Is your educational AI high-risk under the AI Act?
The AI Act (Regulation (EU) 2024/1689) classifies four AI use cases in education as high-risk (Annex III, point 3):
- 3(a): AI to determine access or admission to educational or vocational training institutions
- 3(b): AI to evaluate learning outcomes, including where outcomes steer the learning process (adaptive learning)
- 3(c): AI to assess the appropriate level of education
- 3(d): AI to monitor and detect prohibited behaviour of students during tests (proctoring)
Emotion recognition prohibition: Art. 5(1)(f) prohibits AI systems inferring emotions of natural persons in the workplace and educational institutions, except for medical or safety reasons. This prohibition has been in force since 2 February 2025.
Emotion recognition as high-risk: Where emotion recognition is not prohibited, it is classified as high-risk under Annex III point 1(c).
Remote biometric identification: Remote biometric identification (Annex III point 1(a)/(b)) may be high-risk or prohibited depending on the context and inferred attributes.
Children's data (GDPR + LOPDGDD): Art. 8 GDPR sets the conditions for children's consent in information society services. The LOPDGDD Art. 7 sets the minimum consent age at 14 in Spain. Children under 14 cannot give valid consent; parental consent is required.
- Annex III point 3 classification — We determine whether your educational AI is high-risk
- Art. 5(1)(f) audit — We verify your AI does not infer emotions in education (prohibited)
- Children's data analysis — We identify the legal basis and parental consent (LOPDGDD Art. 7)
- Educational DPIA — We carry out the Art. 35 GDPR Impact Assessment for children's and biometric data
- Technical documentation — We prepare the Art. 11 documentation for high-risk educational AI
AI Act obligations for high-risk Edtech
If your educational AI is high-risk (Annex III point 3), the AI Act obligations are:
For providers (developers):
- Risk management system (Art. 9)
- Training data quality (Art. 10), critical to avoid bias in assessment
- Technical documentation and record-keeping (Art. 11)
- Transparency and information for deployers (Art. 13)
- Human oversight (Art. 14)
- Accuracy, robustness and cybersecurity (Art. 15)
- Conformity assessment (Art. 6 + Annex III)
- Registration in the EU database (Art. 49)
For deployers (educational institutions):
- Designate staff with competence for human oversight (Art. 26(2))
- Carry out FRIA (Art. 27) before deploying the system
- Notify serious incidents (Art. 73)
- Follow the provider's instructions
Emotion prohibition (Art. 5(1)(f)): Any system inferring students' emotions is prohibited, except for medical or safety reasons. This prohibition has been in force since 2 February 2025.
Timeline: High-risk systems under Annex III must comply before 2 December 2027. Prohibited practices under Art. 5 have been in force since 2 February 2025.
AI use cases in Edtech and their classification
| Use case | AI Act classification | Applicable rule |
|---|---|---|
| AI for admission to educational institutions | High risk | Annex III, point 3(a) |
| AI for learning assessment | High risk | Annex III, point 3(b) |
| AI for educational level assessment | High risk | Annex III, point 3(c) |
| AI for exam proctoring | High risk | Annex III, point 3(d) |
| AI for emotion recognition | Prohibited | Art. 5(1)(f) |
| AI for remote biometric identification | High-risk or prohibited | Annex III point 1 + Art. 5 |
| Tutoring chatbot | Limited risk | Art. 50(1) transparency |
| AI for content recommendation | Minimal (generally) | GDPR |
Real enforcement cases in edtech
- AEPD — School fine, €10,000 (2025) — Creation of a child’s electronic profile without parental consent (Arts. 6, 13 and 32 GDPR). Source: PSN Sercon blog
- AEPD — Report on facial recognition in online exams: AEPD
- AEPD — Resolution on biometric proctoring at a university: AEPD
- AEPD — Guide for educational institutions: AEPD
- AEPD — Principles for digital educational platforms: AEPD
AI Act compliance checklist for Edtech
- Identify all AI uses in the educational product
- Classify under Annex III point 3 (a, b, c, d)
- Verify no emotion inference (Art. 5(1)(f), prohibited)
- Verify no prohibited remote biometric identification
- Implement risk management system (Art. 9)
- Document training data quality (Art. 10), avoiding bias
- Prepare technical documentation (Art. 11)
- Establish human oversight (Art. 14)
- Carry out conformity assessment (Art. 6 + Annex III)
- Register in EU database (Art. 49)
- Carry out Art. 27 FRIA (educational institution deployers)
- Carry out Art. 35 GDPR DPIA for children’s and biometric data
- Verify parental consent (LOPDGDD Art. 7, under 14s)
- Comply with Art. 8 GDPR (children’s consent conditions)
Official sources
- Regulation (EU) 2024/1689 (AI Act): EUR-Lex
- Annex III point 3 (education): AI Act Service Desk
- Art. 5(1)(f) (emotion prohibition): AI Act Service Desk
- LOPDGDD (Organic Law 3/2018): BOE
- GDPR Art. 8 (children’s consent): EUR-Lex
Related resources
- AI Act Hub — Resource centre on the European AI Regulation
- AI Act Glossary — 45+ key terms with article references
- GDPR Glossary — 45+ key terms of the GDPR and LOPDGDD
- AI Act vs GDPR — Comparative table of both regulations
- AI Act Compliance Checker — Self-assess your AI system
- AI & Data Regulation Service — Integrated advisory
- GDPR for Edtech — Sectoral GDPR guide for edtech
This page is general information, not legal advice. Each AI system must be analysed individually. Fines and deadlines cited are based on Regulation (EU) 2024/1689 in force at the date of publication.