Which AI tools have European universities approved? A sourced overview (2026)

We read the official IT and policy pages of 35 universities in 14 European countries to find out which generative AI tools they provide or approve for staff and students, and what conditions come with them. Every row below links to the university's own page, read on 7 October 2026.

Published 7 October 2026 · Sources checked 7 October 2026

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers AI research assistance with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

1. How we checked

On 7 October 2026 we searched for and read the official pages of universities in 14 European countries that list generative AI tools for staff or students: IT service catalogues, helpdesk instructions, AI policy hubs, data protection guidance and, where nothing else was public, university news items announcing a tool. We only included a university when one of its own pages named at least one tool and we could read that page on the check date. Where a page is a news item or older than a year, the table says so, because tool offers change quickly.

We recorded three things for each university: the tools it provides, approves or recommends; the conditions attached (login, data classification, personal data, licence cost, who has access); and any tools it explicitly rules out. Short quotations are verbatim from the page text. Everything else is our paraphrase. We did not log in to any intranet, so internal guidance behind single sign-on is not covered. Where we could not find something on a public page, we say "not stated on the page", which is not the same as "not offered".

The sample is a convenience sample weighted towards the Nordic countries, the Netherlands, Belgium, the UK and Ireland, plus German-speaking, French and Spanish universities where we could find a readable public page. We tried several other universities and left them out when the relevant page was blocked to automated reading, sat behind a login, or did not name any tools.

Tool offers change from term to term. A tool marked "pilot" or "in evaluation" here may be live or withdrawn by the time you read this. Always check your own institution's current page.

2. The overview: 35 universities

The table lists what each university's public page said on 7 October 2026. "Copilot Chat" means Microsoft's chat assistant used with a university Microsoft 365 account (enterprise or commercial data protection), not the consumer version signed in with a private account.

3. Tool by tool: counts in this sample

The second view counts how many of the 35 universities name each tool or type of tool as provided, approved or recommended. A university counts once per row even if it offers several versions. Tools that are only "allowed for open data", in evaluation, or listed as a general example do not count. These are counts within this sample of 35, chosen as described in the method; they are not percentages of European universities.

Two further points sit outside the counts. Zurich lists ChatGPT and Claude as under evaluation, and Oxford says it is in discussions about Claude. Vienna permits ChatGPT Business or Enterprise for employees under conditions but provides no central licences.

4. Five patterns

Copilot arrives through the existing Microsoft 365 contract

The most common route is not a new procurement at all. Most of the 25 universities that name Copilot Chat present it as part of the Microsoft 365 account staff and students already have: Trinity says all staff and students have it as part of Microsoft 365, DTU points to its existing data processing agreement with Microsoft, and Uppsala and Stockholm explain that the university login is what switches on data protection. Several pages teach users to look for the green shield that marks the enterprise version, and warn that the consumer version reached with a private account is a different service.

The paid tier is treated more cautiously. Eight universities offer Microsoft 365 Copilot, usually on application and paid by the unit: Stockholm quotes about SEK 200 per user per month, Oxford GBP 26, and DTU adds manager approval and a mandatory e-learning course. Radboud goes the other way and does not offer it, citing SURF's advice based on its latest DPIA and noting that "not all risks have yet been sufficiently mitigated". For more on what Microsoft's documentation says about each plan, see our Microsoft Copilot GDPR check.

Own platforms and shared sector services

A second group builds or shares its own interface. Twelve universities run a chat platform of their own, usually a web front end over models reached through Azure OpenAI or another cloud provider, sometimes with open-weight models on their own hardware. Edinburgh's ELM runs OpenAI models under a zero data retention agreement and added a locally hosted Llama model. Utrecht's UU AI-Chat, which the page says is based on Amsterdam's environment, offers models via Azure OpenAI and Mistral alongside open-weight models on SURF servers. Vienna's u:ai and Aalto's AI Assistant give each user a monthly cost budget.

Smaller institutions often use a sector service instead of building one. In Norway, OsloMet and NHH point to Sikt's KI-chat, and OsloMet also offers GPT UiO, which Oslo opens to other institutions. Marburg uses the GWDG KI-Cloud provided with KISSKI. In the Netherlands, SURF and Npuls run the EduGenAI pilot that Utrecht is testing. In France, UVSQ recommends RAGaRenn, built by Université de Rennes and hosted in a regional higher education data centre.

Personal and sensitive data: the same tool, different rules

The clearest finding is how differently universities draw the data line, even for the same product. Helsinki's instruction is blunt: "Personal data must not be processed in Copilot." It gives the reason that the model may be located outside the EU at the time of use, and steers internal data to its own CurreChat instead. Copenhagen, KTH, UCD, Mannheim, Marburg and NHH also tell users not to enter personal data into the AI tools they provide.

Others grade the rule by classification level. Stockholm University says that signing in "does not mean you are allowed to enter information with confidentiality level 3 or 4 into Copilot", because chat history is saved. Zurich publishes a table that approves each tool for named levels: Copilot Chat for public and internal data, Microsoft 365 Copilot up to confidential only if web search is switched off. KU Leuven reserves confidential and strictly confidential data for Copilot, while other tools may be used for non-confidential data.

A third group allows more. Aalto says: "You may use public, internal, and confidential data when chatting with the Aalto AI Assistant." It still excludes special category data. GPT UiO allows some models with red (confidential) data. UPV's guide says PoliGPT and Copilot "may contain personal or internal data". Cambridge goes furthest in one sense: its guidance names Copilot, Gemini and NotebookLM as the tools that should be used where personal data has to be processed, precisely because licensed versions come with contractual and technical safeguards.

Research data gets its own rules

Research data, and especially data about research participants, is singled out on several pages. Edinburgh's staff guidance says: "Do not use ELM with identifiable patient/clinical data or any identifiable research participant data." Imperial lets researchers request developer access to dAIsy, but says uploading private or confidential research data may require departmental approval, ethics review or a DPIA. NHH tells master's students that personal data collected for their thesis must never be shared with AI tools, and Zurich restricts its supercomputer GPU service to non-personal scientific data. Tartu's staff page lists materials from protected research among the data that should not go into AI applications. For the GDPR side of research use, see our guide to GDPR and AI tools in research.

Consumer tools: restricted rather than banned

Only a few pages name tools users must not use. NTNU's list of unapproved tools covers Grok and DeepSeek and states: "These tools must not be used for NTNU-related activities." Université Paris Cité's charter classes the public versions of ChatGPT, Gemini, Claude, Perplexity, DeepSeek and Copilot as not secured by the university. More often, consumer tools are allowed with public data only: NTNU approves ChatGPT, Claude, Gemini, NotebookLM and Perplexity for open (green) data, UPV allows ChatGPT, Gemini and Claude "only with published information", and Cambridge's guidance simply says: "Do not use free GenAI tools." Helsinki adds that anyone who uses a service the university does not provide does so as a private individual.

Two pages also attach conditions to the user rather than the tool. Mannheim requires a sufficient level of AI competence before staff or students use its AI systems, checked through a quiz. Vienna rules out u:ai for automated assessments and Marburg rules out its AI services for automated exam grading and personnel selection, both pointing at uses the EU AI Act treats with particular care (see our AI Act guide for universities).

5. What this means for your institution

Validemic's analysis

This section is our interpretation of the pattern above, not a summary of what any university says.

An "approved" list is only as useful as the data rule next to it. Almost every university in the sample approves Copilot Chat in some form, yet the permitted data ranges from public only to personal and internal. A list of tool names without a classification level per tool leaves staff to guess. Zurich's table and NTNU's green, yellow and red labels are the clearest formats we saw, because a user can answer "may I paste this?" from one page.

Plan tiers decide the answer. Universities consistently separate the enterprise version reached through the university account from the consumer version of the same brand. That matches what vendors' own documentation does: data processing agreements, training opt-outs and data location usually differ by plan. When a university approves "ChatGPT" or "Gemini", the approval only makes sense if it names the plan and the login route. Our GDPR checks for ChatGPT, Gemini and NotebookLM set out what each vendor's documents say per plan.

Own platforms shift the work, they do not remove it. A university-run interface gives control over login, logging and model choice, which is why several of them allow more sensitive data. But the underlying model still often runs at a cloud provider, and Innsbruck's page shows how individual features (web search, image generation, one model) can leave the EU even inside a protected instance. Each model and feature behind the interface needs its own entry in the record of processing and, where relevant, the DPIA.

Research tools are the gap. The pages we read focus on general chat assistants. Specialised research tools (literature search assistants, transcription, survey and writing tools) appear rarely, apart from library search tools such as Keenious and Scopus AI. Researchers use them anyway, so the assessment burden lands on departments and DPOs case by case. A short, published route for assessing these tools would close that gap faster than a longer approved list.

Dates matter. Several of the clearest pages are news items, some from 2024. If your institution's guidance is a news post, readers cannot tell whether it still applies. A dated, maintained page with a named owner is a small change that makes the rules easier to follow.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

6. How to run your own AI tool assessment

If you are deciding which AI tools your institution should approve, the universities above suggest a practical order of work:

1. Start from your data classification. Decide, per tool and per plan, which classes of data it may receive. Publish the answer next to the tool name, as Zurich and NTNU do.
2. Read the vendor's documents for the plan you will license. Check the data processing agreement, subprocessors, data location and training terms. Our DPA checker walks through the clauses that matter.
3. Screen for a DPIA. Tools that process personal data at scale, research participant data or student data usually need one. Use our DPIA screening tool for a first pass.
4. Check the AI Act angle. Uses such as grading, admissions or monitoring students carry specific obligations. Our AI Act checker for education and AI Act guide explain the categories.
5. Record and review. Add each approved tool and plan to your record of processing, set a review date, and watch for changes to the vendor's terms and subprocessors.

Our vendor assessment guide for universities covers each step in more detail, including the questions to send to a vendor.

7. Sources

All pages were read on 7 October 2026. Links open the university's own page.

1. University of Oxford, AI Competency Centre: GenAI tool features.
2. University of Cambridge, Information Compliance: Guidance for staff on the administrative use of generative AI.
3. University of Edinburgh, Information Services: ELM; Using generative AI in your work: guidance for staff; ELM FAQs.
4. Imperial College London, ICT: What is dAIsy?; Microsoft Copilot.
5. Uppsala University: AI tools for students.
6. Lund University, Unit for Educational Services: Copilot for employees at Lund University.
7. KTH: FAQ generative AI; AI service.
8. Stockholm University: AI resources at Stockholm University.
9. University of Helsinki, IT Helpdesk: Generative AI at the University.
10. Aalto University: Aalto AI Assistant.
11. Tampere Universities, Digital toolkit: What is Copilot?; Guidelines for using artificial intelligence.
12. University of Oslo: GPT UiO.
13. NTNU: AI tools.
14. OsloMet: AI tools at OsloMet.
15. NHH: Retningslinjer for bruk av KI-verktøy i forbindelse med masteroppgaven (Norwegian).
16. University of Copenhagen: Three guidelines and a new tool for using AI (8 May 2024).
17. DTU Inside: Choose your AI tool.
18. University of Amsterdam: UvA lanceert eigen AI Chat (Dutch, 28 August 2025).
19. Utrecht University: AI platforms at UU.
20. Radboud University: Copilot Chat enhanced with access to up-to-date web information (19 March 2026).
21. KU Leuven: Generative AI at KU Leuven.
22. UCLouvain: Recommended GenAI tools.
23. Ghent University: Copilot and other tools.
24. Trinity College Dublin, IT Services: Copilot Chat; Accessing Microsoft Copilot with your Microsoft 365 account.
25. University College Dublin, IT Services: AI features from UCD IT Services.
26. University of Zurich, Central IT: AI Tools and Services (updated 29 September 2026).
27. University of Vienna, ZID: AI services of the ZID; u:ai; Using ChatGPT in compliance with data protection regulations.
28. University of Innsbruck, ZID: Academic AI (German).
29. University of Tartu: AI at the University of Tartu: staff; New language model now available with University of Tartu account.
30. University of Mannheim: Freigegebene KI-Systeme und Nutzung von HAWKI (German).
31. University of Marburg, HRZ: KI-gestützte Dienste (GWDG KI-Cloud) (German).
32. Universitat Politècnica de València: Guide to the use of artificial intelligence services at the UPV.
33. Universidad Carlos III de Madrid, UC3M Digital: AI tools.
34. UVSQ: RAGaRenn, l'IA française au service des universités (French).
35. Université Paris Cité: Charte d'usage des systèmes d'intelligence artificielle générative (French, PDF).

8. About this page

This overview was compiled by Validemic on 7 October 2026. Every university page listed above was fetched and read on that date, and every quotation was checked against the page's text on the same day. The sample covers 35 universities in 14 countries (Austria, Belgium, Denmark, Estonia, Finland, France, Germany, Ireland, the Netherlands, Norway, Spain, Sweden, Switzerland and the United Kingdom) and does not claim to represent all European universities. We only read public pages; many universities publish fuller guidance on intranets behind single sign-on, so a missing detail here means it was not on the public page we read, not that it does not exist.

If you work at one of these universities and your offer has changed, or we have described it inaccurately, please contact us with the current page and we will correct the entry and note the change here. The same applies if your university publishes a list of approved AI tools that we missed and you would like it included in the next update. For a closer look at how Swedish universities guide generative AI use in research, see our Swedish-language survey of 18 universities.