Article 26 Deployer Obligations for Education AI — EU AI Act
How EU AI Act Article 26 deployer obligations apply to schools and universities — teacher training, parent notification, children's data protection, FRIA.
Article 26 of the EU AI Act establishes obligations for deployers — organisations that use high-risk AI systems developed by third parties. In education, deployers are schools, universities, examination boards, and education authorities that procure AI-powered tools from edtech vendors for student assessment, adaptive learning, plagiarism detection, or admissions screening. These institutions bear direct compliance responsibility for how AI tools are used in educational settings, even though they did not build the technology.
Education deployers face heightened obligations because their AI systems affect children and young people — vulnerable data subjects under GDPR. A DPIA is mandatory when deploying AI in educational settings involving minors, and parents or guardians must be notified of AI tools used in their child's education. This page explains what Article 26 requires of educational institutions, how it interacts with data protection and education law, and what compliance gaps Scanara detects.
Who Is a Deployer in Education?
Schools & School Districts
Primary and secondary schools deploying AI-powered tools for student assessment, learning analytics, or behavioural monitoring. School districts that procure AI platforms centrally are deployers with Article 26 obligations for all schools using those tools.
Universities & Higher Education
Universities using third-party AI for admissions scoring, automated essay grading, plagiarism detection (e.g., Turnitin), or adaptive learning platforms. Each institution deploying these tools is a deployer regardless of whether procurement was centralised.
Examination & Certification Bodies
Organisations using AI for automated exam scoring, proctoring, or certification assessment. These deployers make high-stakes decisions about educational attainment and must ensure robust human oversight of AI-assisted grading.
Education Ministries & Authorities
Government education bodies deploying AI for school performance analytics, resource allocation, or early warning systems for student dropout risk. As bodies governed by public law, these deployers must conduct a FRIA before deployment.
Online Learning Platforms
Educational institutions using third-party AI tutoring systems, adaptive learning engines, or personalised recommendation systems from commercial edtech providers. The institution licensing the platform for student use is the deployer.
Key Deployer Obligations for Education
Article 26 requires deployers to use AI systems within the provider's instructions, assign human oversight, and monitor operations. For education, these obligations carry additional weight because the affected individuals are often children with limited capacity to understand or challenge AI decisions.
Teacher Training on AI Tools
Deployers must assign human oversight to persons with the necessary competence, training, and authority. In education, this means teachers must be trained to use AI tools appropriately, identify when AI output is incorrect, and override AI recommendations. Training must cover the specific AI system's capabilities and known limitations.
Parent and Guardian Notification
For AI tools used with minors, parents or legal guardians must be informed about the AI systems deployed in their child's education. This includes the purpose of the AI, what data it processes, and how AI outputs are used in educational decisions. This extends beyond Article 26 into GDPR children's data requirements.
Fundamental Rights Impact Assessment
Public schools and education authorities must conduct a FRIA before deploying high-risk AI. The assessment must evaluate impacts on children's rights to education, non-discrimination, development, and participation. Private schools providing publicly funded education may also be required to conduct a FRIA.
Monitoring for Age-Appropriate Use
Deployers must monitor AI system operations based on the provider's instructions. In education, this includes verifying the AI tool is appropriate for the student age group and cognitive level, and that it does not produce outputs that are harmful, misleading, or developmentally inappropriate.
Regulatory Overlaps
Education deployers must comply with the EU AI Act alongside GDPR children's data protections, national education laws, and Council of Europe guidelines on AI in education. The overlap creates a layered compliance obligation.
GDPR Art. 8 — Children's Data
GDPR provides specific protections for children's personal data, including parental consent requirements for information society services. Deploying AI that processes student data triggers these protections alongside Article 26 deployer obligations. Consent mechanisms must be designed for comprehension by parents and, where appropriate, by students themselves.
GDPR Art. 35 — DPIA for Vulnerable Subjects
A DPIA is mandatory when processing data of children or using new technologies in educational settings. This is separate from the AI Act FRIA but addresses overlapping concerns. Education deployers should conduct both assessments in parallel, ensuring each regulatory requirement is distinctly addressed.
National Education Laws
Member States have education laws governing assessment standards, student rights, and parental information rights. Some jurisdictions restrict automated decision-making in educational assessment or require specific approvals before deploying technology in classrooms. These requirements layer on top of Article 26.
Council of Europe AI in Education Guidelines
The Council of Europe has issued guidelines on AI in education emphasising transparency, learner agency, and teacher empowerment. While not legally binding, these guidelines inform best practice and may influence how supervisory authorities interpret Article 26 deployer obligations in educational settings.
Common Violations Scanara Detects
No Logging Configuration for EdTech AI Events
AI assessment or adaptive learning tools deployed without logging infrastructure capturing AI inputs, outputs, and decisions. Scanara flags educational deployments where no audit trail exists for AI-assisted grading or student profiling decisions.
Third-Party AI Deployed Without FRIA Documentation
Public schools or education authorities deploying AI tools without a documented fundamental rights impact assessment. Scanara detects high-risk AI deployments in public education settings where no FRIA has been recorded prior to student-facing use.
Human Oversight Role Not Formally Assigned
AI grading or assessment tools deployed without formally designating which teachers or academic staff review AI outputs before consequential decisions. Scanara identifies deployments where no role assignment links trained educators to AI oversight responsibilities.
No Parent Notification for AI Use with Minors
AI tools processing student data deployed without documented notification to parents or guardians. Scanara flags deployments in K-12 settings where no parental notification or consent mechanism has been implemented for AI system usage.
Article 26 Compliance Checklist for Education
Use Within Instructions for Use
Verify AI tools are used within the vendor's declared scope — correct age groups, subjects, and assessment types. Document any use outside the intended scope.
Teacher Training & Oversight
Train teachers on AI tool capabilities and limitations. Formally assign oversight roles with documented authority to override AI outputs in assessment and student profiling decisions.
Incident Reporting
Establish a workflow for reporting AI malfunctions to the edtech provider and competent authority. Include criteria for what constitutes a serious incident in an educational context.
Operational Logging
Configure logging for AI-assisted assessment decisions and learning analytics. Retain logs for academic appeals, regulatory inspection, and parental information requests.
Fundamental Rights Impact Assessment
Conduct a FRIA before deploying AI in public education settings. Address children's rights to education, non-discrimination, development, and participation.
Frequently Asked Questions
Related Resources
Article 26: Deployer Obligations
Full Article 26 deployer requirements across all industries.
Education AI — Industry Hub
Complete EU AI Act compliance guide for education AI systems.
Article 9: Risk Management for Education
Risk management system requirements for education AI deployers and providers.
Article 13: Transparency for Education
Transparency and information obligations for education AI systems.
How Scanara Helps
Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.