Annex III §3
EU AI Act compliance for edtech
Education is the Annex III line where the regulator genuinely cares about minors, and that single fact reshapes most of the technical file. Admissions ranking, automated assessment, automated proctoring, and course allocation all sit inside Annex III §3 — and the parental-consent and child-rights overlay forces design choices that generic ML governance does not surface.
Edtech is genuinely different from the other Annex III sectors because the affected natural person is often a child, and EU regulators take child-rights overlays seriously. The AI Act incorporates by reference the protection of children's rights from the EU Charter; the GDPR adds Article 8 on conditions for child consent in information-society services; member-state laws on educational data add a third layer. Most edtech founders walk into the engagement expecting an Annex IV gap analysis and walk out with a child-data-flow map, because that is where the actual risk lives.
Annex III §3 covers four substantive areas in education and vocational training: (a) determining access or admission, including allocation of natural persons to educational institutions; (b) evaluating learning outcomes, including steering the learning process; (c) assessing the appropriate level of education an individual will receive or be able to access; (d) monitoring and detecting prohibited behaviour during tests. The fourth one — proctoring and exam-monitoring — is the one most edtech founders forget is in scope. It catches not just exam vendors but anyone whose product flags suspicious behaviour during assessments. Pure content-recommendation that does not influence advancement is typically out; the moment your engine touches a graded outcome, you are in.
Buyer-side questions in edtech come from two procurement archetypes. School-district and ministry buyers ask about safeguarding posture, child-data-flow diagrams, and conformity with national education-data laws (which the AI Act sits on top of). University buyers ask the same fairness and transparency questions you see in HR — slice metrics, explanation, override rate, appeal route — but with a sharper edge on disability accommodation. Both ask about parental consent capture and revocation, even though that is GDPR territory; the AI Act technical file is where they expect to see the integration evidence.
The most common gap in edtech is age-gating and consent-state visibility in the model layer. Many edtech products serve a mixed population — adult learners, university students, secondary-school students — and the model is unaware of the age band of any specific user. Annex IV §1(c) requires the system description to include how the system interacts with the consent-management layer of the host institution; we typically find that integration is informal and undocumented. The second gap is proctoring algorithms that lack independent fairness review for visual-attention or audio-based features, which disproportionately flag neurodivergent students. The fix is a documented review by an independent reviewer plus a slice-level error rate by accommodation class.
Edtech evidence is scattered across the LMS, the assessment engine, and the proctoring service. Per-student decision logs typically live in the LMS — they need export hooks that prove Art. 12 automatic logging and per-event reason codes. Proctoring confidence scores live in the proctoring vendor — if that is third-party, you need a data-processing agreement that gives you read access for the technical file. Drift monitoring on assessment outputs lives in your training pipeline; we wire it to alarm when subgroup error rates diverge beyond a fixed threshold. The Programme tier covers institutional rollout, where the host school's DPO becomes a documented stakeholder.
Diagnostic for edtech providers
Most edtech engagements run alongside an institutional DPO. The Diagnostic confirms Annex III §3 classification across up to three systems and produces a child-data-flow snapshot the buying institution can append to its own DPIA. Fixed price.