Education & training · AI Act

Education & Training — AI Act: governing AI in learning

The AI Act classifies as high risk any AI that decides on admission, assesses learning outcomes, determines pathways or monitors examinations. Educational institutions, training bodies and EdTech providers must qualify these use cases and manage biases. This guide details the qualification process, the obligations and the allocation of responsibilities.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • The EdTech is the provider; the institution or organisation is the deployer.
  • Qualify the systems.
  • Control biases.
  • Ensuring human oversight.
  • Up to €35M or 7% for prohibited practices and €15M or 3% for high risk, in addition to GDPR exposure.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

Annex III of the AI Act targets AI intended for admission or assignment to educational establishments, assessment of learning outcomes, student guidance, and the monitoring and detection of prohibited behaviours during examinations. These systems are subject to high-risk obligations.

Purely educational uses without decisions affecting individuals fall under lighter regulatory regimes.

Is the 'Education & training' sector concerned?

The EdTech is the provider; the institution or organisation is the deployer. Each bears its own obligations.

Adaptive tutors without assessment decisions may fall under lighter regimes, while still remaining subject to GDPR.

Detailed obligations

Qualify the systems

Isolate admission, assessment, guidance and proctoring (high risk).

Control biases

Audit data and outcomes to prevent discrimination.

Ensuring human oversight

Ensure effective human decision-making (particularly regarding assessments).

Ensure transparency

Informing learners and families about AI usage.

Document (supplier)

Building the technical documentation and assessment.

Sanctions & risks

Up to €35M or 7% for prohibited practices and €15M or 3% for high-risk, in addition to GDPR risk. An unfair algorithmic assessment durably affects a learner's educational journey.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2High risk. From 2 August 2026 for educational AI.

Common mistakes in the sector

  • 1High risk denied. Treating automated grading as a simple tool.
  • 2Untested biases. Not audit results by profile.
  • 3Unregulated proctoring. Monitoring exams without safeguards.
  • 4Absent transparency. Fail to inform learners and families.

Practical case

An organisation deploys AI-based remote exam proctoring. As a high-risk and intrusive use case, it requires a DPIA, human oversight of alerts, candidate notification, and a bias audit, with the vendor providing compliance documentation.

Compliance roadmap

  1. 1

    Inventory. Inventorying educational AI use cases.

  2. 2

    Qualify. Isolate high risk.

  3. 3

    Auditing biases. Monitor data and outcomes.

  4. 4

    Frame. Supervision and transparency.

  5. 5

    Document. Documentation and assessment (supplier).

Frequently asked questions

Yes, when it evaluates learning outcomes.

Back to the Education & training guideEducation & training & GDPR

Take action on AI Act

Free assessment or a chat with an expert dedicated to education & training.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the education & training sector secured their compliance with DCO.

See testimonials