If you run a private education institution that uses AI systems, start here: at most companies, high risk isn't in the business, it's in HR. Private education breaks that rule: Annex III gives it a whole point with four letters, and between the four they cover almost the entire student cycle.
The four letters of point 3
"(a) AI systems intended to be used to determine access or admission or to assign natural persons to educational and vocational training institutions at all levels;"
"(b) AI systems intended to be used to evaluate learning outcomes, including when those outcomes are used to steer the learning process of natural persons in educational and vocational training institutions at all levels;"
"(c) AI systems intended to be used for the purpose of assessing the appropriate level of education that an individual will receive or will be able to access, in the context of or within educational and vocational training institutions at all levels;"
"(d) AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions at all levels."
Read them in sequence: admission, evaluation, guidance and monitoring. It's the full path a student takes through the institution.
The figure draws the eight areas of Annex III under Article 6(2) and highlights point 3: education and vocational training. A system in these areas may fall within high risk; classification is done system by system, against the specific letter of each point and its exceptions.
Letter (d) is the one nobody sees coming
The first three are recognised right away: a school understands that deciding admissions or scoring exams with AI is serious business.
(d) is another matter. It describes proctoring — the automated monitoring of exams, in person or remote — and there are two reasons it slips out of the inventory.
The first is that it isn't perceived as AI. It's procured as an "exam monitoring system" or comes bundled with the assessment platform. The function that detects behaviour is a component of the product, not the product itself.
The second is that someone else decides it. It's chosen by the academic registrar or the person in charge of exams, not by whoever keeps the technology inventory. It's the same dynamic that leaves HR software out of the inventory in any other sector: the system was bought by a department that isn't part of the conversation about AI.
And what doesn't count, because that matters too
It's worth drawing the line, because a four-letter point invites throwing everything into it.
AI-generated teaching content — materials, exercises, rubrics for staff — doesn't evaluate or decide about anyone. It doesn't fall under point 3.
The institution's administrative management — enrolment, billing, communication with families, AI-assisted office work — doesn't either.
And plagiarism detection deserves a nuance that's easy to miss: if its output is a report that a teacher reviews and decides on, the tool may fall outside high risk under the Article 6(3) derogation — for instance, because it is intended to perform a preparatory task to an assessment — provided it does not materially influence the outcome of the decision and does not perform profiling of natural persons, in which case it is always considered high-risk. If a grade or academic consequence is derived automatically from that output, then a learning outcome is being evaluated, and that is letter (b). The difference isn't only in the software: it's in what it is intended for and what happens with what it returns.
That criterion — what the system decides versus what a person decides using what the system reports — works as a first filter across all four letters, but it doesn't replace the Article 6(3) test: the system must not materially influence the outcome of the decision, one of its four conditions must be met, and it must not perform profiling of natural persons.
What a school needs to look at, and in what order
Three questions, in this order, and none of them is technical.
Which systems play a role in admission, evaluation, guidance or exam monitoring? That's the short list that matters. Everything else at the institution sits outside point 3.
For each one, does it decide or does it inform? And if it informs, does anyone actually look at what it returns before it has consequences?
Who procured it? Because if the answer isn't the same department in all four cases, an inventory built from a single vantage point will come out incomplete.
The other half, forgotten because it's obvious
An educational institution is also an employer. It hires teaching staff, evaluates performance, manages administrative personnel.
Annex III, point 4 applies to it just as it does to any company, and with the same usual blind spot: all the attention goes to point 3 — the sector-specific part — and HR software falls off the map. In education this is especially easy, because point 3 already gives enough work to keep from looking for more.
And the date, which applies equally to all four letters
The Annex III regime is not yet in application. It starts on 2 December 2027, and the date circulating in a good many guides is August 2026, which is wrong. Until that date, no institution has high-risk obligations through this route; what makes sense now is to prepare.
What has applied since 2 February 2025, regardless of classification, is Article 4 on literacy — rewritten by the Digital Omnibus without ceasing to be binding — and Article 5 on prohibited practices, except for Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b), added by Regulation (EU) 2026/1744, which apply from 2 December 2026.
And Article 5 has a prohibition here with a name of its own, one that admits no deadline and no preparation period: inferring emotions in education institutions — just as in the workplace — is prohibited, with a single exception: a system intended to be put in place or into the market for medical or safety reasons. It isn't high risk, it isn't documented and it isn't managed. It stops being used. A system that analyses students' expressions to infer their emotions and so measure attention or engagement doesn't sit in a grey area of this article — it sits outside it. The prohibition is on inferring emotions: detecting a readily apparent expression, gesture or movement without inferring an emotion from it is not, which is also how recital 18 draws the line around emotion recognition.
Content in accordance with Articles 4, 5, 6 and 113 and Annex III of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (Official Journal of the EU, 24 July 2026).
This article is for informational purposes only and does not constitute legal advice.