Skip to main contentSkip to main content
Sector Guide

Education & Vocational Training

AI systems used in education face particularly stringent obligations because of their impact on individuals' life opportunities. The EU AI Act treats most assessment and admissions AI in education as high-risk, requiring full Annex IV documentation, human oversight, and FRIA.

Provisional Digital Omnibus deal — high-risk deadlines shifted

On 7 May 2026, the Council of the EU and the European Parliament reached provisional political agreement on the Digital Omnibus on AI. Key shifts:

  • Annex III high-risk obligations: 2 August 2026 → 2 December 2027
  • Annex I product-embedded high-risk: 2 August 2027 → 2 August 2028
  • New Art. 5 prohibition on AI generating child sexual abuse material or non-consensual intimate imagery: 2 December 2026
  • Art. 50(2) machine-readable watermarking ONLY: 2 August 2026 → 2 December 2026
  • Member State AI sandboxes: 2 August 2026 → 2 August 2027

What is NOT delayed by the Omnibus — still live on the original dates:

  • Art. 4 AI literacy — in force since 2 February 2025 (all organisations)
  • Art. 5 existing prohibitions — in force since 2 February 2025
  • Chapter V GPAI obligations — in force since 2 August 2025
  • Art. 50 transparency duties (chatbot disclosure 50(1), emotion recognition / biometric categorisation 50(3), deepfake disclosure 50(4), public-interest disclosure 50(5)) — still 2 August 2026. Only the machine-readable watermarking limb (50(2)) was shifted.

If you deploy a chatbot, a deepfake-generation tool, an emotion-recognition system or a biometric categoriser — your 2 August 2026 deadline is unchanged, even if your underlying AI is "minimal risk".

The Omnibus agreement is provisional. Formal adoption by Council and Parliament is expected before 2 August 2026. If formal adoption fails, the original Regulation (EU) 2024/1689 dates apply across the board.

Education AI is Annex III Category 3 — captured by the high-risk deadline shift to 2 December 2027 (provisional). Art. 4 AI literacy is live now and disproportionately important here: teachers and assessors must understand the AI they use.

See regulatory updates for full source citations.

SMEs and corporate teams — using a third-party AI does not exempt you

Using AI to score applications, assess assignments, or detect cheating — even via ChatGPT plug-ins? Annex III(3) education is high-risk — you are a deployer.

The AI vendor (Anthropic, OpenAI, Google, Microsoft, Meta, Mistral, etc.) takes the Art. 16 provider obligations for the underlying model. The duty to operate the system safely in your business context is yours as a deployer under Art. 26 — including:

  • Designating and training a human overseer (Art. 26(2))
  • Ensuring input data is relevant and representative for your context (Art. 26(4))
  • Monitoring system operation and reporting serious incidents to the provider (Art. 26(5)–(6))
  • Informing affected workers, customers or citizens about the AI's role in decisions (Art. 26(7), Art. 26(11))
  • Conducting a Fundamental Rights Impact Assessment if you are a public body or in Annex III 5(b)/(c) (Art. 27)
  • Registering as a deployer in the EU database where you are a public body (Art. 49(2))
  • Maintaining automatically generated logs for at least six months (Art. 26(6))

Point 3

Annex III category

Prov. 2 Dec 2027

Annex III high-risk

€30M / 6%

Max penalty

Yes (Art. 27)

FRIA required

High-risk AI systems in education (Annex III, point 3)

Annex III, point 3 designates certain educational AI as high-risk. All Art. 9–17 obligations apply — risk management, data governance, transparency, human oversight, accuracy, and post-market monitoring.

HIGH-RISKAnnex III — 3(a)

AI systems for determining access or admission to education

Systems used to determine access to educational institutions (school admissions, university selection) or to allocate places on educational programmes. This includes AI-scored entrance tests, algorithmic admissions screening, and university ranking systems that influence admissions decisions.

Examples

  • University admissions scoring tools
  • School placement algorithms
  • Scholarship allocation systems
HIGH-RISKAnnex III — 3(b)

AI systems for student assessment and evaluation

Systems used to assess and evaluate students, including automated essay scoring, AI-driven examination tools, and systems that evaluate the learning outcomes of persons in educational contexts. Covers both formative and summative assessment AI.

Examples

  • Automated essay grading
  • AI-based proctoring with performance scoring
  • Adaptive learning assessments
HIGH-RISKAnnex III — 3(c)

AI systems for vocational guidance and career counselling

Systems that monitor students and detect behavioural patterns relevant to learning, or systems used for vocational guidance based on analysis of individual characteristics that may affect access to professional opportunities.

Examples

  • AI career counselling tools
  • Learning analytics that influence course recommendations
  • AI-based student profiling systems

What is NOT high-risk in education

Not all AI in education is high-risk. Systems that are purely tools for teachers or administrative efficiency, without directly affecting students' access to opportunities, are generally not in scope:

  • AI tools that help teachers create lesson plans or educational materials
  • Chatbots used for general student Q&A (unless they make consequential decisions)
  • Plagiarism detection tools (informing a teacher decision, not making the decision)
  • Administrative AI for timetabling, resource allocation, or school logistics
  • Translation or accessibility tools for educational content

Note: If any of these systems feed into a consequential decision about a student, they may become in-scope.

Key obligations for educational AI providers and deployers

Art. 27Deployer

Fundamental Rights Impact Assessment

Educational institutions deploying high-risk AI must conduct a FRIA before deployment, covering impacts on students' rights to education, non-discrimination, privacy, and dignity. The FRIA must be updated when the system changes significantly.

Art. 14Both

Human oversight — override capability

Decisions about students based on AI outputs must always be reviewable and overridable by a human. A teacher or administrator must be able to disregard AI recommendations. Students must have access to human review (see also GDPR Art. 22).

Art. 13Provider

Transparency and explainability

Instructions for use must explain the AI system's purpose, accuracy, and limitations in plain language understandable to educators. Particularly important for assessment AI where educators may not have AI literacy.

Art. 10Provider

Data governance — protected characteristics

Training data must be examined for bias with respect to protected characteristics: age, disability, gender, race and ethnicity, socioeconomic background. Particular attention to historical data that encodes systemic educational inequalities.

Art. 22 GDPRDeployer

Student rights — GDPR overlap

Students subject to consequential automated decisions (admissions, assessments) have rights under GDPR Art. 22: the right not to be subject to solely automated decisions, the right to explanation, and the right to human review. AI Act and GDPR obligations must be fulfilled simultaneously.

Special case: AI exam proctoring

AI-based exam proctoring tools (which monitor student behaviour via webcam, detect suspicious activity, and generate reports used in academic integrity decisions) are in a complex position. They likely qualify as high-risk under Annex III, point 3(b) — and may also engage the biometric data provisions if they analyse physical/behavioural characteristics. Several EU data protection authorities have raised concerns about the lawfulness of remote proctoring, and some national implementations are being challenged. Exercise extreme caution with proctoring AI.

This guide is for informational purposes only and is not legal advice. Verify all requirements with the relevant national supervisory authority.