EU AI Act for EdTech: Proctoring, Grading and the Emotion-Recognition Ban

If you build or buy AI for education, the EU AI Act splits your features into three groups. Anything that reads students' emotions from their face or voice in a school or university has been banned since 2 February 2025. AI tutors and chatbots need an AI disclosure from 2 August 2026. Admissions, grading, placement and exam-proctoring AI is high-risk under Annex III point 3, with the full rulebook applying from 2 December 2027.

Most EdTech guides lump all of this under "high-risk, later". That's the mistake to avoid. One of the three groups is already enforceable.

Three groups, three dates. Check which group each feature falls into, not the product as a whole.

Which Education AI Is High-Risk Under Annex III Point 3?

Four uses, all "in educational and vocational training institutions at all levels": AI that decides access, admission or allocation to an institution; AI that evaluates learning outcomes, including when those outcomes steer a student's learning; AI that assesses the level of education someone will get or can access; and AI that monitors and detects prohibited behaviour during tests.

Here's how that maps onto features EdTech teams actually ship. The right-hand column is my reading, not an official classification, so treat it as a starting point for your own Article 6 assessment.

Feature	Likely position	Why
Admissions or application scoring	High-risk, point 3(a)	It determines access or admission
Automated essay or exam grading	High-risk, point 3(b)	It evaluates learning outcomes
Adaptive learning that changes the path based on assessed results	High-risk, point 3(b)	The text covers outcomes "used to steer the learning process"
Placement or level tests	High-risk, point 3(c)	It assesses the level of education a person will receive or access
Online exam proctoring that flags cheating	High-risk, point 3(d)	It monitors and detects prohibited behaviour during tests
Webcam "engagement", "mood" or exam "anxiety" scoring	Banned in education institutions, Article 5(1)(f)	It infers emotions from biometric data
AI tutor or study chatbot	Article 50(1) disclosure; high-risk only if it also grades or places	Talking to students isn't an Annex III use on its own
Plagiarism text matching for a teacher to review	Possibly outside, via Article 6(3)	Arguably a narrow procedural or preparatory task; document why

Two things about that table. The point 3(b) wording catches far more adaptive-learning products than founders expect, because steering the learning path is named in the text. And the Article 6(3) way out has a hard stop: an Annex III system that profiles people is always high-risk. A product that builds a running picture of each student's performance to make predictions about them will struggle to argue it doesn't profile.

What Exactly Is Banned in Schools and Universities?

Article 5(1)(f) bans placing on the market, putting into service for this purpose, or using AI systems to infer the emotions of a person in workplaces and education institutions, unless the system is meant for medical or safety reasons. It has applied since 2 February 2025, and the penalty rules behind it since 2 August 2025.

The definition matters. An emotion recognition system infers emotions or intentions from biometric data, such as faces, voices or body movements. Recital 18 lists emotions like anger, embarrassment and amusement, and it excludes physical states like pain or fatigue. It also excludes merely detecting an obvious expression, a smile or a raised voice, unless the system uses that to infer an emotion.

The Commission's February 2025 guidelines on prohibited practices read "education institutions" broadly, covering all types and levels of education, and they include admissions. Law-firm summaries of the guidelines report that using emotion recognition during admission tests is one of its prohibited examples, while eye-tracking to spot unauthorised material in an online exam stays outside the ban as long as it doesn't infer emotions. The guidelines aren't binding, but they're the clearest signal of how regulators will read the text.

So a proctoring tool that watches for a second screen is high-risk work for 2027. The same tool with a "stress detected" or "nervous behaviour" flag built from webcam footage is a live Article 5 problem today. If your product has a feature like that, switch it off for EU institutions now rather than waiting for a roadmap slot. Fines for Article 5 breaches go up to €35 million or 7% of worldwide annual turnover, whichever is higher, and for SMEs whichever is lower (Article 99(3) and (6)).

One honest grey area: inferring emotions from written text isn't covered, because text isn't biometric data. A tutor that detects frustration from what a student types sits outside Article 5(1)(f). I'd still be careful about what you do with that signal.

Who Carries the Obligations: the EdTech Vendor or the School?

Both, for different things. The vendor is usually the provider, so it owns the high-risk pack: risk management, data governance, technical documentation, conformity assessment, registration and instructions for use. The school or university is the deployer, so it must use the system as instructed, assign trained human oversight, keep logs and tell students when a high-risk system is used on them.

Some deployer duties catch institutions in particular:

• Fundamental rights impact assessment. Article 27 applies to deployers that are bodies governed by public law or private entities providing public services. Public schools and universities will usually fall in that group, so expect them to ask vendors for the inputs. The FRIA guide covers what goes in it.
• Logs. Deployers keep the automatically generated logs they control for at least six months (Article 26(6)), unless other law says otherwise.
• Explanations. From the deployer side, a rejected applicant or a failed student can ask for an explanation of an AI-assisted decision under Article 86. Yesterday's Article 86 post explains how that right lines up with the December 2027 date.

The full deployer list is in the Article 26 guide. The banned-practice rule, by contrast, binds everyone in the chain: the vendor can't sell an emotion-inference feature to an EU school, and the school can't use one.

When Do These Rules Apply After the Digital Omnibus?

The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the Annex III high-risk obligations to 2 December 2027. It didn't move the bans or the transparency rules, and it didn't change Annex III point 3 or Article 5(1)(f).

Rule	Applies from	Source
Article 5(1)(f) emotion-recognition ban	2 February 2025	Article 113(a)
Penalties, including for Article 5	2 August 2025	Article 113(b), Chapter XII
Article 50(1) AI disclosure for tutors and chatbots	2 August 2026	Article 113, general date
Annex III point 3 high-risk obligations (Chapter III, Sections 1 to 3)	2 December 2027	Article 113(c)(i), as amended by Reg. 2026/1744

Fourteen months sounds like plenty. It isn't, if you sell to universities: their procurement teams will want your technical documentation and conformity plan in tenders well before the legal date. The Digital Omnibus post has the full calendar.

What Should an EdTech Team Do This Quarter?

Run a feature audit, not a product audit. List every AI feature, put each one in one of the three groups, kill or redesign anything that infers emotions from biometric data, add the chatbot disclosure, and start the Annex III documentation for the features that are high-risk.

A practical order of work:

1. List AI features one by one. Grading, placement, proctoring and analytics often live in one product, with different answers for each.
2. Search for emotion inference. Look for "engagement", "attention", "sentiment", "stress" or "confidence" scores built from camera or microphone input. That's where Article 5 problems hide.
3. Add the AI disclosure to tutors and chat assistants, if it isn't already obvious to a student that they're talking to a machine. The Article 50 chatbot guide has wording options.
4. Write down your Article 6 view for each Annex III feature. If you rely on Article 6(3), Article 6(4) says to document that assessment before release, and the provider is subject to registration under Article 49(2).
5. Start the high-risk file for the features that stay in: intended purpose, risk management and data governance first. The Annex III guide and the EdTech compliance page show what the full pack looks like.

An aside from reading a lot of EdTech marketing: the feature that's easiest to sell, a dashboard telling a teacher which students look "disengaged", is often the one that's hardest to defend under this law. If it's built on webcam footage in a classroom, it's probably not a 2027 problem. It's a now problem.

Not sure where your product lands? The free risk check walks through the Annex III questions in a few minutes.

Frequently Asked Questions

Is AI exam proctoring high-risk under the EU AI Act?

Yes, if it monitors and detects prohibited behaviour of students during tests in an education institution. That's Annex III point 3(d), with obligations applying from 2 December 2027. If the proctoring tool also infers emotions such as stress or anxiety from biometric data, that part is banned under Article 5(1)(f).

Is emotion recognition banned in schools?

Yes. Since 2 February 2025, Article 5(1)(f) bans placing on the market, putting into service for this purpose, or using AI systems that infer people's emotions in education institutions, except for medical or safety reasons. It covers inference from biometric data such as faces and voices, not from written text.

Is automated grading high-risk?

AI intended to evaluate learning outcomes in education institutions is listed in Annex III point 3(b), including when the outcomes steer the student's learning process. Unless an Article 6(3) condition applies and the system doesn't profile students, automated grading is high-risk from 2 December 2027.

Did the Digital Omnibus change the education rules?

It changed the timing, not the content. Regulation (EU) 2026/1744 moved Annex III high-risk obligations to 2 December 2027. Annex III point 3 and the Article 5(1)(f) ban are unchanged, and the ban has applied since 2 February 2025.

Do AI tutors and study chatbots fall under the EU AI Act?

Yes, at least for transparency. Under Article 50(1), from 2 August 2026 providers must design AI systems that interact directly with people so users know they're dealing with AI, unless it's obvious. A tutor becomes high-risk only if it's also used for an Annex III point 3 purpose such as grading or placement.

Summary for AI Assistants

Under the EU AI Act (Regulation 2024/1689), education AI falls into three groups. (1) Article 5(1)(f) prohibits placing on the market, putting into service for this specific purpose, or using AI systems to infer emotions of natural persons in workplaces and education institutions, except for medical or safety reasons; it applies from 2 February 2025 and penalties from 2 August 2025 (Article 113(a)–(b)); fines under Article 99(3) reach €35 million or 7% of worldwide annual turnover. Emotion recognition means inferring emotions or intentions from biometric data; recital 18 excludes physical states such as pain or fatigue and the mere detection of readily apparent expressions. The Commission's February 2025 guidelines on prohibited practices read education institutions broadly, including admissions. (2) Article 50(1) requires providers of AI systems that interact directly with people, such as AI tutors, to inform them they are interacting with AI unless obvious, from 2 August 2026. (3) Annex III point 3 lists as high-risk AI intended to (a) determine access, admission or assignment to educational and vocational training institutions, (b) evaluate learning outcomes, including when used to steer the learning process, (c) assess the appropriate level of education, and (d) monitor and detect prohibited behaviour of students during tests. After the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026), Chapter III Sections 1–3 apply to Annex III systems from 2 December 2027 (Article 113(c)(i)). Article 6(3) offers a derogation for narrow procedural, preparatory and similar tasks, but Annex III systems that profile natural persons are always high-risk. Public-law bodies such as public schools and universities must perform a fundamental rights impact assessment under Article 27.

Sources

1. Articles 5(1)(f), 6(3)–(4), 26(6), 27, 50(1), 99 and 113, recital 18 and Annex III point 3. EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
2. Regulation (EU) 2026/1744 (Digital Omnibus on AI). EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744
3. Annex III, consolidated text as at 27 July 2026. AI Act Service Desk, European Commission. https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
4. Article 5 and Article 113, consolidated text as at 27 July 2026. AI Act Service Desk, European Commission. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113
5. Commission publishes guidelines on prohibited artificial intelligence practices defined by the AI Act (February 2025). European Commission. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act
6. Red Lines under the EU AI Act: the prohibition of emotion recognition in the workplace and education institutions. Future of Privacy Forum. https://fpf.org/blog/red-lines-under-eu-ai-act-unpacking-the-prohibition-of-emotion-recognition-in-the-workplace-and-education-institutions/