The EU AI Act for education AI.

Education is named directly in the EU AI Act. Annex III, point 3 covers AI used to decide access to education, to evaluate learning outcomes, to assess the appropriate level of education a person should receive, and to monitor for prohibited behaviour during tests. If your product does any of those, it is presumptively high-risk - and unlike most sectors, there is a second trap sitting next to it in Article 5.

Proctoring is the case to look at first. Monitoring exam behaviour is explicitly high-risk under Annex III 3(d). If that monitoring includes emotion inference, it is not high-risk - it is prohibited outright under Article 5, in educational settings, with no documentation route out.

Where EdTech lands

The line that decides it: sequencing vs judging

An adaptive system that picks the next exercise because the last one was answered wrong is sequencing content. A system that produces a score, a level, a readiness judgement or a recommendation about the learner is evaluating the person - and that is both Annex III and profiling, which closes the Article 6(3) exemption absolutely.

Vendors often sit closer to the line than they think, because the same engine that sequences content usually also produces a mastery estimate. If that estimate is surfaced to a teacher, an admissions officer or an employer, it is doing assessment work.

School or vendor - who owes what

A school or university buying an AI grading tool is a deployer under Article 26: human oversight, monitoring, input-data relevance, logging, and informing affected students. It does not inherit the vendor's Chapter III duties - risk management, technical documentation, conformity assessment, CE marking - which stay with the provider. The full test.

Two traps specific to education procurement. First, a school that substantially modifies a tool - retraining it on its own cohort, repurposing a placement model into an admissions filter - can become the provider. Second, public-sector deployers of Annex III systems have additional duties, including a fundamental rights impact assessment. Universities and state schools should assume the heavier deployer set applies to them.

What is live today, whatever your tier

• Article 50 - a study bot tells students it is an AI, at first contact.
• Article 4 - teachers and admin staff operating these systems need recorded AI literacy. In education this is easier to argue you've done and harder to argue you don't need.
• Article 5 - no emotion inference on students. Check any proctoring or engagement-tracking feature now, not in 2027.

High-risk obligations run to 2 December 2027. That is not far off for a grading or admissions product: conformity assessment realistically takes 12 to 18 months, and academic procurement cycles are annual. Full deadline map.

GDPR does much of the work already. Student data is often children's data, so if you have a DPIA, an age-appropriate design position and a lawful basis that survive scrutiny, a large share of Article 10 data governance is evidenced by work you have done. Reglynn reports flag those overlaps rather than billing you twice.

Frequently asked questions

Is AI grading software high-risk under the EU AI Act?

Yes. Annex III point 3(b) names AI intended to evaluate learning outcomes as high-risk. Because it evaluates individual learners it also profiles them, which closes the Article 6(3) exemption.

Is AI exam proctoring allowed under the EU AI Act?

Proctoring that monitors for prohibited behaviour during tests is high-risk under Annex III point 3(d). If it also infers emotional state, it is prohibited outright under Article 5, which bans emotion inference in educational settings - and no disclosure or documentation cures a prohibited practice.

Is adaptive learning software high-risk?

Usually not. Sequencing which exercise comes next is delivering content, not evaluating the person. It tips over when the system produces a score, level or readiness judgement about the learner that is surfaced to a teacher, admissions officer or employer.

Is a school a provider or a deployer?

A deployer, with Article 26 duties: human oversight, monitoring, input-data relevance, logging and informing affected students. It does not inherit the vendor's Chapter III obligations - unless it substantially modifies the tool, for example by retraining it on its own cohort.

Do public schools and universities have extra duties?

Yes. Public-sector deployers of Annex III systems face additional obligations including a fundamental rights impact assessment, so state schools and universities should assume the heavier deployer set applies.