AI Admissions Screening of EU Applicants: Is It High-Risk for US Universities?

When admissions screening is classed as high-risk

Recital 46 of the AI Act states that AI systems used in education or vocational training, in particular for determining access or admission, should be classified as high-risk. The stated reason is that such systems may determine a person's educational and professional course and their ability to secure a livelihood.

In practice, the question is what each tool does to an application. A model that screens out applicants, ranks them or assigns a score sits close to the core of the use case. A tool that only reformats documents or answers applicant questions sits further away, and its classification needs a documented rationale.

Two tests matter. An Annex III system is not considered high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making. But an Annex III system that performs profiling of natural persons is always considered high-risk. So how a score or ranking is used by admissions staff affects classification as much as what the model computes. If reviewers routinely follow the ranking, the claim that the tool does not materially influence outcomes is difficult to sustain.

Does the Act reach a US university?

The Commission states that the AI Act applies to public and private actors inside and outside the EU who place an AI system on the EU market, put it into service, or use it in the EU. Location of the institution is therefore not the test. The test is how and where the system is placed or used.

For admissions, the scoping questions are concrete. Are EU applicants being scored by a system whose use can be tied to the EU? Is a vendor placing the tool on the EU market? Does the university itself deploy, or build and put into service, the tool? Reasonable counsel can read the territorial provisions differently for a non-EU institution that evaluates EU residents from outside the EU, and a university should record the reading it adopts and the facts behind it rather than assume either answer.

Role matters as well. The Commission describes obligations for providers, using a developer of a CV-screening tool as its example, and for deployers, using a bank that uses that tool. A university licensing a vendor's screening product resembles the deployer in that example. A university that builds its own scoring system may carry provider duties, including conformity assessment and a quality management system. Record the role for each tool, since a single admissions stack can include both.

GDPR and FERPA apply to the same records

The AI Act does not affect the obligations of providers and deployers as data controllers or processors under Union or national data protection law where AI use involves personal data. Meeting one regime does not discharge the other.

For admissions, this means the same applicant record can be subject to several analyses at once: the AI Act classification of the tool, GDPR rules on automated decisions and on transfers of EU applicant data to the United States, and FERPA obligations on education records once an applicant becomes a student. These should be tracked in one inventory instead of three separate reviews, because a single control often serves several regimes. Redacting an identifier before it reaches a model, for example, reduces exposure under all of them.

Enforcement is shared among the Commission's AI Office, the European Data Protection Supervisor and national competent authorities, so a single admissions workflow could attract attention from more than one body.

Dates to plan against, as of November 2026

High-risk rules were originally due to apply on 2 August 2026. The Digital Omnibus on AI changed that. The Commission's current pages give the dates below, and the compliance calendar should be revisited as the amending act progresses.

• 19 November 2025: The Commission proposes the Digital Omnibus on AI, with targeted amendments to the AI Act.
• 7 May 2026: Council and Parliament reach a provisional agreement that sets fixed application dates.
• 2 December 2027: High-risk rules for stand-alone systems in Annex III areas, including education, apply.
• 2 August 2028: High-risk rules for systems embedded in regulated products apply.

Implementation: inventory first, then enforce in the path

Begin with an inventory of every AI use in the admissions workflow, including embedded features in application systems, and record for each whether it screens, ranks or scores applicants and whether it profiles them. This supports both the Annex III classification and any documented conclusion that a tool is not high-risk. Assign named owners for classification decisions and for human oversight roles, since the Act requires effective oversight by natural persons without naming who they are.

Once the inventory exists, enforcement can be placed in the execution path. Trussed enforces policy at runtime, not reviewed after the fact, across models, agents, tools, MCP servers, AI sites and coding assistants. Actions on individual interactions and tool calls are allowed, redacted, blocked, rate limited, or escalated for human approval. That enforcement generates continuous audit-ready evidence mapped to the EU AI Act, among other frameworks, so a compliance team can show what the AI was allowed to do and what it did. Trussed can be self-managed in the customer cloud, with configurable retention and data residency, which is relevant when applicant data crosses borders. It holds SOC 2 Type II, HIPAA, GDPR, FERPA, ISO 27001 and NIST AI RMF attestations and serves customers in insurance, pharma, healthcare and education.

Runtime enforcement does not replace classification, provider conformity work or legal analysis of GDPR and FERPA. It makes the resulting decisions enforceable and provable.

• Inventory each admissions AI tool and its screen, rank, score or profile function.
• Record provider or deployer role and the scoping rationale per tool.
• Place human approval before any admissions-relevant output is acted on.
• Define which applicant fields may reach each model, and redact or block the rest.
• Confirm each control produces a per-interaction record a regulator or auditor could review.
• Assign an owner to track the 2 December 2027 date and the Digital Omnibus.