The EU AI Act treats schools that use AI tools as “deployers”. Emotion-recognition AI has been banned in schools since February 2025. Chatbot transparency rules apply from August 2026. AI used for admissions, grading, placement or exam proctoring counts as high-risk from 2 December 2027, bringing duties on human oversight, monitoring and informing students.
This article summarises the law’s text for school leaders. It is not legal advice.
Does the EU AI Act apply to schools?
Yes, as users of AI. The Act defines a deployer as “a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity” (Article 3(4)). A school that licenses an AI platform for teaching, marking or admissions is a deployer. The vendor is the “provider”, which carries most of the design and conformity duties. International schools in EU member states are covered whatever curriculum they teach.
What changes when?
The Act applies in stages, adjusted in 2026 by the Digital Omnibus on AI, Regulation (EU) 2026/1744. It is dated 8 July 2026 and in force since 27 July 2026.
| Date | What applies to schools |
|---|---|
| 2 February 2025 | Ban on emotion recognition in education (Article 5(1)(f)); original AI literacy duty (Article 4) |
| 27 July 2026 | Omnibus in force; Article 4 replaced with a duty to “support the development of AI literacy” |
| 2 August 2026 | Transparency rules (Article 50), e.g. telling people they are interacting with an AI system |
| 2 December 2027 | High-risk rules for Annex III systems, including education |
| 2 August 2028 | High-risk rules for AI in products covered by Annex I legislation |
Sources: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744.
What is banned in schools?
Emotion recognition, with narrow exceptions. Article 5(1)(f) prohibits “the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons”. It has applied since 2 February 2025. Tools that claim to measure attention, engagement or mood from webcams or voices need scrutiny now, not in 2027. Breaches of Article 5 carry the Act’s highest fines: “up to EUR 35 000 000 or … up to 7 % of its total worldwide annual turnover”, whichever is higher.
Which school AI uses are high-risk?
Four education uses, listed in Annex III, point 3:
| Annex III, point 3 | Typical school example |
|---|---|
| (a) “Determine access or admission or to assign natural persons to educational and vocational training institutions” | AI admissions screening or class allocation |
| (b) “Evaluate learning outcomes, including when those outcomes are used to steer the learning process” | AI marking or adaptive platforms that set the next task from results |
| (c) “Assessing the appropriate level of education that an individual will receive or will be able to access” | AI-driven setting, tier or pathway decisions |
| (d) “Monitoring and detecting prohibited behaviour of students during tests” | AI proctoring |
Not every tool in these areas will be high-risk. Under Article 6(3), an Annex III system “shall not be considered to be high-risk where it does not pose a significant risk of harm”. Examples include a system meant “to perform a narrow procedural task” or “a preparatory task to an assessment”. But a system is “always … high-risk where the AI system performs profiling of natural persons”. The provider must document its assessment if it claims an exception. Ask vendors for that documentation.
What must a school do as a deployer of high-risk AI?
From 2 December 2027, Article 26 requires deployers to:
- Use the system “in accordance with the instructions for use”, with appropriate technical and organisational measures.
- Assign human oversight “to natural persons who have the necessary competence, training and authority, as well as the necessary support”.
- Check input data, where the school controls it, is “relevant and sufficiently representative”.
- Monitor the system, and if it presents a risk, inform the provider and authority “and … suspend the use of that system”.
- Keep logs for “at least six months”, unless other law says otherwise.
- Inform staff: before workplace use, employers “shall inform workers’ representatives and the affected workers”.
- Inform students: deployers of Annex III systems that “make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk AI system”.
Deployers also use the provider’s information to carry out the GDPR data protection impact assessment (Article 26(9)). Public bodies and private entities providing public services must also carry out a fundamental rights impact assessment (Article 27). Breaching deployer obligations can bring fines up to EUR 15 million or 3% of turnover. For SMEs the lower amount applies.
What does the AI literacy duty now require?
Support, not a guaranteed standard. The Omnibus replaced Article 4. Providers and deployers “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”. It adds: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” Staff training on the tools a school uses, recorded in CPD logs, is the practical response. See the AI policy template.
What about chatbots and AI study assistants?
Transparency from 2 August 2026. Article 50(1) requires providers to design AI systems that interact directly with people so that “the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious”. The information must be given “at the latest at the time of the first interaction”. Schools should check that student-facing assistants say so clearly. See deploying an AI study assistant school-wide.
What should schools in Europe do before December 2027?
- Inventory every AI tool and map it to Annex III point 3 or to “not in scope”.
- Remove or disable any emotion-recognition features now.
- Ask vendors in writing whether each tool is high-risk, and for any Article 6(3) assessment.
- Name human overseers for high-risk tools, with training and authority.
- Update privacy notices to tell students and parents where high-risk AI is used.
- Align the DPIA with the provider’s instructions for use.
- Take legal advice on borderline tools, especially marking and adaptive learning.
How schools do this with AI Buddy
AI Buddy marks past-paper-style practice instantly and adapts practice to results, which is the kind of use Annex III point 3(b) describes. Schools should include it in their AI Act inventory like any other tool. Ask us for the documentation you need to assess it. In most schools, teachers review AI Buddy’s results and make the grading decisions that count.
Frequently asked questions
When does the EU AI Act apply to schools?
In stages: the emotion-recognition ban since 2 February 2025, transparency rules from 2 August 2026 and high-risk rules for education from 2 December 2027, as set by Regulation (EU) 2026/1744.
Is AI marking high-risk under the EU AI Act?
AI systems “intended to be used to evaluate learning outcomes” are listed as high-risk in Annex III. Some narrow or preparatory tools may fall outside under Article 6(3). Schools should get legal advice and the provider’s assessment.
Is emotion recognition allowed in schools?
No. Using AI to infer emotions in education institutions has been prohibited since 2 February 2025, except for medical or safety reasons.
Do schools have to train staff on AI?
Schools must “take measures to support the development of AI literacy” of staff using AI systems. Since July 2026 the Act says this does not require guaranteeing any specific level.
Discover how AI Buddy helps schools strengthen teaching, learning and evidence-informed school improvement. Or start a short consultation with our schools team using the form below — we will get back to you directly.
Sources
- European Union, Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3, 4, 5, 6, 26, 27, 50, 99 and Annex III
- European Union, Regulation (EU) 2026/1744 (Digital Omnibus on AI) (8 July 2026)