EU AI Act in Education (Annex III, 3): Schools, Universities, Training

Main article: High-risk AI under Annex III — the eight high-risk areas, the narrow exception in Art. 6(3) AI Act and the obligations by role.

1. Annex III, 3 EU AI Act

Annex III no. 3 AI Act covers four categories of AI systems in general and vocational education — access decisions, assessment of performance, assessment of the level of education and exam monitoring.

Annex III no. 3 AI Act (Regulation (EU) 2024/1689) covers four categories of cases: (a) — AI systems intended to be used 'to determine access or admission or to assign natural persons to educational and vocational training institutions at all levels'; (b) — systems 'to evaluate learning outcomes', including where those outcomes are used to steer the learning process; (c) — systems 'for the purpose of assessing the appropriate level of education that an individual will receive or will be able to access, in the context of or within educational and vocational training institutions at all levels'; (d) — systems 'for monitoring and detecting prohibited behaviour of students during tests'.

What matters is the intended purpose, not the product name; typical examples in this area are the assessment of pupils and students as well as plagiarism detectors with an effect on grading. Under Art. 6(3) AI Act, a system listed in Annex III is exceptionally not considered high-risk where it does not pose a significant risk to health, safety or fundamental rights — the exception falls away, however, as soon as the system performs profiling of natural persons. Where it produces recommendations or assessments that can materially influence human decisions, it remains high-risk despite Art. 6(3). Practical recommendation: interpret the exception narrowly, classify as high-risk in case of doubt and record the reasons for the decision in the AI inventory.

2. Obligations from 2 December 2027 (Regulation (EU) 2026/1744, in force since 27 July 2026)

Which obligation applies to an educational institution depends on its role — provider (Art. 3 no. 3) or deployer (Art. 3 no. 4); the obligations of Chapter III Sections 1 to 3 apply to Annex III high-risk systems from 2 December 2027 (Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026).

Conformity assessment, bias testing, transparency, human oversight — these deployer and provider obligations apply to all institutions concerned, each according to its role as provider or deployer (table below). The FRIA (fundamental rights impact assessment, Art. 27), by contrast, does not apply across the board: under Art. 27(1) AI Act, it is carried out only by deployers 'that are bodies governed by public law, or are private entities providing public services', as well as by deployers of high-risk AI systems referred to in Annex III no. 5 (b) and (c). Public schools and universities as well as private providers delivering public services are therefore covered — purely commercial training providers are not.

The table reproduces only statutory obligations under the AI Act, no practical recommendations.

One clarification on registration: the provider obligation under Art. 49(1) applies to all Annex III systems with the single exception of no. 2 — education systems under no. 3 are covered. Under Art. 49(2), providers that classify their system as not high-risk under Art. 6(3) register in addition. The Digital Omnibus has been in force as Regulation (EU) 2026/1744 since 27 July 2026: the obligations of Chapter III Sections 1 to 3 therefore apply to Annex III systems from 2 December 2027 (Art. 113(3)(c)(i) AI Act as amended).

3. Particularly sensitive data: Art. 9 GDPR

In education, health and disability data are frequent — special categories of personal data under Art. 9 GDPR (Regulation (EU) 2016/679). The processing of such data for the detection and correction of bias in high-risk AI is governed by Art. 10(5) AI Act (data and data governance) — not Art. 9 AI Act, which concerns the risk management system.

Art. 9(1) GDPR subjects this data to a general prohibition on processing — covered are, among others, health data, data on racial and ethnic origin, religious or philosophical beliefs as well as biometric data for the purpose of uniquely identifying a person; exceptions are set out in paragraph 2, for example explicit consent. Independently of this, every processing operation requires a legal basis under Art. 6(1) GDPR, whereby point (f) (legitimate interests) does not apply to processing carried out by public authorities in the performance of their tasks. Anyone relying on consent must be able to demonstrate it; it can be withdrawn at any time, and withdrawal must be as easy as giving consent (Art. 7(1) and (3) GDPR). Practical recommendation: document the legal basis separately for each purpose — admission, performance assessment and exam invigilation are different purposes.

4. Prohibition of emotion detection in exams

Art. 5(1)(f): emotion detection in education is prohibited — including in anti-cheating software.

The prohibition of emotion recognition in the workplace and in educational institutions is part of the catalogue of prohibited AI practices in Art. 5(1) AI Act and has applied since 2 February 2025 under Art. 113 AI Act (Chapters I and II); Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026, has not changed this. For examinations, a sharp two-way split follows: a proctoring system that recognises or infers emotions falls under the prohibition. An invigilation system without emotion recognition, intended only to detect prohibited behaviour during tests, is permitted, but is high-risk AI under Annex III no. 3 (d) — with the obligations set out in section 2. The penalty framework also draws a sharp line: infringements of Art. 5 are sanctioned with up to EUR 35 million or 7 % of worldwide annual turnover, whichever is higher (Art. 99(3)). Practical recommendation: obtain written confirmation before procurement of which features the system evaluates.

5. Information for parents and pupils

Art. 50 + Art. 13 GDPR: transparent information about the use of AI. Right to object.

The transparency obligations of Art. 50 AI Act have applied since 2 August 2026 and are not tied to the high-risk classification: systems intended to interact directly with natural persons must inform those persons that they are interacting with an AI system (paragraph 1) — the central point for learning chatbots. Providers generating synthetic audio, image, video or text content must mark the outputs in a machine-readable format as artificially generated or manipulated (paragraph 2); deployers who generate or manipulate deep fakes must disclose this (paragraph 4). This must be distinguished from the information of an institution's own employees under Art. 26(7) AI Act — that obligation is addressed to teaching and administrative staff and applies to Annex III systems from 2 December 2027 (Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744). Requests from data subjects under Art. 15 to 22 GDPR must be answered without undue delay, at the latest within one month; the period may be extended by two months where the matter is complex, which must be notified within the first month (Art. 12(3) GDPR).

6. FRIA and DPIA: two assessments with their own triggers

The FRIA and the data protection impact assessment are two separate assessments, each with its own trigger and its own legal reference — one follows from the AI Act, the other from the GDPR.

In substance, the FRIA covers the description of the AI use, the persons affected, the risks to fundamental rights and the safeguards. In educational institutions, both triggers frequently coincide: a learning analytics system that systematically evaluates performance data and in doing so processes health or disability data touches both the profiling criterion and the special categories of data under Art. 9 GDPR. Practical recommendation: carry out both assessments in a single data-gathering run, but present them separately — auditors expect the respective legal reference, not a combined document.

7. EdTech procurement: roles, contracts, change of role

Anyone purchasing an educational AI system is generally a deployer — provider obligations arise only in the case of a substantial modification or of placing the system on the market under one's own name (Art. 25 AI Act).

Three points belong in every procurement. Clarifying the role: a provider is anyone who develops an AI system or places it on the market; a deployer is anyone who uses it under their own authority. If a university converts a purchased system into its own, differently marketed system, the change of role under Art. 25 AI Act applies, with the full provider package from section 2. Data processing agreement: only Data Processors providing sufficient guarantees of appropriate technical and organisational measures may be used; the contract must set out the subject matter and duration, the nature and purpose of the processing, the type of data, the categories of data subjects as well as the obligations and rights of the controller (Art. 28(1) and (3) GDPR). Learning platform technology: in Germany, storing information on terminal equipment or accessing it is permitted only with prior, informed consent; no consent is required where access is strictly necessary in order to provide a digital service expressly requested (§ 25(1) and (2) TDDDG). Practical recommendation: treat ISO 42001 as one building block, not as a full substitute — conformity assessment (Art. 43), EU database entry (Art. 49) and the FRIA (Art. 27) are not covered by it.

8. Data protection officers: obligation to designate in DE and AT

The obligation to designate follows first of all directly from Art. 37(1) GDPR — processing by a public authority or body (point (a)), regular and systematic monitoring on a large scale as a core activity (point (b)) or processing on a large scale of special categories of data as a core activity (point (c)). The supplementary national threshold differs:

• Germany: in addition to Art. 37(1)(b) and (c), a data protection officer must be designated where, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data — and irrespective of that number where processing operations are subject to a DPIA under Art. 35 GDPR (§ 38(1) BDSG).
• Austria: no numerical designation threshold going beyond Art. 37 GDPR; the obligation follows directly from Art. 37 GDPR. § 5 DSG additionally governs confidentiality and independence from instructions in the public sector (§ 5 DSG).

For educational institutions, the second German trigger is the more relevant one in practice: anyone who has to carry out a DPIA for a learning analytics or examination system designates a DPO in Germany irrespective of the 20-person threshold.

9. Anti-discrimination protection in access to education: AGG and GlBG

Alongside the AI Act, anti-discrimination law applies — and here Germany and Austria differ in their point of reference and in the standard of proof.

Access to educational services. In Germany, discrimination on grounds of race or ethnic origin, sex, religion, disability, age or sexual identity is impermissible in civil-law obligations that typically come about without regard to the person in a large number of cases (mass transactions) or that concern private insurance; for race and ethnic origin, the prohibition applies comprehensively beyond that (§ 19(1) and (2) AGG). Civil-law claims must be asserted within two months (§ 21(5) AGG). In Austria, § 31 GlBG expressly names education: no one may be discriminated against directly or indirectly on grounds of ethnic affiliation, among others in access to goods and services, in social protection, in social advantages and in education.

Staff selection by the institution. Where a school or university uses AI for its own staff selection, the case falls under Annex III no. 4, not no. 3. The standard of proof differs: in Germany, under § 22 AGG the other party bears the burden of proving that there was no infringement once indications of discrimination have been established. In Austria, the person concerned must establish the discrimination as credible; the defendant party then bears the burden of proving that, weighing all circumstances, it is more likely that another motive was decisive or that a ground of justification exists (§ 12(12) GlBG for sex, § 26(12) for the remaining grounds).

10. Penalty framework: AI Act and GDPR side by side

A faulty use of AI in education can trigger two penalty regimes — that of the AI Act and that of the GDPR together with national supplements.

Three clarifications: for the administrative offences under § 43 BDSG — it covers the § 30 cases, that is the faulty handling of a request for information and the notification of consumers, framework up to EUR 50,000 — no fines are imposed on public authorities and other public bodies; this concerns § 43 BDSG only, not the framework of Art. 83 GDPR. In Austria, § 62(1) DSG applies only subsidiarily: unless the act already constitutes an offence under Art. 83 GDPR or is subject to more severe penalties under other administrative penal provisions, an administrative offence exists — for example intentional unlawful access to a data processing operation — which is to be sanctioned with a fine of up to EUR 50,000; the Austrian Data Protection Authority (Datenschutzbehörde) is competent. And infringements of Art. 4 AI Act (AI literacy) do not fall under Art. 99(4) — they have no separate EU fine framework, penalties in that respect follow national law (Art. 99(1)).

11. Implementation steps for educational institutions (practical recommendation)

The following sequence is a practical recommendation, not a statutory deadline — the statutory dates are set out in sections 2, 4 and 5.

1. Build an AI inventory — for each system: name and provider, use case, role, risk class, types of data including special categories under Art. 9 GDPR, persons responsible for oversight and escalation.
2. Art. 5 screening of every examination and invigilation system (section 4), followed by the Annex III allocation and a narrow assessment of Art. 6(3) (section 1).
3. Record the role and allocate the obligations from the table in section 2; plan the FRIA and DPIA according to the triggers in section 6.
4. Anchor deployer obligations technically — log retention, input data relevance check as a work step, document the information of employees (Art. 26(4), (6) and (7) AI Act).
5. Record the final human decision — human oversight under Art. 14 AI Act is part of the catalogue of obligations for Annex III systems; assessment and admission decisions need a named deciding person.
6. Ensure AI literacy under Art. 4 AI Act for all persons who come into contact with AI — this obligation has applied since 2 February 2025.

Practical rhythm (not a statutory deadline): update the inventory and role allocation once a year and on an ad hoc basis whenever an examination or assessment system changes release; classify new tools before the pilot operation, not afterwards.