EU AI Act compliance for AI in student assessment and exam proctoring
Education is its own Annex III category. Point 3 covers AI used to determine admission, evaluate learning outcomes, assess the appropriate level of education a person will receive, and monitor and detect prohibited behaviour during tests.
Remote proctoring is explicitly in scope, and it carries an additional problem. Systems that infer a student’s emotional state run into the Article 5 prohibition on emotion inference in educational institutions.
Are you a provider or a deployer?
A school, university, or training provider using a proctoring platform is the deployer. An edtech company building the platform is a provider with heavier duties.
How this is classified under the Act
Annex III point 3 names admission decisions, evaluation of learning outcomes, assessment of the appropriate level of education, and monitoring for prohibited behaviour during tests. Automated grading and AI proctoring both fall within it.
What changes the answer: Article 5(1)(f) prohibits emotion inference in educational institutions outside medical and safety purposes. Proctoring that scores stress, attention, or suspicion from facial expression can be a prohibited practice rather than a high-risk one.
Want this checked against your own setup?
Run the free 6-question check →Documents you need
- AI Literacy Policy Article 4
A written policy covering which AI tools you use, which roles interact with them, what those people need to understand, who owns the document, and how it gets updated. Enforceable since 2 February 2025.
- Risk Classification Memo Articles 6, 9 and Annex III
A documented assessment placing each AI system in the Act’s risk tiers, including the Article 5 prohibited-practice check and the Article 6(3) exception assessment, with article citations.
- Usage Policy for Deployers Article 26
Defines permitted and prohibited uses, human oversight arrangements, input data standards, logging, and incident reporting for a high-risk AI system you deploy.
- Transparency Disclosure Article 50
Informs people when they are interacting with an AI system and labels AI-generated or manipulated content. Article 50 applies from 2 August 2026. The narrower Article 50(2) duty on general-purpose models generating synthetic content applies from 2 December 2026.
Obligations that apply
- Article 5(1)(f) No emotion inference about students
Check whether the proctoring product scores emotional state, attention, or stress. Disable it for educational use and document the decision.
- Article 26(2) Human review of flags and grades
A flagged exam or an automated grade needs review by a qualified person with authority to overturn it, and students need a route to contest the outcome.
- Article 86 Explanation to the student
A student affected by a decision made with a high-risk system can ask for an explanation of the AI’s role. Assessment appeals processes have to be able to answer it.
- Article 27 Fundamental rights impact assessment
Public bodies and certain other deployers must complete a fundamental rights impact assessment before deployment. Most public education providers fall into this group.
Common mistakes
- Deploying proctoring with behavioural or emotional scoring without checking Article 5 first.
- Treating an automated integrity flag as a finding rather than a signal for human review.
- Giving students no way to contest an AI-influenced grade or flag.
- Public institutions overlooking the Article 27 fundamental rights impact assessment.
Where the deadlines stand
The AI literacy obligation under Article 4 and the Article 5 prohibitions have been enforceable since 2 February 2025. General-purpose AI model rules applied from 2 August 2025. The Omnibus, published in the Official Journal on 24 July 2026, moved the high-risk dates: standalone high-risk systems under Annex III to 2 December 2027, and high-risk AI embedded in regulated products under Annex I to 2 August 2028. Article 50 transparency obligations still apply from 2 August 2026. Only the narrower Article 50(2) duty on general-purpose models generating synthetic content moved, to 2 December 2026, which is also when the new prohibition on AI-generated intimate imagery and child sexual abuse material takes effect.
The delay applies to the high-risk obligations. It does not move Article 4, which is why a written AI literacy policy is the document most companies are missing today.
Generate your 4 documents in about 30 minutes
Answer a short questionnaire and get every document above, pre-filled with your company details and article citations, in 11 EU languages. Preview free, download for €99 one-time. No subscription.
This page describes obligations under Regulation (EU) 2024/1689 as amended by the Omnibus published in the Official Journal on 24 July 2026, and was verified on 29 July 2026. It is general information rather than legal advice, and classification depends on your specific configuration and use. Review by qualified legal counsel is recommended before formal adoption of any compliance document.