AI used in admissions, grading, exam proctoring, and learning assessment falls under Annex III, point 3 (education and vocational training). If your AI influences who gets admitted, how students are graded, or whether they pass — you have until December 2, 2027 — 561 days — to comply.
Annex III, point 3 covers AI intended for use in education and vocational training — specifically systems that determine access to education, assess learning outcomes, or monitor students.
AI that evaluates applications, ranks candidates, or determines admission eligibility for educational institutions
Automated grading tools, essay scoring engines, or AI that evaluates student performance and assigns marks
AI systems that monitor students during examinations, flag suspicious behaviour, or make decisions about exam validity
AI that determines student proficiency levels, recommends educational pathways, or decides access to educational programmes
Not every EdTech AI tool triggers Annex III. The deciding factor is whether the AI determines access to education or evaluates student outcomes in ways that materially affect their educational path.
Even if your system is not high-risk, transparency obligations under Article 50 may still apply. Run the free classifier to find out.
Each must be in place before December 2, 2027. Non-compliance risks fines up to €15 million or 3% of global turnover.
Provider vs deployer matters
Most educational institutions using third-party AI tools are classified as deployers, not providers. Deployers have lighter obligations — but you still need to ensure AI systems are used according to the provider's instructions, conduct a fundamental rights impact assessment (FRIA), and maintain human oversight. If you've built your own AI system in-house, you're the provider and face the full set of obligations.
Read: Deployer vs Provider — which are you? →Some work carries over
Handling student data under GDPR means you already have data protection processes and impact assessments. These partially cover AI Act Articles 9 and 10. But the AI Act adds requirements GDPR doesn't cover: model accuracy documentation, bias testing across protected groups, conformity assessment, and continuous post-market monitoring.
See the full GDPR overlap mapping →