The school is the controller; Dify and the model provider are processors, outside the EU
No data processing agreement (sandbox) = no personal data goes in
Personal data after all: a student's message to the teacher (Study coach). Then: legal basis, impact assessment, retention period for the logs
EU AI Act
Art. 4: AI literacy mandatory for whoever uses AI (since Feb 2025). This workshop is such a measure
Prohibited: emotion recognition in education
High risk: admission, assessing learning outcomes, proctoring. Our apps decide nothing about people; a coach that assesses students would
Art. 50: a chatbot says it is AI
Rule of thumb: as soon as an app decides or records something about a person, the question changes from "does it work?" to "is it allowed, and who is responsible?" State of play September 2026; check your national assessment framework for the current picture.
Workshop AI Agents with Dify · LeX Consultancy · CC BY-SA 4.0
