When a university adopts an AI policy today, the content almost always revolves around the same questions: May students use ChatGPT for assignments? How does the examination office detect AI-generated submissions? What rules apply to oral exams? That focus is understandable — teaching and academic integrity are the core mission of any higher education institution. Yet a comprehensive analysis by the German Higher Education Forum on Digitisation (HFD) reveals that an entire domain has been systematically overlooked: university administration.

30 Policies, 16 Federal States — and a Conspicuous Gap

In May 2026, the HFD published its “Guidelines Check 2026” — a comparative analysis of 30 officially published AI guidelines drawn from all 16 German federal states. The study, produced by the CHE Centre for Higher Education Development, paints a nuanced picture of progress: AI policies are becoming more common, more detailed, and more legally aware. But a pattern stands out.

The HFD describes AI guidelines as “enabling documents”: texts that do not merely regulate, but also contextualise and inspire. Well-crafted guidelines, the analysis argues, give university members orientation in an environment that is changing technologically and legally faster than any statute can keep pace with.

Among the identified blind spots — alongside accessibility and ecological resource consumption — university administration is explicitly named. Almost all documents examined address teaching staff and students. Administrative processes such as campus management, examination organisation, document management, or secretarial work barely feature.

Why This Gap Matters

Administration is the backbone of any university. Without well-functioning processes in examination management, enrolment, or data governance, even the most innovative teaching cannot run smoothly. And it is precisely here that AI holds significant potential — but also significant risk when no clear rules exist.

Consider examination registration: in many institutions, staff manually verify whether a student meets the prerequisites for a given exam — a time-consuming and error-prone process. AI-assisted systems can perform these checks automatically and consistently. But who bears responsibility when the algorithm errs? Which data may the system access? How long are decision logs retained?

Or take document management: universities handle thousands of sensitive records — transcripts, applications, examination papers. AI can help classify documents, monitor deadlines, and reduce processing times. But without clear guidelines, key questions remain open: Which AI tools are GDPR-compliant? Who is authorised to deploy these systems, and who is not?

The silence of current guidelines on these issues is not a niche problem. It means that administrative staff make consequential decisions every day without institutional backing — creating legal uncertainty and blocking meaningful efficiency gains.

The EU AI Act Raises the Stakes

The HFD analysis also points to the EU AI Act, which has imposed binding requirements on AI deployment since 2025. Universities using AI in administration must classify the relevant systems, document their use, and in certain cases implement specific safeguards. Institutions that fail to address this operate in a regulatory grey zone.

Systems that automatically decide on admissions or examination eligibility may fall under the AI Act’s “high-risk” profile — with corresponding documentation and transparency obligations. An AI policy that excludes administration provides no guidance here.

What Universities Should Do Now

The HFD’s report concludes with a call for AI guidelines to be designed dynamically — not as static documents, but as living frameworks that evolve alongside technological development. This applies all the more to administration.

In practical terms: universities should expand their existing guidelines with a dedicated section on AI in administration. This section should define which processes may be AI-supported, which data protection and transparency requirements apply, and how staff will be qualified to work with AI tools.

Campus management systems such as TraiNex — which digitally map examination organisation, attendance tracking, and document management — can play a structuring role in this context. They establish the database foundation on which AI can operate sensibly and compliantly, provided the institutional framework is in place. TraiNex goes further: it can selectively anonymise data and uses GDPR-compliant AI models integrated directly into its processes, ensuring that sensitive data never leaves the controlled environment of the campus management system.

Conclusion

The Higher Education Forum on Digitisation has delivered an important stocktaking with its Guidelines Check 2026. The finding is clear: German higher education has made progress in strategic AI integration over the past two years — but administration has been left behind. It is time to correct that.

The pattern is not new. An empirical survey conducted in 2023 as part of a publication on AI maturity already showed that teaching is penetrated by AI significantly faster than administration. In the AI Maturity Matrix for Higher Education, many institutions are still best described as “AI Teaching Experimenters” — universities that teach about AI use. Attaining the status of “AI Process Professional” — an institution that has systematically integrated AI into administrative processes — remains the exception.

→ Workshop materials on the AI Maturity Matrix — freely available

→ Full HFD report: “AI Guidelines in Check 2026” (in German)

From 2 August 2026, further key provisions of the EU AI Act apply. Does this affect us as a university? Do we now need to have our AI tools reviewed? What happens if we do nothing? The short answer: it very much depends on what you do with AI. The longer answer is here.

What Applies from 2 August 2026?

Anyone who interacts with an AI system must in principle be able to recognise that they are dealing with AI. A chatbot for students or a digital assistant should therefore identify itself clearly as an AI system at the latest at the beginning of the conversation – unless this is already obvious.

For universities, this means above all:

• Clearly label AI chatbots,
• Do not present AI-generated media as authentic recordings,
• Define responsibilities for AI systems in use,
• Document AI deployment in a traceable manner.

AI Literacy Remains Mandatory

Since February 2025, institutions have been required to offer measures to promote the AI competence of their staff. From August 2026, compliance with this obligation can be more strictly monitored.

A specific certificate is not required. However, the following are advisable:

• Internal rules for ChatGPT and other AI tools,
• Training on data protection, hallucinations and confidential data,
• Special briefings for sensitive areas such as the examinations office, admissions and HR,
• Documentation of the measures offered.
• TraiNex supports you with the e-tutorial “AI at the University in 10 Chapters”. You can store this directly in TraiNex for teaching staff and administrative employees, have them complete it and automatically document the evidence. Contact us.

Are Students Affected?

When using generally available AI tools privately, students are normally neither providers nor operators within the meaning of the AI Act. They are, however, protected as data subjects. If a university uses AI for admissions, examination assessment or examination monitoring, obligations arise for the university.

What Applies to Teaching Staff?

Teaching staff are likewise neither providers nor operators within the meaning of the AI Act. However, they must comply with the university’s requirements, data protection law, copyright law and examination regulations. In order to assess the use of AI in these areas, participation in further training is necessary.

How TraiNex Classifies AI Functions

At TraiNex, we assess every AI function based on its specific purpose and impact.

AI-supported search functions, text suggestions, summaries and general chatbots assist users without themselves making decisions about admissions, grades or sanctions. These risk classes are largely permitted without issue.

The picture may look different when an AI result is used directly for consequential decisions. An automatic evaluation of attendance data, for example, is to be assessed differently if examination eligibility is derived from it without further review.

That is why we specifically examine:

• Purpose and data used,
• Impact on students and staff,
• Degree of automation,
• Human control options,
• Logging and traceability,
• Data protection and IT security.

What Applies to AI Agents?

AI agents do not form a separate risk category in the AI Act. Here too, what matters is which tasks they take on.

An agent that prepares documents, transfers information or proposes changes for approval is to be assessed differently from an agent that independently rejects admissions, changes grades or sanctions individuals. The latter would be too autonomous and too risky under the AI Act. To achieve an acceptable and permitted risk class, at minimum human approval would be mandatory.

At TraiNex AI agents, we therefore rely on:

• clearly defined areas of responsibility,
• graduated access rights,
• complete logging,
• human approvals for consequential actions,
• the ability to stop or reverse actions,
• restriction of AI autonomy.
  See waas.campus-management-system.de

What Universities Should Do Now

Universities and educational institutions should now:

1. Record the AI systems they use,
2. Document their specific purposes of use,
3. Correctly label AI chatbots and generated content,
4. Offer staff appropriate training and guidelines,
5. Particularly scrutinise applications that influence admissions, examinations or HR decisions.

Conclusion

From 2 August 2026, transparency, labelling and documented accountability will become more important for universities above all. Next milestone: the comprehensive high-risk requirements for the education sector apply from 2 December 2027.