evidoria

← Back to browse

Good practice Imported

EduGenAI — SURF and Npuls' Privacy-by-Design Generative-AI Platform for Dutch Education, DPIA-Cleared Before National Rollout

Netherlands · Utrecht · See the Netherlands profile · See the Utrecht profile

Evidence: Descriptive / self-reported Top 73% 40/100 · Ask Evidence Copilot about this practice

SURF and Npuls built EduGenAI, a sovereign, pseudonymised gateway to open-source and commercial LLMs (OpenAI, Llama, Mistral, Claude) for Dutch mbo/hbo/wo institutions. An independent DPIA published August 2025 found only 12 low residual risks before the pilot began.

12 risks
DPIA residual risks identified, all rated low (Aug 2025)

Details

Maturity
Pilot
Promoter
SURF / Npuls
Period
DPIA published 8 Aug 2025; pilot runs through the 2025-2026 academic year
Keywords
generative AI, data protection impact assessment, national AI infrastructure, higher and vocational education, privacy by design

Context

SURF (the Dutch higher-education ICT cooperative) and the Npuls programme built EduGenAI, a national gateway routing pseudonymised access to open-source and commercial LLMs (OpenAI, Llama, Mistral, Claude) for Dutch mbo/hbo/wo institutions, hosted via SURF's Amsterdam (Watergraafsmeer) datacentre for open-source models.

Results

An independent Data Protection Impact Assessment by Privacy Company (published 8 August 2025) identified 12 residual risks, all assessed as low after mitigations already built into the architecture (pseudonymisation, EU-hosted infrastructure, and exclusion of high-risk uses such as automated assessment or fraud detection). The pilot runs through the 2025-2026 academic year with institutions including the University of Twente; no learning or equity outcomes have yet been measured.

Conclusions

SURF and Npuls plan to develop EduGenAI into a standing national service from late 2026 if the pilot succeeds, making this a rare example of privacy governance built in before deployment rather than imposed after a violation.

Implementation
Indicative cost
High (€500k–€5M) — National platform build (SURF datacentre routing plus pseudonymisation layer for commercial APIs) funded via Npuls pooled institutional funding; no specific budget figure published.
Time to results
Medium (1–3 years) — DPIA published Aug 2025; pilot runs through the 2025-2026 academic year; planned transition to a standing national service from late 2026.
Staffing & skills
SURF (Dutch higher-education ICT cooperative) infrastructure and engineering team, Npuls programme, pooling funding and coordination across Dutch mbo/hbo/wo institutions, Privacy Company, commissioned as independent DPIA assessor

Conditions for success

  • Pseudonymisation of requests sent to commercial model providers so prompts cannot be linked to individual users
  • EU-hosted infrastructure for open-source models via SURF's own datacentre
  • Contractual exclusion of high-risk uses (automated assessment, fraud detection) from the platform's scope
  • Independent DPIA commissioned and published before rollout rather than after

Common failure modes

  • Pilot learning and equity outcomes not yet measured, so the effectiveness case remains unproven
  • Current scope excludes higher-risk use cases, limiting near-term utility

Where it fits

Governance type
national sector-cooperative (SURF/Npuls pooling public HE institutions)
Scale
national (Dutch mbo/hbo/wo)
Income level
high-income

Commonly funded by

National / regional programmes Digital Europe Programme

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Similar practices you may find useful