AI Grading and Proctoring Under the EU AI Act: What Edtech Must Do

Four entries: (a) systems determining access or admission to educational institutions, (b) systems evaluating learning outcomes — including when that evaluation steers the learning process, (c) systems assessing the appropriate level of education a person will receive, and (d) systems monitoring and detecting prohibited student behaviour during tests — that is, AI proctoring.

In product terms: automated essay scoring, admissions ranking, adaptive-learning engines that gate progression, plagiarism-adjacent behaviour detection during exams, and placement algorithms are all candidates for high-risk. A vocabulary app that never scores consequentially is not.

Article 5(1)(f) prohibits AI systems that infer emotions in education institutions (and workplaces), except for medical or safety reasons — and it has applied since 2 February 2025, with the top fine tier of €35M or 7% of turnover.

This lands directly on attention-tracking and engagement-scoring features in proctoring and classroom tools. Gaze detection used purely to flag looking away from the screen sits close to the line; inferring frustration, boredom or stress from faces or voices is over it. If you ship this, removing or geo-gating the feature for the EU is the conservative move.

Edtech providers of in-scope systems carry the standard high-risk stack: risk management (Art. 9), data governance and bias examination (Art. 10) — training data skewed by demographics or language background is the classic edtech failure mode — Annex IV technical documentation (Art. 11), logging (Art. 12), instructions enabling teacher oversight (Art. 13), human oversight design (Art. 14), accuracy and robustness evidence (Art. 15), conformity assessment, CE marking and EU database registration.

Human oversight deserves design attention, not lip service: Article 14 expects the system to be built so a teacher or examiner can meaningfully review and override outputs — an appeal-proof black-box grade is precisely what the Act targets.

Institutions deploying these systems are deployers under Article 26: use per instructions, competent oversight, input-data quality, monitoring, log retention — and informing students that they are subject to a high-risk AI system. Public educational institutions must additionally complete a fundamental rights impact assessment (Art. 27) before first use.

For vendors this matters commercially: procurement will push these duties into contracts, and the vendor that arrives with documentation ready — instructions for use, oversight guidance, and FRIA support where Article 27 applies — wins the deal against the one that promises it later.

Content-generation aids for teachers, language-practice chatbots, flashcard generators and study planners generally sit in limited or minimal risk — Article 50 disclosure duties at most — provided they do not evaluate outcomes consequentially, gate access or proctor exams. The test is consequence: does the output affect a learner’s access, assessment result or educational path? If it only assists, transparency duties are usually the ceiling.