EU AI Act High-Risk Classification for At-Risk Student AI

Classification is a functional test

The Commission's FAQ states that an AI system is high-risk if it is intended to be used for one of the use cases listed in Annex III. Classification therefore follows intended purpose and actual use, not product category. A vendor may describe a product as analytics, retention support or learner success, but the description does not settle the question.

For education, the recitals of Regulation (EU) 2024/1689 identify these high-risk uses: determining access or admission, assigning people to institutions or programmes at all levels, evaluating learning outcomes, assessing the appropriate level of education for an individual and materially influencing the level of education and training they will receive or can access, and monitoring and detecting prohibited behaviour of students during tests. The stated rationale is that such systems may determine a person's educational and professional course and so affect their ability to secure a livelihood.

An at-risk flagging system is not named in that list. The question is whether its output functions as one of the listed uses. A risk score that is used to evaluate learning outcomes, or that shapes which programme or level a student is placed in, moves toward the education category. A score that surfaces a student to an adviser for a supportive conversation, with no effect on progression, placement or access, is a different fact pattern. Where the wording "materially influencing" could apply, the analysis should be documented rather than assumed.

Use patterns and likely classification direction

The table separates common deployments by how the flag is used. The direction shown is a starting hypothesis for the functional test, not a determination. Each institution should confirm its own conclusion against the Act's text and the Commission's classification guidelines and keep the reasoning on file.

• Flag triggers a support message or adviser outreach, with no effect on progression, placement or access: Closer analysis needed. Depends on whether the output evaluates learning outcomes or materially influences education level in practice.
• Flag is one input to a decision on progression, probation or continued enrolment: Moves toward high-risk, particularly where it contributes to evaluating learning outcomes.
• Flag informs placement in a programme, track or level: Moves toward high-risk under assignment to programmes or assessment of education level.
• Flag is used in admission or access decisions: Within the listed access and admission use.
• Flag is derived from monitoring of student behaviour during tests: Within the listed use of monitoring prohibited behaviour in tests.
• Use changes over time, for example outreach tool later feeds a progression review: Reclassify. Intended use drives the outcome, so the determination must be revisited.

What follows if the system is high-risk

The recitals list the requirements for high-risk systems: risk management, quality and relevance of data sets, technical documentation and record-keeping, transparency and information to deployers, human oversight, and robustness, accuracy and cybersecurity. The regulation requires a risk management system to be established, implemented, documented and maintained.

The Commission FAQ lists the provider's obligations: conformity assessment before placing on the market or putting into service, a quality management system, registration in a public EU database, serious incident reporting, corrective actions, and cooperation with market surveillance authorities. An institution that buys a flagging product should ask the provider for evidence of each of these items. An institution that builds its own system may carry them directly.

The institution's operational role centres on how the system is used. In practice that means a named person reviews flags before any consequence for a student, the input data is relevant to the stated purpose, and records show how the system behaved. As of November 2026, the Commission states that rules for high-risk areas including education apply from 2 December 2027. Plan against that date and keep the determination current as the flag's use evolves.

Limits of runtime enforcement, and data protection alongside the AI Act

Runtime enforcement acts only on interactions it observes. It does not classify a system, perform conformity assessment, maintain provider documentation, run a risk management system, or register a system in the EU database. Those remain provider or institutional duties. Evidence from enforcement supports a compliance programme and does not establish classification or compliance on its own.

The AI Act sits alongside GDPR and, for US student records, FERPA. These are separate regimes with their own requirements, and the AI Act classification does not replace a data protection assessment. Redacting or blocking student data before it reaches a model is a practical control that supports minimisation under any of these regimes, but each regime needs its own analysis.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, scoped to individual interactions and tool calls. It supports allow, redact, block, rate limit and escalation for human approval, and generates audit-ready evidence mapped to the EU AI Act, among other frameworks. It can be self-managed in the customer's cloud, with configurable retention and data residency. Trussed serves customers in education, where student data and FERPA are central, and holds FERPA and GDPR among its listed attestations.