The four Annex III §3 categories
- §3(a) Admissions and assignment. University admissions scoring, school allocation algorithms, gifted-and-talented placement, course-streaming AI.
- §3(b) Learning outcome evaluation. Automated essay scoring, AI-assisted formative feedback, language-proficiency assessment, the AI components of standardised tests.
- §3(c) Level placement. Adaptive learning systems that decide which content a student sees next based on predicted ability.
- §3(d) Proctoring and cheating detection. Live and recorded proctoring AI, plagiarism detection, behavioural anomaly detection during online assessments.
EdTech vendor obligations
- Article 9 risk management — calibrated to the educational stake (a high-stakes admissions AI is a higher risk profile than a homework-help chatbot).
- Article 10 data governance — representativeness across linguistic backgrounds, cultural contexts, and special educational needs. Bias testing for non-native speakers and for students with disabilities is the principal exposure.
- Article 13 instructions for use written for teachers and registrars, not engineers.
- Article 14 design for oversight — a teacher must be able to override an AI grade or admissions score with full information.
- Internal Annex VI conformity assessment is the default route. A notified body is not required for §3 systems.
School and university obligations
- Article 26(1) intended-purpose use: a writing-assessment AI must not be repointed at admissions decisions.
- Article 26(2) human oversight by staff with the competence to interpret AI outputs.
- Article 26(7) information to teaching staff — both because they are workers, and because they need to operate the system.
- Article 27 fundamental rights impact assessment for public bodies (most state schools, most public universities).
- Article 50 transparency to students. For minors, this extends to parents and guardians under national child-protection rules.
- GDPR Article 22 review for solely automated admissions or grading decisions with significant effect.
Where AI Act and GDPR collide on proctoring
Proctoring AI is the most-litigated education AI use case. The Italian Garante (decision 9709974, 2021) and the Dutch AP (decision z2020-04875) have both taken action against universities for proctoring deployments that were disproportionate, processed special-category data without a clear legal basis, or did not offer meaningful alternatives. Under the AI Act, every Article 9–15 obligation applies to proctoring AI. The vendor must show the system was tested on diverse populations; the university must show a less-intrusive alternative exists for students who decline.
Enforcement
National DPAs are likely to be the first movers on education-AI enforcement, drawing on existing GDPR case law. The market surveillance authorities for AI Act enforcement vary by Member State — in France the Direction de l'enseignement supérieur de la recherche et de l'innovation has signalled coordination with CNIL; in Germany the LfDIs are likely to retain a leading role for school-level AI.