Education is one of the areas the AI Act looks at particularly closely. Decisions about admission, assessment and exams shape life paths, and those affected are often young people. For EdTech providers and educational institutions this means: some applications are prohibited, some high-risk, and competence and transparency duties apply to almost all.
What is prohibited
Since February 2025, using AI systems to infer emotions in educational institutions has been prohibited, except for medical or safety reasons. A tool meant to infer learners’ attention or mood from facial expressions or voice falls under this. The overview is in the glossary under prohibited AI practices.
What is high-risk
Annex III names four case groups for education and vocational training: AI systems determining access or admission to educational institutions; systems evaluating learning outcomes, including when used to steer the learning process; systems assessing the level of education a person will receive or can access; and systems monitoring and detecting prohibited behaviour during tests. From 2 December 2027 the full high-risk obligations apply to these.
Not every AI in teaching is high-risk. An assistant phrasing explanations or a tool translating teaching material is usually not covered by Annex III. Whether a system can claim an exception under Art. 6(3) must be checked carefully and documented; the approach is described in our article on risk classification.
Duties for EdTech providers
Providers of a high-risk education system need a risk management system, data governance that detects bias, for example by origin or language, technical documentation, logging, understandable instructions for schools, means for human oversight, a conformity assessment and registration. Systems outside the high-risk area are subject to transparency obligations, such as the chatbot notice, and the AI literacy duty.
Duties for schools and universities
Educational institutions are usually deployers. They use high-risk systems according to the instructions, assign oversight to competent people, inform learners and teachers and keep logs. Public institutions must carry out a fundamental rights impact assessment before deploying a high-risk system. And AI literacy measures apply to all staff working with AI.
Data protection remains central
Education data often concerns minors and is particularly sensitive. Alongside the AI Act, data protection law applies and in many cases a data protection impact assessment; the interplay is described in the AI Act and the GDPR.
The Swiss view
For Swiss schools the AI Act applies only where there is an EU nexus. For public schools, cantonal data protection laws are decisive; for private providers, the revised FADP. Swiss EdTech providers with customers in the EU, by contrast, fall under the AI Act as providers; for them it pays to align products with the high-risk requirements from the start where Annex III applies.
What to do now
1. Record all AI features in the product or institution and check them against the bans and Annex III.
2. Remove emotion recognition features.
3. For high-risk candidates, draw up a roadmap to December 2027.
4. Implement transparency and AI literacy immediately.
5. Carry out data protection impact assessments for applications using learning data.
For classifying individual systems, AI Risk Check fits; we support implementation through high-risk conformity.