Why does the AI Act classify algorithmic admissions as high risk?

Algorithmic admissions systems are artificial intelligence systems used by educational institutions or training providers to decide or influence a person's access: determining admission to an institution or program, assigning students to tracks or classes, evaluating learning outcomes even when that evaluation steers a person's subsequent path, determining the level of education a person may reach, or monitoring prohibited behavior during tests and exams. Regulation (EU) 2024/1689 (the AI Act) classifies these uses as high risk under Annex III, point 3. What matters is not the product's commercial name, but the function it performs: a scoring module sold as "enrollment support" inside a management platform still falls into this category if it decides or weighs on a natural person's admission. The classification covers schools, universities and vocational training centers at any level, from entrance tests to the automatic assignment of a study track, and it triggers documented obligations distinct from the general transparency duty that applies to conversational or generative AI used in the classroom.

See also: AI Act · The EU's risk-based AI regulation: transparency, GPAI rules and sanctions apply from 2 August 2026, with high-risk duties partly postponed.

What makes these systems high risk

For the general risk-based framework of the AI Act and its deadlines, see the AI Act entry: the Annex III high-risk obligations, which cover education alongside HR, credit and essential services, slip to 2 December 2027 under the Digital Omnibus. Article 6(3) of the regulation sets out exceptions to the high-risk classification for Annex III systems that perform a narrow procedural or preparatory task without replacing human assessment. But the same article draws a hard line: an Annex III system is always considered high risk if it performs profiling of natural persons. A tool that builds a profile of a student, from classroom behavior to historical results, to decide admission or track therefore falls under high risk without exception, even if it only automates a preparatory step.

An enterprise example

An EdTech vendor sells a vocational training consortium a module that scores enrollment applicants by combining an online test result, demographic data and academic history, to rank the waiting list when places are limited. The vendor presents it as an "automatic application prioritization" feature inside the enrollment portal, not a regulated product. The client institutions, which use it (the deployers, in AI Act terms), adopt the module without verifying the vendor's conformity documentation: the score automatically evaluates and predicts the applicant's suitability, so for the GDPR it is profiling (Art. 4(4)), and the system falls under Annex III point 3 with no room for exceptions. An institution that discovers this only after a parent's complaint has to redo due diligence on the vendor, document the human oversight applied to decisions already taken, and revisit the waiting lists formed in the meantime.

Why it matters for decision makers

For a company selling software to schools or training providers, the risk is not the severity of the rule but the moment it is discovered: a scoring or assignment module presented as an administrative feature can still fall under high risk regardless of how it is marketed, and profiling cancels the exceptions provided for procedural tasks. Decision makers, whether vendor or purchasing institution, should verify before adoption whether the system processes data that builds a profile of the individual student, document where human oversight intervenes before any admission or assignment decision, and prepare the notice owed to the students and families concerned. The Digital Omnibus postponements move the sanctions to 2 December 2027, not the classification and inventory work, which still takes months ahead of that deadline.

This entry is informational and does not constitute legal advice: for AI Act and GDPR compliance of systems affecting student admission or evaluation, involve your DPO or legal counsel.