Education & training compliance: AI Act (high risk) & GDPR

Why the 'Education & Training' sector is affected

Educational AI is expanding: admissions and guidance tools, automated marking and assessment, remote exam proctoring, adaptive tutors. The AI Act classifies as high risk any AI that decides access to education, assesses learning outcomes, or monitors examinations.

The audience is predominantly made up of minors, which raises the GDPR compliance bar: parental consent based on age, consideration of the child's best interests, data minimisation and caution regarding profiling.

Remote examination proctoring is where tensions are most concentrated: it combines a potentially high-risk AI use case with intrusive processing of minors' data, justifying an in-depth impact assessment.

AI Act — high-risk educational AI

The AI Act classifies as high-risk any AI intended to decide on admission or assignment within educational institutions, to assess learning outcomes, to guide learner pathways, and to monitor or detect prohibited behaviours during examinations. High-risk obligations apply: risk management, data quality, human oversight, transparency, and documentation.

The EdTech is the provider; the institution is the deployer.

Key obligations

• Qualify use cases (admissions, assessment, proctoring) as high risk.
• Bias control and data quality.
• Human oversight of decisions.
• Transparency towards learners and families.
• Documentation and assessment (supplier).

GDPR — minor's data

Establishments and organisations act as data controllers for learner data, often involving minors. Key points of attention: parental consent according to age, the child's best interests, data minimisation, caution regarding profiling and the governance of proctoring.

Key obligations

• Legal basis and, for minors, parental consent according to age.
• Minimisation and caution regarding learner profiling.
• Proctoring framework (DPIA).
• Security and retention periods.

Comparative overview of regulations

How these regulations interact

Remote exam proctoring illustrates the cumulative GDPR / AI Act challenge: it constitutes both a high-risk AI use case (detection of behaviours during examinations) and an intrusive processing of minors' data (GDPR). It requires a combined impact assessment and robust safeguards.

The allocation of roles structures compliance: the EdTech (provider) bears responsibility for system compliance, the institution (deployer) bears responsibility for use — transparency, human oversight and respect for the child's best interests.

Application timeline

• 1GDPR. In force; enhanced protection for minors.
• 2AI Act. High risk: From 2 August 2026 for educational AI.

Applicable penalties

AI Act up to €35 M or 7%, GDPR up to €20 M or 4%. Breaches involving minors' data and unfair algorithmic profiling are particularly sensitive from a reputational standpoint.

A biased AI assessment tool can permanently affect a learner's educational journey, which increases the risk.

Compliance roadmap

• 1Inventory educational AI. Mapping admission, assessment, guidance, proctoring and qualifying high risk.
• 2Mastering bias and transparency. Auditing biases and informing learners and families.
• 3Protecting minors. Parental consent according to age, data minimisation, child's best interests.
• 4Frame proctoring. Conduct a DPIA and calibrate monitoring proportionately.
• 5Distribute the roles. Clarifying provider (EdTech) and deployer (institution).

How Data Comply One supports the sector

Data Comply One covers GDPR and the AI Act on a single platform, with outsourced DPO, and supports institutions, training organisations and EdTech companies on the GDPR/AI Act interface and the protection of minors.

DCO offers tailored templates (DPIA for proctoring, family information notices, AI Act educational documentation).

Frequently asked questions