EU AI Act Education Rules: High-Risk AI in Schools, Universities and Vocational Training

EU AI Act education rules classify AI as high-risk when it decides admission or placement, evaluates learning outcomes, assesses the level of education a person can reach, or monitors students for prohibited behaviour during tests (Annex III point 3). Those duties apply from 2 December 2027. Inferring the emotions of students has been banned since 2 February 2025.

This guide was checked on 14 October 2026 against the consolidated AI Act on EUR-Lex, Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, the Commission’s guidelines on prohibited practices, and its May 2026 draft guidelines on high-risk classification, which include worked education examples. It explains the law in general terms and is not legal advice for any institution.

To classify a single tool, the EU AI Act checker runs Article 5, Annex III and Article 50 in one pass. AI that evaluates teachers or other staff falls under the employment rules instead, which our HR guide covers.

EU AI Act education and vocational training: the four high-risk uses

Annex III point 3 lists AI systems intended to be used:

• (a) to determine access or admission, or to assign people, to educational and vocational training institutions at all levels;
• (b) to evaluate learning outcomes, including when those outcomes are used to steer the learning process;
• (c) to assess the appropriate level of education a person will receive or be able to access;
• (d) to monitor and detect prohibited behaviour of students during tests.

Classification follows the intended purpose, which Article 3(12) defines by the provider’s instructions, marketing and technical documentation. The same language model can sit outside Annex III as a study aid and inside it as an essay grader.

The Commission’s draft guidelines read “institutions at all levels” broadly: early childhood, primary, secondary, tertiary, vocational and adult education, public or private, online, in person or blended, including non-formal providers that award certificates. Systems aimed mainly at training teachers fall outside point 3 but may fall under the employment area in point 4. The draft adds that education systems often profile students, and under the last subparagraph of Article 6(3) any Annex III system that profiles people is always high-risk.

Which education AI is high-risk: common uses compared

The middle column follows the Commission’s draft guidelines of 19 May 2026, which were still a draft when checked. Treat it as the Commission’s current reading, not settled law.

One tension is worth watching. Point 3(b) itself covers evaluations “used to steer the learning process”, while the draft treats adaptive systems that steer practice without feeding grades as outside it. The final guidelines may draw that line differently.

Emotion recognition in classrooms and exams is already banned

Article 5(1)(f) prohibits placing on the market, putting into service for this purpose, or using AI systems to infer the emotions of a person in the areas of workplace and education institutions, except for medical or safety reasons. It has applied since 2 February 2025 under Article 113(a). An emotion recognition system, in Article 3(39), works from biometric data, so sentiment analysis of written text falls outside the ban.

The Commission’s guidelines on prohibited practices, C(2025) 5052 of 29 July 2025, give education examples:

• Prohibited: inferring students’ interest and attention; emotion recognition during admission tests; adding emotion detection, such as arousal or anxiousness, to online exam monitoring.
• Not prohibited: eye tracking in online exams to spot unauthorised material, as long as it infers no emotions; an emotion-aware language app that a learner uses on their own outside an institution.
• Changes the answer: the same app becomes prohibited when an institution requires students to use it, and the ban also covers candidates during admission.

The medical and safety exception is read narrowly. Therapeutic use means CE-marked medical devices, and monitoring wellbeing, motivation or learning satisfaction does not qualify, although the guidelines accept support for students with autism as a medical use. Under Article 99(3), breaches can cost an undertaking up to €35 million or 7% of worldwide annual turnover, whichever is higher, while each Member State decides how far public institutions can be fined (Article 99(8)). Our overview of the Article 5 bans covers the rest, and our fines guide the penalty tiers.

When an education tool is not high-risk

Article 6(3) lets an Annex III system escape high-risk status when it does not materially influence decisions and performs one of four roles: a narrow procedural task, improving a completed human activity, detecting patterns in past decisions without replacing human assessment, or a task preparatory to an assessment. The draft’s education examples are an exam quality checker that only polishes a teacher’s paper, a grade calculator that averages weighted marks, a tool that flags anomalies in instructors’ past grading for human review, and an assistant that drafts questions a teacher can use to assess a student’s readiness for the next level.

The exemption is the provider’s to claim and document under Article 6(4), with registration under Article 49(2). An institution that uses an exempt tool to shape decisions about students, or points a general-purpose assistant at grading, changes its intended purpose and becomes the provider under Article 25(1)(c). Article 16 then applies in full: a quality management system, technical documentation, a conformity assessment, CE marking and registration.

Edtech companies outside the EU are not exempt. Article 2(1) covers providers that place systems on the EU market wherever they are established, and providers and deployers abroad whose system output is used in the EU; our guide for US companies explains that reach.

Duties for schools and higher education institutions as deployers

From 2 December 2027, an institution that uses a point 3 system under its own authority is a deployer:

Recital 96 names education among the public services that bring private providers into Article 27, so private schools and training providers that deliver a public service may be covered as well as public ones. Our FRIA template works through the six required elements. Where a decision based solely on automated processing has significant effects, Article 22 of the GDPR applies alongside all of this.

AI literacy and chatbots: the duties already in force

AI literacy. Article 4 has applied since 2 February 2025. As amended by the Omnibus from 27 July 2026, it requires providers and deployers to take measures to support the AI literacy of their staff and others who operate AI on their behalf, and it no longer requires a guaranteed level. For a school, that points to teachers and administrators who use AI tools rather than to students. The Omnibus recitals point the Commission and Member States to frameworks including the AI Literacy Framework for Primary and Secondary Education.

Transparency. Article 50 has applied since 2 August 2026. A student-facing chatbot must tell users they are dealing with AI unless that is obvious, a duty that falls on the provider, which is the institution itself when it puts an assistant into service under its own name. Generated audio, images, video and text must carry machine-readable marking, and systems on the market before 2 August 2026 have until 2 December 2026 to add it. Deployers must disclose deepfakes, including synthetic video of real people in teaching material. Our note on Article 50 in practice covers who counts as provider.

Key dates for schools and universities

• 2 February 2025: the Article 5 bans, including emotion recognition in education, and the AI literacy duty.
• 27 July 2026: the Digital Omnibus enters into force and softens Article 4.
• 2 August 2026: Article 50 transparency duties.
• 2 December 2026: the marking deadline for older generative systems, and two added bans on AI systems that generate non-consensual intimate imagery of identifiable people or child sexual abuse material.
• 2 December 2027: high-risk duties for Annex III systems, including point 3 and the FRIA.
• 2 August 2030: high-risk systems intended for public authorities that were already in service must comply, design change or not.

Systems already in use before December 2027 otherwise fall under the high-risk rules only after a significant change to their design (Article 111(2)). Our deployer readiness guide sets out the phases in more detail.

How VDF AI fits

Student records, coursework and assessment data are among the most sensitive data an institution holds. VDF AI runs assistants and governed agents on infrastructure the institution controls, on-premises or air-gapped, so that data stays inside its estate, and VDF AI Router keeps each workload on approved models.

Workflows can pause for a teacher’s or administrator’s approval before a consequential step, every prompt, retrieval and response is logged for the retention period the institution sets, and role-based access control comes with every plan. For the duties already in force, the AI compliance training agent supports Article 4 programmes and the transparency notice generator drafts Article 50 wording. Classifying each system and meeting the deployer duties remain the institution’s responsibility.