risk AI systems.  

Back to top

The AI Act does not apply e.g. to “AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development”.

Back to top

The AI Act is implemented as necessary by national legislation, with Member States defining the authorities supervising the Act at the national level, for example. In Finland, preparation for the national implementation of the AI Act is handled by the Ministry of Economic Affairs and Employment. At the time of publication of this text, the national implementation was still in progress. At the EU level, the party responsible for the implementation of the Act is the European Artificial Intelligence Office. Member States are represented in the European Artificial Intelligence Board, which advises and assists the Commission and Member States in promoting the consistent and effective application of the AI Act. 

Back to top

The AI Act entered into force on 1 August 2024, and the obligations under it will be fully applied from 2 August 2026 onwards. By way of derogation, the Act includes obligations that will enter into force in accordance with the following transitional periods:  

1 August 2024 entry into force of the AI Act    
2 February 2025 entry into force of regulation of prohibited systems and the AI literacy obligation  

  • Chapter I (“General provisions”, including promoting AI literacy) and  
  • Chapter II (“Prohibited AI practices”)

2 August 2025 entry into force of governance rules and obligations concerning general-purpose AI models and sections concerning national supervisory authorities  

  • Chapter III, section 4 (“Notifying authorities and notified bodies”),  
  • Chapter V (“General-purpose AI models”),  
  • Chapter VII (“Governance”),  
  • Chapter XII (“Penalties”) and Article 78 (“Confidentiality”), with the exception of Article 101 (“Fines for providers of general-purpose AI models”);

2 August 2026 the Act is applied in full
2 August 2027 entry into force of rules on high-risk AI systems included in regulated products (Annex I)    

  • Article 6(1) (classification of a system as high-risk in the cases set out in Annex I) and the corresponding obligations of the Act 
Back to top

Back to top

Besides the AI Act, other EU and national level legislation that must be taken into account in the utilisation of AI include the Administrative Procedure Act, the Act on the Openness of Government Activities, the General Data Protection Regulation, the Data Protection Act, the Act on Information Management in Public Administration, the Act on the Provision of Digital Services, the Copyright Act, procurement legislation, the Non-Discrimination Act, the Act on Equality between Women and Men and applicable legislation on education and training, such as the Act on Early Childhood Education and Care, the Act on Primary and Secondary Education, the Act on General Upper Secondary Education, the Act on Vocational Education and Training, the Act on Preparatory Education Leading to an Upper Secondary Qualification and the Act on Liberal Adult Education.  

Back to top