Sixty emails that read like one person wrote them.
The legal position for emailing EU schools, who to write to in what order, fourteen templates you can send today, and the small number of things that reliably get a reply from someone who receives forty pitches a week.
Legal first, and do not skip this
You are about to email named individuals at institutions across the EU about a compliance product. Getting this wrong while selling regulatory compliance would be professionally fatal in a sector where everyone talks to everyone.
Two laws apply and people routinely forget the second. GDPR governs whether you may process the personal data; the ePrivacy Directive governs whether you may send the message at all — and each member state transposed it differently.
Legitimate interest is a valid basis
Article 6(1)(f) permits processing where you have a genuine business reason that does not override the individual's rights, and Recital 47 explicitly recognises direct marketing as capable of being a legitimate interest.
You must document a Legitimate Interest Assessment covering purpose, necessity and balance. It is not strictly required by law, but without one you lose the argument by default if anyone complains.
This can override layer one
National implementations differ sharply on whether unsolicited B2B email needs prior consent. France is permissive for profession-related outreach; Germany is consent-heavy and commonly enforced strictly; several others sit in between.
You cannot treat the EU as one jurisdiction. An email that is fine in one member state may not be in another.
Your Legitimate Interest Assessment, written once
LEGITIMATE INTEREST ASSESSMENT — school outreach
Controller: [YOUR NAME / PRACTICE] · Date: [DATE] · Review: [DATE]
1. PURPOSE TEST — is there a legitimate interest?
Yes. Schools operating in the EU are subject to a legal duty under Article 4
of Regulation (EU) 2024/1689, enforceable since 2 August 2026. I provide a
service that helps them meet it. Informing the specific individual whose
professional role covers this duty is a legitimate commercial interest and
also serves the recipient's own compliance interest.
2. NECESSITY TEST — is email necessary and proportionate?
Yes. The recipients are named post-holders at institutions with no public
procurement route for services of this size. Email to a professional address
is the least intrusive means of making contact. Telephone would be more
intrusive; postal mail slower and no less a processing operation.
3. BALANCING TEST — do their rights override my interest?
No, on these facts:
· Contacted in a strictly professional capacity, at a work address
· Subject matter is directly relevant to their published job role
· No special category data is processed
· Data sourced only from the school's own public website
· Volume is low (max 15 per week) and non-repetitive
· Single-click opt-out honoured immediately and permanently
· Suppression list retained indefinitely to prevent re-contact
· Reasonable expectation: senior school staff routinely receive
relevant vendor and CPD outreach
4. SAFEGUARDS APPLIED
· Role-relevant targeting only — no blanket sends to all staff
· Source and date recorded for every contact
· Privacy notice linked in every message
· No purchased or scraped lists
· Country check performed before sending (see Part 2)
· Maximum four touches, then permanent suppression
5. CONCLUSION
Legitimate interest under Art. 6(1)(f) is available for B2B outreach to
named post-holders in permissive jurisdictions. For stricter jurisdictions
I will rely on prior contact, referral, or inbound interest instead.
Signed: [NAME] Date: [DATE]
Every email must contain these five
Your identity
Real name, real practice name. No pseudonyms, no fake "team".
Physical address
A real postal address in the footer. Yes, even for a sole trader.
Working opt-out
One line, one click or one reply. Honoured within 24 hours, permanently.
Privacy notice link
A real page saying what you hold, why, and how to object.
Source, on request
If they ask "how did you get my email", you need a source and a date. Instantly.
The three rules that keep you safe
Never buy or scrape a list. Source every contact from the school's own public website and record the URL and date. This is both the compliance position and, as Vol. 01 argues, the thing that makes the emails work.
Never email a personal address. Work addresses only, for named post-holders whose published role covers this subject. No teacher's private Gmail, ever.
Verify before you send. Data accuracy is itself an obligation, and high bounce rates destroy deliverability at the same time.
Not legal advice
This is a practitioner's summary, not a legal opinion. Fines in this area are real and have been issued against small organisations, not only large ones. If you scale beyond a few hundred contacts a year, or into Germany or other strict jurisdictions, get the LIA and your sending practice reviewed by a data protection lawyer. The cost is trivial against the reputational exposure of a compliance consultant being found non-compliant.
Country map
Check the column before you write the email. If you would rather not maintain this, default every send to the strictest standard you serve — you will lose some volume and gain complete peace of mind.
| Market | B2B cold email | Practical approach |
|---|---|---|
| PortugalHome market | Verify locally | Confirm the national transposition with a local adviser before running any volume. It is your home jurisdiction and the one most likely to hear about you, so be conservative here regardless. |
| France | Permissive for B2B | Generally workable for profession-related outreach to corporate addresses under a documented legitimate interest. |
| Netherlands | Relatively permissive | Corporate addresses, role-relevant subject, clean opt-out. |
| Spain | Cautious | The regulator has issued a large volume of marketing-related fines. Prefer warm introductions and inbound. Cold is possible but keep volume very low and documentation immaculate. |
| Italy | Cautious | Treated as stricter for unsolicited commercial email. Lead with referral and content rather than cold. |
| Germany | Effectively consent-required | Do not run cold sequences here. Reach German international schools through associations, conference contact, referrals and inbound only. |
| Poland | Consent typically expected | Same approach as Germany. |
| UKPost-Brexit, still relevant | Corporate subscribers exempt | Corporate subscribers sit outside the consent rule for marketing email. Comfortable market for cold B2B, and full of international schools. |
The simplifying decision
Start with Portugal warm, the UK cold, and France cold. That is a large enough pool of international schools to fill a year of capacity at two engagements a month. Add Spain and Italy through referral and content once Vol. 02 is producing inbound. Leave Germany and Poland to inbound entirely.
This is not a limitation. It is what a one-person practice with a teaching job should be doing anyway.
Which door to knock on
One person per school, first. Emailing three people at the same school in the same week is the fastest way to look like software.
| Recipient | Order | Why, and what they need to hear |
|---|---|---|
| Head of Digital Learningor Director of Technology, Head of Computing | First, always | Already knows this is a gap. Has probably raised it and been deprioritised. Your email is ammunition for an argument they are already having. Highest reply rate by a distance. |
| Head of School / Principal | Second, day 12 | Only if the first door is silent. Shorter email, risk framing, no detail. They forward rather than reply, which is a win. |
| DP Coordinator / Head of Secondary | Alternative angle | Use where the school has a visible academic integrity problem. Lead with assessment, not compliance. Different pain, same sale. |
| Business Manager / Bursar | Never first | They gate budget but do not create demand. Email them only once someone internal wants this. |
| Group Head of EducationMulti-campus groups | Highest value | One conversation, many campuses. Worth ten single-school emails. Research these properly and write each one by hand. |
| Generic inboxes | Never | Nobody reads them, and it signals you did not look. If you cannot find a named person, skip the school. |
Sequence architecture
Four touches over eighteen days, then permanent suppression. Fifteen schools a week. Every touch must be independently useful — if a message adds nothing on its own, it is a nudge, and nudges are what get you marked as spam.
Touch 1 — the observation
To the Head of Digital Learning. Opens with something specific and true about their school. Names the duty, names the date, asks for twenty minutes. Under 150 words.
Touch 2 — the useful thing
Reply on the same thread. No "just following up". Send the free instrument, or the single most relevant post. The email is worth opening even if they never reply.
Touch 3 — the different door or the different angle
Either a fresh, short email to the Head of School, or a new angle to the same person — usually the delay misconception or the emotion-recognition point.
Touch 4 — close the loop and mean it
Two lines. You are stopping. Everything remains free and available. No guilt, no "last chance". Then suppress permanently, whatever happens.
Four touches, then stop
Not five. Not "re-engage in six months". A short, finite, courteous sequence is both the compliance position and the reputational one. Schools remember who kept emailing.
Tuesday to Thursday, 07:00–08:30 local
School leaders clear email before the day starts. Avoid Mondays, Fridays, the first and last week of term, and any period around exams or reports.
Cold templates
Square brackets are mandatory edits. If you cannot fill the observation bracket with something true and specific to that school, do not send the email — send it to a different school.
Subject: Article 4 and [SCHOOL NAME] Hi [FIRST NAME], [OBSERVATION — one true, specific sentence. Examples: "I saw [SCHOOL] published an AI use policy for students in September — more than most schools have done." "Your job ad for a Computing teacher mentioned AI across the curriculum, which is why I'm writing to you rather than the Head." "I noticed [SCHOOL] runs [PLATFORM], which has engagement analytics built in."] Quick context in case it's useful: the AI literacy duty in Article 4 of the EU AI Act has applied since February 2025, and national market surveillance authorities started enforcing it on 2 August 2026. A lot of schools stood their planning down when the news said the AI Act was delayed — what was delayed was the high-risk regime, not this. I'm a Digital Technology teacher at an international school in Lisbon. I built a readiness programme for my own school and now run it for others — audit, staff INSET, policy set, evidence file. Would twenty minutes be useful? No slides. I ask four questions and tell you honestly where you sit. If you're already covered I'll say so. [YOUR NAME] [ROLE] · [PRACTICE] [POSTAL ADDRESS] Not useful? Reply "no thanks" and I won't write again. [Privacy notice]
Subject: A question about [SCHOOL NAME] and the EU AI Act Dear [TITLE] [SURNAME], One question, and I'll be brief. If a market surveillance authority asked [SCHOOL] for evidence that staff have had AI literacy training proportionate to their roles, what could the school hand over today? That duty — Article 4 of the EU AI Act — has applied since February 2025 and became enforceable on 2 August 2026. It was not affected by the delay that was reported last year, which covered the high-risk provisions instead. I'm a Digital Technology teacher at an international school in Lisbon. I run a one-term programme that takes a school from nothing to a dated evidence file: system register, staff training record, policy set, board paper. If it's helpful I'll send the free self-assessment we use — 24 questions, about forty minutes, no obligation. Or I'm glad to speak to whoever owns this at [SCHOOL]. [YOUR NAME] [ROLE] · [PRACTICE] [POSTAL ADDRESS] Reply "no thanks" and I won't write again. [Privacy notice]
Subject: AI detection scores and integrity cases Hi [FIRST NAME], Not a compliance email — this one's about assessment. Most integrity cases involving AI now start with a detection score, and those scores are contestable. They're least reliable for EAL writers and for students with an unusual voice, which means the students least able to argue back are the ones most likely to be wrongly flagged. The alternative that works is redesigning the task and making the process visible — versioned drafts, in-class checkpoints, a three-minute oral defence, and a permitted-use statement printed on the task itself. I'm a Digital Technology teacher in Lisbon. I run a session with departments where every teacher rebuilds one real assessed task so a model can't do it well, and writes the permitted-use line students will see. They leave with the artefact, not a plan to make one. Worth twenty minutes? Happy to just send the framework if that's more useful. [YOUR NAME] [ROLE] · [PRACTICE] [POSTAL ADDRESS] Reply "no thanks" and I won't write again. [Privacy notice]
Subject: Article 4 across [GROUP NAME]'s [N] EU campuses Dear [FIRST NAME], [OBSERVATION specific to the group — a recent opening, a published education strategy, a conference talk they gave.] The AI literacy duty under Article 4 of the EU AI Act became enforceable on 2 August 2026, and it applies per institution. For a group operating [N] campuses inside the EU that's [N] separate evidence files, [N] training records, and [N] system registers — usually built [N] different ways by [N] people who've never spoken to each other. There's an obvious efficiency in doing it once, centrally, with a common instrument and a common evidence standard, then delivering locally. I run exactly that: one audit framework, one staff programme, one policy set, adapted per campus. I'm a Digital Technology teacher at an international school in Lisbon, so it's built for how schools actually run. Would it be worth thirty minutes to look at what a group-level version would involve? I can bring a worked example from a single-school delivery. [YOUR NAME] [ROLE] · [PRACTICE] [POSTAL ADDRESS] Reply "no thanks" and I won't write again. [Privacy notice]
Warm and referral
These convert several times better than anything in Part 5. Send all of them before you send a single cold email.
Subject: A small ask Hi [FIRST NAME], Hope [SPECIFIC THING — the new term, the move, the thing they mentioned] is going well. Small ask. I've built an AI Act compliance and AI literacy programme for international schools — the Article 4 duty that became enforceable in August. I ran it at [MY SCHOOL] first and it took us from 14/48 to 39/48 on the readiness audit in a term. I'm looking for a handful of schools to run it with this year. Is there anyone at [THEIR SCHOOL / in your network] who'd be the right person to talk to — usually whoever owns digital learning? Completely fine if not, or if it's awkward. I've written a short forwardable paragraph below in case it's easier to just pass on. Thanks either way, [YOUR NAME] ——— forward from here ——— [NAME] is a Digital Technology teacher in Lisbon who's built a readiness programme for the EU AI Act's Article 4 AI literacy duty — the one that became enforceable in August 2026. Audit, staff INSET, policy set, evidence file. She ran it at her own school first. Worth twenty minutes if AI compliance is on your list and nobody's owning it yet. [EMAIL]
Subject: Re: Intro — [YOUR NAME] / [THEIR NAME] [INTRODUCER], thank you — much appreciated. [FIRST NAME], good to meet you, even by email. Short version: I'm a Digital Technology teacher at an international school in Lisbon. I built a readiness programme for the Article 4 AI literacy duty after realising we had nothing documented, and now run it for other schools. Rather than pitch you, the most useful thing I can offer is twenty minutes where I ask four questions and tell you where I think [SCHOOL] sits. Several schools have come out of that call deciding they were fine, which is a perfectly good outcome. Here's the free self-assessment in the meantime: [LINK] Would [DAY] or [DAY] work? Happy to fit around your timetable — I know what the week looks like. [YOUR NAME] (moving [INTRODUCER] to bcc)
Subject: Session offer for [EVENT / TERM] — the AI Act duty schools missed Dear [FIRST NAME], I'd like to offer [ASSOCIATION] a session for members, free, at whichever meeting suits. The premise: when the news reported that the EU delayed the AI Act, a lot of school leaders reasonably concluded there was nothing to do. What was delayed was the high-risk regime. The AI literacy duty in Article 4 became enforceable on 2 August 2026, and the prohibition on inferring students' emotions has applied since February 2025 — which catches some engagement and proctoring tools schools are currently running. 45 minutes: what applies, what doesn't, the four education uses classed as high-risk, and a 24-point self-assessment members can take away and use. No product pitch — I'll say at the start that I do this commercially and then not mention it again. I'm a Digital Technology teacher at an international school in Lisbon and I run this programme in schools, so it's practitioner-level rather than consultancy-level. Happy to send the materials in advance so you can see exactly what members would get. [YOUR NAME] [ROLE] · [PRACTICE]
Follow-ups
The rule for all three: never write "just following up". Every message carries something new.
Subject: Re: Article 4 and [SCHOOL NAME] [FIRST NAME] — no reply needed to this one. I've put the readiness instrument here, free and with no email wall: [LINK] 24 questions across six domains. Takes about forty minutes with your head of IT in the room. It'll give you a score out of 48 and a paragraph you can put straight into a governors' report. Most schools score somewhere in the teens the first time. That's normal, and a low score with a dated plan is a far better position than nothing written down at all. Use it, ignore me. It's genuinely useful either way. [YOUR NAME]
Subject: One thing worth checking at [SCHOOL NAME] Hi [FIRST NAME], Different angle, and this one's worth thirty seconds regardless of whether we ever speak. Article 5 of the EU AI Act prohibits using AI to infer a person's emotions in an education institution. It's a prohibition, not a risk to manage, and it's applied since February 2025. In practice it catches: webcam attention or focus scoring, engagement analytics derived from facial expression, sentiment analysis of student faces or voices, and proctoring tools that flag stress or suspicion from expression. The phrase to interrogate with vendors is "engagement analytics" — if it's clickstream, fine; if it's biometric, it isn't. If [SCHOOL] runs anything in that category, it's worth getting a written answer from the vendor. Happy to send the exact wording to use — it's a nine-question screen I use with schools. [YOUR NAME]
Subject: Closing the loop [FIRST NAME] — I'll stop here, I know the term is relentless. Everything stays free and up to date if it's ever useful: [LINK] If this lands on the list in January, I'm easy to find. All the best, [YOUR NAME]
After the call
Subject: [SCHOOL NAME] — proposal, as discussed Hi [FIRST NAME], Thanks for the time this morning. Proposal attached — one page. The three things you named on the call: · [GAP 1, in their words] · [GAP 2, in their words] · [GAP 3, in their words] The programme addresses all three and leaves you with a dated evidence file. €[2,400] fixed, everything included, invoice on completion. I'm holding [DATE] for the INSET until [DAY]. After that I'll release it — that period is filling up. If it's a yes, reply "yes" and I'll send the audit link and confirm the date. If it's a no or a not-yet, tell me and I'll stop — and the instrument stays free either way. [YOUR NAME]
Subject: [SCHOOL NAME] — evidence file complete Hi [FIRST NAME], That's everything. Summary: Baseline audit [DATE]: [X]/48 Post-delivery [DATE]: [Y]/48 Staff trained: [N] of [N], records signed and filed Systems registered: [N], all risk-classified Article 5 screening: complete, [N] vendor confirmations on file Policies: T1–T3 approved [DATE], review [DATE] The file is at [LOCATION]. [OWNER NAME] holds it and the next review is [DATE] — I've put it in the calendar. One remaining gap worth naming: [THE BIGGEST REMAINING THING, honestly]. No urgency, but it should be on someone's list. Two asks, both easy to decline: 1. Three sentences I could use, attributed to you and your role? Draft below — edit however you like, or bin it. "[DRAFT QUOTE]" 2. Is there another school you'd think of who's in the position you were in six weeks ago? If an introduction leads to a booking I'll run an extra twilight for you free. It's been a pleasure. [YOUR NAME]
Client lifecycle
Past clients are the cheapest revenue you will ever get. Two emails a year keeps every relationship alive.
Subject: AI Act update — what changed and whether it affects you Hi [FIRST NAME], Short update, because something moved and you'll want to know whether it touches [SCHOOL]. What changed: [PLAIN DESCRIPTION, two sentences] Does it affect you: [YES / NO / ONLY IF] What to do: [NOTHING / UPDATE THE FOLLOWING / ONE SPECIFIC ACTION] I've updated the pillar page and the instrument to match: [LINK] Your evidence file is still current apart from [ITEM], which I'd amend when convenient. Happy to do it if easier — it's ten minutes. [YOUR NAME]
Subject: [SCHOOL NAME] annual AI review — due [DATE] Hi [FIRST NAME], The annual review we diarised is due [DATE]. Flagging it early so it doesn't land in the middle of something. What's changed since last year that affects you: · [CHANGE 1] · [CHANGE 2] What the review involves: re-run the 24-point audit, refresh the register, update policy dates, and induct anyone who joined since [DATE] — [N] people by my count. Half a day of your time, and I produce the updated file. €1,200 as agreed. Shall I book [DATE] or would [ALTERNATIVE] be easier? Also worth mentioning: you scored [X]/48 last year and the two weakest domains were [A] and [B]. Worth seeing whether those moved. [YOUR NAME]
Subject line bank
Lower case where natural. No emoji, no "Quick question", no false "Re:". School leaders read subject lines on a phone at 7am between other things.
Manufactured urgency
"URGENT", "Deadline approaching", "Action required", "Final notice". The deadline is genuinely real, which means you never need to dress it up — and educators are unusually quick to write off anyone who does.
Fake familiarity
"Following up on my last email" when there was none. "Re:" on a first contact. "Per our conversation" when there was not one. One of these and you are done at that school permanently.
Deliverability
Fifteen emails a week from a real person's real mailbox has few technical problems. Get four things right and stop thinking about it.
| Item | What to do |
|---|---|
| Send from your real domain | Your own professional domain, your own name, your normal mailbox. No lookalike sending domains, no third-party bulk tool. At this volume you do not need one and it costs you authenticity. |
| SPF, DKIM and DMARC | All three configured on the sending domain. This is the one genuinely technical item and it takes twenty minutes once. |
| Verify every address | Bounces damage sender reputation and, under the accuracy principle, sending to invalid addresses is itself processing inaccurate personal data. Two reasons, one fix. |
| Plain text, one link maximum | No HTML templates, no tracking pixels, no images, no logos. It should look exactly like an email a person typed, because it is. Tracking pixels in particular are both a deliverability signal and a consent question you do not need. |
| Suppression list | One list, permanent, checked before every send. Anyone who opts out, replies no, or completes four touches goes on it and never comes off. |
| Source column | URL and date for every contact, in the same sheet. If someone asks how you got their address you answer in under a minute, which turns a complaint into a non-event. |
Track four numbers, not fourteen
Sent, replied, calls booked, opted out. Reply rate is the only quality signal that matters — if it is below about 5% on a researched list of sixty, the problem is the observation line in touch one, not the volume. Opt-out rate above 3% means you are emailing the wrong people, and you should stop the batch and re-check the buyer map in Part 3.
What kills these emails
The generic observation
"I was impressed by your school's commitment to excellence." Every school says that on its website. If the bracket cannot be filled with something only true of them, skip the school — a missing observation is worse than no email.
Length
Over 200 words and it does not get read on a phone at 7am. T1 is 150. If you cannot say it in 150 you have not decided what you are saying.
Consultant voice
"Leverage", "solutions", "partner with you on your journey", "holistic framework". One of these words and a teacher stops reading. Write the way you would speak to a colleague in a corridor.
Asking for the sale first
Touch one asks for twenty minutes, free. It does not mention price, does not attach a brochure, does not propose a demo. The ask has to be granteable by one person without consulting anyone.
Ignoring the school calendar
Emailing during exam weeks, report weeks, the first week of term or the last week of term is a wasted send. Build the calendar into the batch schedule.
Not being a teacher in the email
Your single biggest advantage over every consultancy is that you stand in a classroom. If a reader finishes the email without knowing that, you have written a worse version of what everyone else sends.
The test before you press send
Read the email as if you are a Head of Digital Learning who has already deleted six pitches this morning. Would you reply? Does it tell you something you did not know? Could any other sender have written it word for word? If the answer to the last one is yes, it is not finished.