EU AI Act for Education: Which AI Systems in Schools and Universities Are High-Risk

Education is one of the sectors where the EU AI Act draws its sharpest lines. AI systems used in schools, universities, and vocational training institutions face some of the strictest rules in the regulation — and one category is outright banned.

Annex III, Section 3 of the EU AI Act specifically lists education and vocational training as a high-risk domain. But not every AI tool used in education is high-risk. The classification depends on what the system does and what decisions it influences.

Which education AI is high-risk

The following AI uses in education are explicitly classified as high-risk under Annex III, Section 3:

• AI that determines access to education. Systems used in admissions decisions — whether for schools, universities, or vocational training programmes. If the AI influences who gets accepted, it is high-risk. This includes application scoring, ranking, and automated screening.
• AI that evaluates learning outcomes. Automated grading systems, essay scoring tools, and any AI that determines or significantly influences a student's academic results. If the AI output affects a grade, it is high-risk.
• AI that determines the level of education a person can access. Systems that decide which track, stream, or programme a student is placed into. Adaptive learning systems that determine a student's level and adjust content accordingly may fall here if they affect formal educational outcomes.
• AI for monitoring and detecting prohibited behaviour during assessments. Proctoring software that uses AI to detect cheating, monitor eye movements, flag suspicious behaviour, or analyse typing patterns during exams. This is high-risk, not prohibited — but it overlaps with a prohibition (see below).

What is NOT high-risk in education:

• Administrative AI. Timetabling, room allocation, resource planning — these are not high-risk because they don't affect individual educational outcomes.
• General learning tools. AI-powered study aids, flashcard generators, language translation tools, and content recommendation for supplementary learning are typically minimal or limited risk.
• Plagiarism detection (without proctoring). Tools that check submitted text against databases for similarity are generally not high-risk — they assist human review rather than making automated decisions.

What's prohibited in education

Article 5(1)(f) specifically prohibits AI systems that infer emotions of natural persons in the areas of workplace and education institutions. This is a bright-line ban with no exceptions:

• Emotion recognition in classrooms. AI that analyses facial expressions, voice tone, or body language to detect student engagement, attention, boredom, or emotional state is prohibited.
• Emotion-based assessment tools. Any system that uses emotional indicators (stress detection, confidence measurement) as part of evaluating student performance is prohibited.
• Attention monitoring. AI that tracks eye movements, facial expressions, or body posture to measure whether students are paying attention is prohibited if it infers emotional or psychological states.

Provider vs deployer obligations

In education, the provider-deployer distinction creates a clear division of responsibility:

• Edtech companies building AI tools are providers. They bear the primary compliance burden: conformity assessment, technical documentation, risk management system, data governance, post-market monitoring. They must ensure the system can be used in a compliant way.
• Schools and universities deploying these tools are deployers. Their obligations are lighter but still binding: use the system according to instructions for use, ensure human oversight, inform affected individuals, conduct a fundamental rights impact assessment for public institutions, and monitor performance in their specific context.
• Public institutions (state schools, public universities) have an additional deployer obligation: they must conduct a fundamental rights impact assessment (FRIA) under Article 27 before putting the system into use.

Key obligations for education AI

For high-risk education AI, the full set of provider obligations under Chapter III, Section 2 applies:

• Risk management system (Article 9). A continuous, documented risk management system covering the AI system's lifecycle. For education AI, this must specifically assess risks to minors and vulnerable students.
• Data governance (Article 10). Training data must be representative of the student population the system will serve. Bias testing must examine performance across age groups, genders, ethnicities, learning disabilities, and socioeconomic backgrounds.
• Technical documentation (Annex IV). Complete system documentation including intended purpose, capabilities, limitations, and instructions for deployer oversight. Use document generation to create Annex IV documentation.
• Human oversight (Article 14). Education AI must have effective human oversight mechanisms. For grading systems: human review before grades are finalised. For admissions: human decision-maker with authority to override. For proctoring: human review of all AI-flagged incidents.
• Transparency (Article 13). The system must be transparent enough that deployers (schools) can understand and oversee its outputs. Students and parents must be informed when AI is being used in educational decisions.

What to do now

• Audit your AI tools. List every AI system used in your institution or product. Classify each one to determine which are high-risk and which are not.
• Check for emotion recognition. If any tool uses facial analysis, voice analysis, or emotion detection in an educational context, it is almost certainly prohibited. Remove or disable these features immediately.
• Assign roles. Determine whether you are a provider (building the AI) or deployer (using the AI). Your obligations differ significantly.
• Start documentation. For high-risk systems, begin technical documentation now. The high-risk deadline is 559 days away — documentation takes the longest.
• Plan for transparency. All education AI — high-risk or not — must meet Article 50 transparency requirements by the transparency deadline in 72 days. Students and parents must be told when AI is being used.