Electronic Documentation in Schools: AI, GDPR, Security

From “electronic documents” to an institutional information architecture

When this article was first published in 2020, the main challenge was the transition from paper to electronic documents. That transition is still important, but it is now only the first layer. By 2026, schools and kindergartens operate in an environment where official education records, electronic registers, internal documents, cloud storage, electronic signatures, communication systems and AI tools increasingly intersect within the same workflow.

It is therefore useful to distinguish three layers. The first is the official layer — the systems and documents through which the institution fulfils statutory obligations. The second is the operational layer — folders, versions, permissions, templates, archives and workflows. The third is the AI layer — tools for drafting, structuring, searching, comparing and assisting staff. These layers should not be merged without explicit institutional rules.

What is a DMS — and why is the concept no longer sufficient on its own?

A Document Management System (DMS) organises the creation, versioning, access, search, storage and lifecycle of electronic documents. The logic remains fundamental: who has access, which version is current, who changed the file, when it was approved and where the final document is stored.

In education, however, a DMS does not replace official education systems. Bulgaria’s National Electronic Information System for Preschool and School Education (NEISPUO / НЕИСПУО) is a web-based platform used by school leaders, teachers, parents, students and administrative staff. Its documentation module is developed within the national regulatory framework for information and documents in preschool and school education. Internal document organisation should therefore support the official process rather than create a parallel source of institutional truth.

What can AI actually do with school documentation?

When introduced correctly, AI can remove a substantial amount of repetitive administrative work. It can prepare a first draft of an official letter from an approved template, transform meeting notes into a structured draft of minutes, compare a document with a checklist, identify missing sections, summarise public regulatory information, convert a long internal document into concise instructions or propose alternative versions of communication with parents.

A more advanced level is a specialised AI assistant for a specific school or kindergarten. This does not mean training the system on raw student files. A safer design is to provide approved templates, public regulations, internal rules without sensitive data, role instructions and predefined protocols. In this model, the AI learns how the institution works without turning personal information into its training material.

This is the key change since 2020. The old question was: “Which document-management software should we buy?” The more important question now is: “Which combination of systems, access rules, data-protection controls and AI capabilities is safe and useful for our institution?”

GDPR: the first rule is to give AI no more data than it actually needs

The General Data Protection Regulation requires personal data to be processed for specific and legitimate purposes, limited to what is necessary, kept accurate, retained no longer than needed and protected by appropriate technical and organisational measures. For a school, convenience is not by itself a sufficient reason to copy names, national identification numbers, addresses, health information, special educational needs data, grades or family circumstances into an AI tool.

A practical safety question should come first: Can this task be completed without identifiable personal data? In many cases, the answer is yes. Real names can be replaced with roles or pseudonymous identifiers. Instead of uploading a complete document, only the relevant section can be used. Instead of a public AI tool, the institution may choose an approved environment with appropriate contractual, technical and organisational controls.

Where a new technology and a specific type of processing are likely to create a high risk to people’s rights and freedoms, GDPR provides for a Data Protection Impact Assessment. The concrete assessment should be made by the institution, with the involvement of its Data Protection Officer where applicable. This article provides an educational framework, not institution-specific legal advice.

The EU AI Act adds a second question: what exactly are we using AI for?

The EU AI Act does not treat all uses of artificial intelligence in the same way. An assistant that drafts an administrative text is very different from a system that influences a student’s educational trajectory. Annex III includes education-related use cases such as AI systems used for admission or access, evaluation of learning outcomes, determining an appropriate educational level and monitoring prohibited behaviour during tests. Depending on the specific system and use, these applications may fall within the high-risk regime.

Article 4 of the AI Act also places emphasis on AI literacy. Organisations that deploy AI systems must take measures to ensure an appropriate level of AI literacy among staff and other persons dealing with AI systems on their behalf, taking into account their knowledge, experience and the context of use. In practice, staff training is no longer just a technical bonus; it is part of responsible institutional adoption.

Three zones for AI use: green, controlled and stop/high-risk

What does a personalised AI system for a school or kindergarten look like?

Personalisation should not begin with “upload all our documents.” It begins with architecture. First, the institution defines roles — school leader, administration, class teacher, teacher, accountant and other staff. Next, it defines recurring tasks, approved templates, trusted regulatory sources and verification rules. Only then should the institution build an AI assistant or a set of specialised AI workflows.

A well-designed system may know which fields belong in an internal form, which template is used for a specific type of communication and which official source should be consulted. It should not, however, independently alter official records, sign on behalf of a staff member or make final decisions affecting the rights of a student, parent or employee.

Professional training now needs to include AI literacy

Creativity Ltd.’s programme “Electronic Documentation in Schools and Kindergartens” — 32 academic hours, 2 qualification credits was created before the widespread adoption of generative AI, but the subject is continuously updated to reflect the real digital environment. The programme covers electronic documents, electronic signing, the legal and regulatory framework, storage and distribution of electronic materials, electronic security and personal-data protection.

The current 2026 approach naturally extends this foundation with practical AI work: secure document protocols, specialised institutional assistants, rules for permitted and prohibited data, verification of AI output, the difference between public AI and a controlled organisational environment, and adaptation to the specific processes of the school or kindergarten. The objective is not simply to “use AI,” but to build a repeatable, auditable and responsible method of work.