Is AI grading high-risk under the EU AI Act?

Which education uses are high-risk?

• The four in point 3 of Annex III. EU AI Act for education and edtech covers the sector.
• Chapter III, Sections 1, 2 and 3, which hold the high-risk requirements and the deployer duties of Article 26, apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, with the exception of Article 6(5) (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

• Point 3 of Annex III, education and vocational training: AI systems intended to be used (a) to determine access or admission or to assign natural persons to educational and vocational training institutions at all levels; (b) to evaluate learning outcomes, including when those outcomes are used to steer the learning process of natural persons in such institutions; (c) for the purpose of assessing the appropriate level of education that an individual will receive or will be able to access, in the context of or within such institutions; (d) for monitoring and detecting prohibited behaviour of students during tests in the context of or within such institutions.

Can a grading tool be exempt?

Only under Article 6(3), and only if it does not materially influence the outcome. When an Annex III use is not high-risk after all, condition by condition: the Article 6(3) exemption.

• Article 6(3): by derogation from Article 6(2), an Annex III system is not considered high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. That applies where any one of four conditions is fulfilled: the system is intended to perform a narrow procedural task; it is intended to improve the result of a previously completed human activity; it is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; or it is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III. An Annex III system that performs profiling of natural persons is always considered high-risk, and a provider who considers an Annex III system not high-risk documents that assessment before placing it on the market or putting it into service, and is subject to registration under Article 49(2) (Article 6(4)).

What does the school owe as deployer?

• The Article 26 duties, and an explanation on request.
• A public school can be a body governed by public law and a private school a private entity providing public services, and a deployer that is either performs the assessment in Article 27(1).
• Article 27 sits in Chapter III, Section 3, which applies from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).
• Every paragraph, with its exceptions: what a deployer owes under Article 26.

• Article 26(1) and (2): take appropriate technical and organisational measures to use the system in accordance with its instructions for use, and assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.
• Article 86(1): an affected person subject to a decision taken by the deployer on the basis of the output from a high-risk AI system listed in Annex III, with the exception of systems listed under point 2, which produces legal effects or similarly significantly affects that person in a way that they consider to have an adverse impact on their health, safety or fundamental rights, has the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken. The right does not apply where exceptions from, or restrictions to, it follow from Union or national law in compliance with Union law, and it applies only to the extent it is not otherwise provided for under Union law (Article 86(2) and (3)).
• Article 27(1): before deploying a high-risk AI system referred to in Article 6(2), with the exception of one intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5(b) and (c) of Annex III, perform an assessment of the impact on fundamental rights that the use of the system may produce. It consists of a description of the deployer’s processes in which the system will be used in line with its intended purpose; the period of time within which, and the frequency with which, it is intended to be used; the categories of natural persons and groups likely to be affected by its use in the specific context; the specific risks of harm likely to have an impact on them, taking into account the information given by the provider under Article 13; a description of the implementation of human oversight measures, according to the instructions for use; and the measures to be taken if those risks materialise, including the arrangements for internal governance and complaint mechanisms.