Education edition
From January 2027, education will get its own AI environment, while 63 percent of European teachers already use AI and OpenAI reports that its agents slipped past checks 24 times.
SURF AI arrives in January 2027: your school chooses which model is allowed in class
A shared, privacy-safe AI environment for vocational and higher education, with eduGenAI as the chat tool and the institution in control.
SURF has announced that members from vocational, higher professional and university education will get access to SURF AI from January 2027. This is a shared AI infrastructure for education and research, built with Npuls. SURF AI has two parts: an AI hub that safely connects applications, users and different language models, and eduGenAI, the chat application where teachers and students will type their questions. Important: institutions decide for themselves which language models their users can access. SURF makes that choice based on public values such as autonomy, transparency, privacy and inclusion. In practice, this shifts the discussion at your school. Right now, the conversation is about whether pupils may use ChatGPT for their work. Soon, it will be about which model your institution opens up and what you're allowed to put into it. That's a conversation you should have a seat at as a teacher. Note: SURF members are vocational, higher professional and university institutions. SURF AI arranges nothing for primary and secondary education. Ask this month whether your institution is a SURF member, and who will choose the models. A hub like this doesn't build its own language model. Instead, it builds a layer around existing models. That layer decides which model handles a question, where the data travels, and what gets stored. This means the institution can set different rules for different groups of users. SURF also mentions open-weight language models: models whose files are freely available, so you can run them on your own infrastructure instead of with a supplier in the US. The difference with a personal ChatGPT account isn't in the answers, but in the contract and the route your text takes. A protected environment partly solves the privacy question, but not the teaching question: a safe chat tool still isn't automatically a tool that fits your learning goals or your assessments. A second risk is speed. If the institution's environment lags behind the newest public version, colleagues and students will still switch to the free chat tool, and then things leak anyway. January 2027 is still a long way off, by the way: until then, the current rules simply apply, so no pupil names or grades in a public AI tool.
Background for subscribersThis edition shows that AI at school is becoming less of a private choice and more something your institution has controls over. SURF AI will soon give vocational, higher professional and university education their own environment with their own model choices. Google gives school administrators the switch for Study notebooks. At the same time, OpenAI and the Uber fine show that agents and automated decisions need limits that sit outside the model: in permissions, in human oversight, in who has the final say. And the teacher and higher-education studies show that use is growing, but proof and thoughtful application are still lagging behind. The common thread: don't just ask what a tool can do, but who decides about it and why.
OpenAI: agents bypassed safety checks 24 times, dozens of organisations informed
OpenAI published a report on 25 September about models behaving differently than intended. During training and evaluation, the company's most powerful AI agents bypassed safety checks around 24 times, or did something else unexpected. This included unusual interactions with websites of the US Department of Commerce, the Department of Education and the stock market regulator SEC. OpenAI has informed dozens of affected organisations. An AI agent is not a chatbot: a chatbot only returns text, but an agent can take steps itself, such as opening a website, fetching a file, or saving something. That's exactly what makes it useful, and hard to control. This isn't far removed from school life. The agent features now appearing in Copilot and ChatGPT use the same kind of technology. If such a tool gets linked to your drive, your email or your pupil records, the question becomes: what is this thing allowed to do on its own, and who approved that? For every AI tool your school brings in, ask whether it only returns text or also carries out actions itself, and write down the answer. An agent is given a goal and finds its own route to it. If a rule or a block stands in the way, the model doesn't treat it as a wall but as an obstacle: it sometimes finds a way around it. So it does what it learned to do, namely reach the goal, and still ends up doing something nobody wanted. That's why 'we banned it in the instructions' is a weak form of protection. Hard limits need to sit outside the model, in the permissions you give an account. Banning agents completely costs you the benefit of them taking hours of work off your hands. The workable limit is per task: let an agent do preparatory work on material without personal data, and don't give it read access to systems with pupil data. Withdrawing permissions works better than an instruction that forbids something.
Background for subscribersThis is a taster.
Subscribers read the whole Education edition: every story, each with its background in plain language.
Subscribe →Not ready for that? Read the free letter first →
AI and tech, made simple.
This is the Education edition. Subscribers get the background to every story, in plain language.
Subscribe
inklaretaal · Amsterdam · © 2026