94% of students use AI and schools lack the basics

Ninety-four students out of a hundred use artificial intelligence at least occasionally and eighty-four use it to study. That comes from the national survey run by INDIRE and the School Innovation Festival on 5,342 lower and upper secondary students, presented on 4 September 2026. Which means the problem for Italian schools is no longer how to bring AI into the classroom. It is already there, it came in through the students' door, and it asked nobody for permission.

The real problem sits one level below. A school can own every tool on the market and still be unable to govern them, because what is needed first is not software. It is five organisational conditions that the EduNext 2026 report from the Look4ward Observatory (Luiss and Intesa Sanpaolo) gathers into one construct, Systemic Readiness. We have already described them for organisations in general in The 5 preconditions nobody talks about. Here we take them inside the school, one by one, because in a school their absence does not only produce inefficiency. It produces liability.

AI has already entered the classroom through the students' door. Data from INDIRE and the School Innovation Festival, national survey of 5,342 students (2026).

A school is not a user, it is a deployer

There is a difference almost no staff meeting has brought into focus. When a company gets AI adoption wrong it wastes money. When a school gets it wrong it processes children's data without a solid basis, and it does so wearing a precise legal coat.

In the language of the AI Act, an organisation using an AI system under its own authority is a deployer, with its own duties set out in article 26. On top of that, when the system falls under the high-risk category of Annex III, and education falls under it in more than one place, article 27 requires public bodies to run a fundamental rights impact assessment. State schools are public bodies. The substantive high-risk duties were pushed back to 2 December 2027 by Regulation (EU) 2026/1744, so there is time, but time is for getting ready rather than for waiting.

Then there is the Italian layer. The guidelines annexed to ministerial decree 166 of 9 August 2025 ask schools for an internal team, the involvement of the data protection officer, updated privacy notices, suppliers holding ISO/IEC 27001 certification and AgID qualification, a map of their pilots on the UNICA platform, and a cyclical five-phase process. Law 132 of 23 September 2025 adds parental consent for AI access by children under 14.

Here is the point. All of this is Systemic Readiness written in regulatory language. The five dimensions are not management theory borrowed by schools, they are an operational description of what a school needs in place to be able to answer an inspector, a parent and itself.

Each dimension becomes a question the school must answer with a document. Retoria analysis of EduNext 2026, chapter 2.2.

1. Data in order, which in a school means knowing what leaves

For a company, data infrastructure means the quality of internal archives. For a school the question flips, because the issue is not which data enter the school's models. It is which data leave the building every time somebody pastes something into a chatbot.

It turns on a detail almost no school policy names, namely whether a teacher is using a personal account or an institutional one. With the first, in many services the content feeds the supplier's training. With the second, normally it does not. It is the same thing the report describes for companies in the most quoted line of the chapter.

«We are not ready because our data are not in order.»

The report also notes that AI enters where it is easy rather than where it matters. In Italy the leading area of application is marketing and sales, named by roughly one company in three, followed by administrative processes at 25.7% and research and innovation at 20%, while logistics stops at 6.1% (Istat, 2025). Schools do exactly the same. AI enters the circular letter, the test prepared the night before, the quick translation, in other words everywhere a browser is enough and no formal decision is needed. It does not enter where a collegial decision would be required, because that is the uncomfortable work.

Putting data in order, for a school, means three concrete things. You need a classification, for instance a green class that may leave, an amber class that leaves only anonymised and a red class that never leaves. You need the list of approved tools, actually attached and not merely promised, because a policy that makes a non existent list binding puts the whole staff in breach from day one. And you need the act of anonymising first, which seems obvious and almost nobody does.

2. Culture and mindset, which in a school means stopping the hiding

The second dimension is people's capacity to move through uncertainty instead of stiffening. In schools this has a shape of its own, and the report calls it by its technical name, habitus.

A school ban does not remove the use. It teaches students to hide it. A young person learns concealment at school and carries it unchanged into a workplace five years later, where it becomes what the report calls shadow AI, a widespread but submerged use that nobody can govern or put to work. The director of a public digital transformation agency puts it plainly.

«If a young person has the shadow AI mindset because at school they were afraid to use it, in the organisation they are afraid to use it. We end up with a widespread but submerged use that we can neither govern nor put to work.»

The INDIRE figures show where that road leads. 76% of students trust the answers AI gives them, but only 62% check them against other sources. And there is a trust paradox worth looking at closely, because those who trust it completely and those who do not trust it at all both verify less than the people in between. Verification does not come from suspicion. It comes from the habit of measured use, and that is something you teach. On top of that, 53% say they have turned to AI at least once to vent, girls at nearly twice the rate of boys, and that is a figure a school cannot pretend not to have read.

The most radical proposal in the report is also the simplest, namely allowing AI tools during assessment and moving the object of assessment from the answer to the process. If you grade the finished product, the only defence is a ban, and bans do not hold. If you grade the decisions taken along the way, AI stops being a shortcut and goes back to being a tool.

3. Organisational design, meaning who does what, by name

Here comes the hardest figure in the whole report for anyone working in schools. The action research project «ImparIAmo a scuola con l'IA», coordinated by Centro Studi Impara Digitale, involved 112 class councils. 53 of them reached the end, which is 47%. The authors read that number as a composite indicator, because it measures not only technical and organisational barriers but real differentials in AI literacy and professional self-efficacy among the teachers involved.

Barely more than one school project in two making it to the finish line is not a tools problem. It is a design problem.

Where the organisation stalls, and what it had decided to aim at. Data from EduNext 2026, chapter 5, ImparIAmo case.

The ministerial guidelines ask for an internal team, and schools almost always write one down. The catch is that they write it by function, namely the head teacher, the digital coordinator, the referent, the data protection officer. A function without a name, a surname and a contact is a procedure that never starts, because when the real question arrives nobody knows who to write to. That is the lesson we carry into every programme, and it does not come from a book. It comes from the policies we read.

4. Governance, which in a school is already a legal duty

The fourth dimension in the report covers responsible AI frameworks, accountability for decisions, and what the authors call the double responsibility, for adoption and equally for non adoption. In companies that is a strategic choice. In a school it is a compliance item with a date on it.

At its heart is human oversight. A system may suggest, analyse and sort, but pedagogical, assessment and disciplinary decisions stay with the teacher, and must demonstrably stay there. It is the same thing article 22 of the GDPR says about automated decisions and the right to human review, and the same thing the report describes when it separates a human presence that rubber stamps from one that judges.

There is a part of governance no rule imposes on you, though, and it is the most important of all, namely deciding what you are using AI for. In the ImparIAmo case critical thinking appears as a stated learning goal in only 3% of cases and problem solving in 12%. In the same project ChatGPT and Gemini are named as the main triggers of students' critical thinking. In other words tools that demand critical evaluation of their output are being used in a setting where that very skill was almost never put among the goals. That is not the students' contradiction. It is a choice made by adults, and it can be reversed.

5. Adaptive learning speed, meaning the review nobody puts in the diary

The fifth dimension is the one the report calls its most original contribution, namely the ability to compress the cycle running from signal to decision, to execution, to learning. In a school it has a plain and merciless translation, the date of the next review.

The dates a school needs in its calendar. Retoria analysis of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, decree 166 of 9 August 2025 and law 132 of 23 September 2025.

Look at a school AI policy. You will nearly always find the resolution number. You will nearly never find the version, the date it took effect and the date the document will be read again. A text without a review ages on its own, and on this subject it ages fast, given that the AI Act dates have already moved once. The five phases in the ministerial decree are described as cyclical for exactly this reason, but the cycle only exists if somebody puts it in the diary.

How well does this framework hold up

It is worth asking whether Systemic Readiness is a solid construct or a nice frame. The honest answer is that it holds, with one limit the authors state themselves.

The construct comes from 32 in depth interviews with senior figures, conducted between December 2025 and April 2026 using Constructivist Grounded Theory, and the authors read it as a specification of the dynamic capabilities of Teece, Pisano and Shuen (1997) for the AI era. They also write that it is not yet validated as a stable category in the management literature, and that caution belongs here too.

That said, the convergence with existing research is striking. Jöhnk, Weißert and Wyrtki interviewed 25 AI experts and likewise arrived at five categories of organisational readiness, published in 2021 in Business and Information Systems Engineering. The RAND Corporation, working from 65 interviews with data scientists and engineers, identifies five root causes of AI project failure, and four out of five are not technological.

The missing piece in both schemes is supplied by Bryan Weiner, in a theory of organisational readiness for change published in 2009 in Implementation Science. His argument is that readiness is not a property of the person in charge, it is a shared psychological state, made of a shared resolve to do the thing and a shared belief in being collectively able to. Where members of an organisation see it very differently from one another, readiness simply is not there, however convinced the leader may be.

Translated into a school, that is the most important sentence in this article. A readiness that lives in the head teacher's mind and the digital coordinator's is not institutional readiness. It is a two person project, and the 47% in ImparIAmo is exactly what happens when the two are confused.

Where you actually start

Before buying anything, and before writing the policy, it is worth answering five questions. You do not need consultants for that, you need an hour of staff meeting and the honesty to write «we do not know» where you do not know.

• Which data leave the school today, through which accounts, and who checked it.
• How many teachers already use AI without saying so, and what happens to the ones who say so.
• Who is the person, by name and contact, you write to when a doubt about a tool comes up.
• Which skill are we using AI for, and where is that written down.
• When do we read all of this again, and who calls that meeting.

If even one answer is missing, the problem is not the tool. It is the precondition.

This is the work we do with schools, namely starting from the foundations rather than from the catalogue. If you want to know where your school stands, write to us for an AI readiness assessment, see how we work, and if the regulatory picture is what interests you read what Italy's AI decree for schools actually provides.

Methodological note

The five dimensions of Systemic Readiness, the anonymised quotes from senior figures and the ImparIAmo case data come from the EduNext 2026 report, from chapter 2.2 and chapter 5 respectively. The construct is built on 32 in depth interviews conducted between December 2025 and April 2026 using Constructivist Grounded Theory, and the authors state that it is not yet validated as a stable category in the management literature. Figure 2.2 of the report lists its source as analysis of Istat data, but the five dimensions derive from the qualitative analysis of the interviews rather than from a statistical survey, so they are not attributed to Istat here. The Istat figures cited in this article concern the business areas where AI was applied in 2025 and are taken from chapter 1 of the same report.

The figures on student use of AI come from the national survey by INDIRE and the School Innovation Festival on 5,342 lower and upper secondary students, collected between March and June 2026 and presented on 4 September 2026. The authors note that this is a convenience sample and not statistically representative, so the percentages describe the students who answered rather than the whole school population.

This article is not legal advice. The rules cited must be read in the version in force on the day you apply them, and on this subject the deadlines have already moved once.

Sources

• Look4ward Observatory, Luiss Research Center for Strategic Change "Franco Fontana" and Intesa Sanpaolo (2026). EDUNext: Nuovi scenari per l'Education e le competenze nell'era dell'IA. Licensed CC BY 4.0.
• INDIRE and Festival dell'Innovazione Scolastica (2026). National survey on the use of artificial intelligence among students.
• Italian Ministry of Education and Merit. Guidelines for the introduction of Artificial Intelligence in schools, annexed to ministerial decree 166 of 9 August 2025.
• Regulation (EU) 2024/1689 (AI Act), articles 26 and 27, as amended by Regulation (EU) 2026/1744.
• Italian law 132 of 23 September 2025, article 4 paragraph 4.
• Teece, D. J., Pisano, G. and Shuen, A. (1997). Dynamic capabilities and strategic management. Strategic Management Journal, 18(7), 509-533.
• Jöhnk, J., Weißert, M. and Wyrtki, K. (2021). Ready or Not, AI Comes: An Interview Study of Organizational AI Readiness Factors. Business and Information Systems Engineering, 63(1), 5-20.
• Weiner, B. J. (2009). A theory of organizational readiness for change. Implementation Science, 4, 67.
• Ryseff, J., De Bruhl, B. F. and Newberry, S. J. (2024). The Root Causes of Failure for Artificial Intelligence Projects and How They Can Succeed. RAND Corporation.

Data and analysis from the EduNext report are reproduced under a CC BY 4.0 licence. Required citation: Osservatorio Look4ward, Luiss Research Center for Strategic Change "Franco Fontana" & Intesa Sanpaolo (2026). EDUNext: Nuovi scenari per l'Education e le competenze nell'era dell'IA.