AI Act-audit
For education
One category in education is not high-risk but prohibited. That prohibition has applied since February 2025.
Education has its own place in Annex III. Systems that decide on admission, that assess learning outcomes, that determine the appropriate level of education or that monitor behaviour during examinations fall within the heaviest category. Those obligations apply from 2 december 2027.
There is also a category that is not more heavily regulated but prohibited outright: systems that infer emotions or emotional state in pupils and students. Measuring attention, motivation or engagement through camera or behavioural data falls within it. That prohibition has been in force since 2 February 2025.
Administrative applications such as timetabling, enrolment records and room management generally fall outside both.
Assessment and guidance
We establish which systems contribute to decisions on admission, evaluation or educational guidance, and which only deliver material. Adaptive practice material is not the same as a model that fixes a pupil's level.
We also examine whether the teacher in practice has the scope to depart from what the system indicates.
Prohibited practices
We review whether attention, motivation or emotional state of pupils is inferred anywhere in your digital learning environment.
In proctoring software and engagement dashboards, that function is present more often than the institution is aware.
Examination monitoring
Software that analyses writing style or monitors behaviour during tests falls within Annex III.
We map which of those systems you use, what happens when a signal is raised, and whether a student knows the system is running.
Procured systems and minors
Your learning platform, pupil tracking system and assessment software come from suppliers. We determine who is the provider and who is the deployer.
Where minors are involved, we also map how the AI Act relates to your obligations under the GDPR.
What you receive
An inventory of the AI systems within scope, a qualification for each system, and a prioritised list of the gaps identified. The qualification is the work of the affiliated lawyers, acting in their own name and under their own professional indemnity insurance.
We carry out the audit and compile the report. We do not assess conformity and we do not issue certificates.
After the audit,
Automation
The remediation plan is yours. You can carry it out in-house, with your existing supplier,or with us
If the audit shows that your AI systems run on US infrastructure and you want to change, that is a seperate question.
That is what we are developing Thor for: a self-hosted environment in which your business data does not leave Europe. Development starts on 1 November 2026 and runs for six months, against thresholds set in advance. It is a separate engagement, not a follow-on from the audit.