Education providers that use AI systems for admissions, assessment or exam proctoring fall substantially within the scope of the EU AI Act. Many schools, universities, vocational programmes and edtech organisations buy off-the-shelf AI tools and assume that responsibility lies solely with whoever built the system. That is not the case. Whoever deploys an AI system bears its own, independent obligations under the regulation. This page explains what this means for the education sector and how you prepare for procurement and supervision.
Your role: provider or deployer
The EU AI Act distinguishes between two roles. A provider is the entity that develops an AI system and places it on the market under its own name. A deployer is the organisation that uses the AI system in its operations. A school that buys in an admissions tool is generally a deployer, while the system developer is the provider.
Note that the role can change. Under Article 25, a deployer may be reclassified as a provider – for example if you substantially modify a high-risk system or put your own name on it. In that case you assume the provider's full obligations. This is why it is important to establish your role early for each individual system.
Education AI as high-risk under Annex III
The core issue for the education sector lies in Annex III point 3, which classifies several common AI applications as high-risk. This covers AI systems for access and admission to education, AI used to assess learning outcomes, and AI to monitor and detect cheating during exams. These systems affect an individual's access to education and their future opportunities, and are therefore subject to the strictest requirements.
Beyond this, you should consider Annex III point 4 on recruitment AI, which becomes relevant when you use AI support in hiring teachers and other staff. These systems are also high-risk.
The deployer's obligations (Article 26)
As the deployer of a high-risk system, under Article 26 you have, among others, the following obligations: to use the system in accordance with the provider's instructions, to ensure human oversight by competent staff, to monitor the system's operation and report serious incidents, and to keep logs. You must also inform affected students and staff that a high-risk system is being used.
A basic prerequisite is that you have oversight of which AI systems exist in your organisation. The obligation to ensure sufficient AI literacy among staff (Article 4) has applied since 2 February 2025, as has the prohibition of certain AI practices (Article 5).
Human oversight and FRIA (Articles 14 and 27)
When assessing students, human oversight under Article 14 is decisive. An AI system must not, on its own, determine a student's grade, admission or an accusation of cheating – a competent human must be able to understand, review and override the system's output.
If you are a public education provider, Article 27 additionally applies, requiring a fundamental rights impact assessment (FRIA) before a high-risk system is put into use. The assessment must, among other things, describe how the system is used, which groups are affected and which risks to fundamental rights exist.
Timeline
- 2 February 2025: Article 4 (AI literacy) and Article 5 (prohibited practices) in force.
- 2 August 2026: Article 50 (transparency) and the deployer obligations for high-risk systems under Annex III start to apply.
- Proposal: The Digital Omnibus proposes deferring the application of Annex III to 2 December 2027. The proposal was approved by the European Parliament on 16 June 2026, but the Council is awaiting publication in the EU Official Journal and it is not yet in force. Plan on the basis of 2 August 2026 until confirmed otherwise.
Penalties
The penalties under Article 99 are significant. For breach of the prohibitions in Article 5, fines can reach 35 million EUR or 7 percent of global annual turnover. For breaches of the high-risk requirements and Article 50, up to 15 million EUR or 3 percent applies. For incorrect information to authorities, up to 7.5 million EUR or 1 percent applies.
Before procurement
- Map whether the system falls under Annex III point 3 (education) or point 4 (recruitment).
- Request the provider's technical documentation and instructions for use.
- Establish your role under Article 25 before you adapt the system.
- Plan for human oversight (Article 14) in all assessment of students.
- Prepare a FRIA (Article 27) if you are a public education provider.
- Ensure staff AI literacy (Article 4) and coordinate with your NIS2 obligations.
PowerQuant is delivered as documentation support: Module 1 (AI inventory + Article 4 register) and Module 2 (Provider documentation package). SEK prices are preliminary.
This page is general information about the AI Act and does not constitute legal advice.