Article 26 in Education: Deployer Obligations

Article 26 sets these duties for deployers of high-risk AI systems.

• Art. 26(1)
  Use according to the instructions

  Take appropriate technical and organisational measures to use the system in accordance with the instructions for use.

• Art. 26(2)
  Assign human oversight

  Assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.

• Art. 26(4)
  Check input data

  To the extent the deployer controls the input data, ensure that it is relevant and sufficiently representative for the intended purpose.

• Art. 26(5)
  Monitor, inform, suspend

  Monitor operation on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. If use in accordance with the instructions may present a risk within the meaning of Article 79(1), inform the provider or distributor and the market surveillance authority without undue delay and suspend use. After a serious incident, immediately inform the provider first, then the importer or distributor and the market surveillance authorities. If the provider cannot be reached, Article 73 applies mutatis mutandis.

• Art. 26(6)
  Keep logs

  Keep the logs the system generates automatically, to the extent they are under the deployer’s control, for a period appropriate to the intended purpose and of at least six months, unless Union or national law, in particular on the protection of personal data, provides otherwise.

• Art. 26(7)
  Inform workers

  Employers must inform workers’ representatives and the affected workers, before putting a high-risk system into service or using it at the workplace, that they will be subject to its use. This information is provided, where applicable, in accordance with the rules and procedures laid down in Union and national law and practice on information of workers and their representatives.

• Art. 26(8)
  Public authorities register

  Deployers that are public authorities, or Union institutions, bodies, offices or agencies, must comply with the registration obligations of Article 49, which concern Annex III systems. They must not use a system that is not registered in the EU database.

• Art. 26(9)
  Data protection impact assessment

  Where applicable, use the information the provider gives under Article 13 for the data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680.

• Art. 26(11)
  Inform people affected by decisions

  For Annex III systems that make or assist decisions about natural persons, inform those persons that they are subject to the use of the system, without prejudice to Article 50.

• Art. 26(12)
  Cooperate with authorities

  Cooperate with the competent authorities in any action they take in relation to the high-risk system.

Article 26 binds deployers of high-risk AI systems only. The rows below show where education AI becomes high-risk and which further rules reach schools and universities.

• Where education sits in the Act

  The Act has no sector-wide education regime. This site uses “education” for AI used in schools, universities, vocational training and exams. Such AI reaches the Act through Annex III point 3, headed “Education and vocational training”, and through the ban on inferring emotions in education institutions (Article 5(1)(f)). Point 3 does not name plagiarism detection, dropout prediction, adaptive learning platforms, learning dashboards or administrative chatbots; whether a system falls under it follows from the intended purpose (Article 3(12)). A system can also be high-risk under another point of Annex III.

• Annex III point 3: four uses

  Annex III point 3 covers AI systems intended to be used: (a) to determine access or admission or to assign natural persons to educational and vocational training institutions at all levels; (b) to evaluate learning outcomes, including when those outcomes are used to steer the learning process of natural persons in educational and vocational training institutions at all levels; (c) for the purpose of assessing the appropriate level of education that an individual will receive or will be able to access, in the context of or within such institutions at all levels; (d) for monitoring and detecting prohibited behaviour of students during tests in the context of or within such institutions at all levels. Under Article 6(2), AI systems referred to in Annex III are considered high-risk. A provider that considers such a system not high-risk under Article 6(3) must document its assessment before the system is placed on the market or put into service, and must register it under Article 49(2). The derogation never applies where the system performs profiling of natural persons. Profiling means profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679 (Article 3(52)).

• Provider and deployer

  The provider develops the AI system, or has it developed, and places it on the market or puts it into service under its own name (Article 3(3)); this can be an education-technology vendor or a university that develops a system for its own use. A natural or legal person, public authority, agency or other body that uses a system under its authority, such as a school, university or examination body, is a deployer (Article 3(4)). A deployer becomes a provider if it puts its name or trademark on a high-risk system already on the market, makes a substantial modification that leaves the system high-risk, or changes the intended purpose of a non-high-risk system so that it becomes high-risk (Article 25(1)). Natural persons who use a system in the course of a purely personal non-professional activity are not bound as deployers (Article 2(10)). Putting its name or trademark on the system is without prejudice to contractual arrangements that allocate the obligations otherwise (Article 25(1), point (a)); the initial provider then ceases to be the provider of that system and must closely cooperate with the new provider (Article 25(2)). The cooperation duty does not apply where the initial provider has clearly specified that its AI system is not to be changed into a high-risk AI system and therefore does not fall under the obligation to cooperate (Article 25(2), last subparagraph).

• Dates

  Annex III point 3 applies from 2 December 2027 (Article 113, point (c)). A system placed on the market or put into service before that date is covered only if, from that date, its design undergoes significant changes. In the same paragraph, the “in any case” sentence says that providers and deployers of high-risk AI systems intended to be used by public authorities shall take the necessary steps to comply by 2 August 2030 (Article 111(2)). The Act does not state whether this also reaches systems placed on the market after 2 December 2027; ask counsel.

• Fines

  Breaches of provider obligations under Article 16 and of deployer obligations under Article 26 can be fined up to EUR 15 million or, for an undertaking, up to 3% of total worldwide annual turnover in the preceding financial year, whichever is higher (Article 99(4)). For SMEs, including start-ups, each fine is capped at whichever is lower (Article 99(6)). The same cap applies to small mid-cap enterprises (Article 3(14b), Article 99(6a)). Each Member State lays down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)). Articles 27, 49 and 86 are not listed in Article 99(3) to (5); Member States lay down the rules on penalties applicable to any infringement of the Regulation by operators (Article 99(1)).

• Limits of the Act’s scope

  The Act applies to providers that place AI systems on the market or put them into service in the Union, or place general-purpose AI models on the market in the Union, wherever they are established (Article 2(1), point (a)), and to providers and deployers in a third country where the output of the AI system is used in the Union (point (c)). It does not apply to areas outside the scope of Union law and does not affect Member States’ competences on national security, nor to AI systems used exclusively for military, defence or national security purposes (Article 2(3)). The Act does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)). It does not apply to research, testing or development before a system or model is placed on the market or put into service; testing in real world conditions is not covered by that exclusion (Article 2(8)). It does not apply to obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity (Article 2(10)). It does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50 (Article 2(12)).

• Is a school or university a public body?

  The Act does not define “public authority” or “body governed by public law”. For example, these rules depend on this status: registration of the system and its use in the EU database by deployers that are public authorities, Union institutions, bodies, offices or agencies, or persons acting on their behalf (Article 26(8), Article 49(3)); the fundamental rights impact assessment (Article 27(1)); and the “in any case” sentence of Article 111(2) on systems intended for public authorities (2 August 2030). Whether a given school, university or examination body has that status is not answered by the Act.

• Fundamental rights impact assessment (Article 27)

  Article 27(1): before deploying a high-risk AI system referred to in Article 6(2), with the exception of systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law or private entities providing public services must assess the impact on fundamental rights that the use of the system may produce. Annex III point 3 is not an excluded area; only point 2 is. The duty applies to the first use; in similar cases the deployer may rely on earlier assessments (Article 27(2)). The deployer notifies the market surveillance authority of the results (Article 27(3)) and may cross-refer to a data protection impact assessment (Article 27(4)).

• Explanation of decisions (Article 86) and information (Article 26(11))

  Under Article 26(11), deployers of Annex III high-risk systems that make or assist decisions related to natural persons must inform those persons that they are subject to the use of the system. Separately, an affected person subject to a decision taken by the deployer on the basis of the output of an Annex III high-risk system (other than point 2) that produces legal effects or similarly significantly affects that person in a way they consider adverse to their health, safety or fundamental rights has the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision (Article 86(1)). This applies only to the extent the right is not otherwise provided under Union law (Article 86(3)). Paragraph 1 does not apply where exceptions or restrictions follow from Union or national law in compliance with Union law (Article 86(2)).

• AI literacy (Article 4)

  Providers and deployers of AI systems must take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context of use (Article 4(1)). This applies to AI systems in general, not only to high-risk systems. Chapter I, which contains Article 4, applies from 2 February 2025 (Article 113, point (a)). It does not require providers or deployers to guarantee a specific level of AI literacy of any individual. Competence, training and authority of the people assigned to human oversight are separately required by Article 26(2).

• No staffing or training numbers

  Article 26 sets no staffing level, training hours or qualification for the people who oversee an admission, grading or test-monitoring system. It requires the necessary competence, training, authority and support. The Commission is to develop guidelines on the application of the requirements and obligations in Articles 8 to 15 and Articles 25 and 26 (Article 96(1), point (a)).

• Log retention

  Article 26(6) sets at least six months for logs under the deployer’s control and gives way to other Union or national law, in particular on personal data. The Act names no retention period for education.

• Design choice: oversight roles

  A common design choice, not an Act requirement: name the oversight persons by role in the admission, grading or test procedures, and record their training.

• Human review of each grade or admission decision

  Article 14(4) and Article 26(2) concern human oversight of the system. Neither says that a person must review each individual decision. Whether other law, for example on automated individual decisions, requires it is not answered by the Act.

• Article 26: Deployer Obligations for High-Risk AI

  Article 26 for all sectors: who is a deployer, the duties, Article 27 and fines.

• EU AI Act Compliance for Education Technology

  The education overview: how the Act reaches AI in schools, universities and training.

• Article 17 for Education AI: Quality Management System

  Education AI and Article 17: the 13 aspects and who is the provider.

• Article 27: Fundamental Rights Impact Assessment

  Article 27 for all sectors: who must assess fundamental-rights impact and what the assessment covers.