Is AI in university admissions high-risk under the EU AI Act?

Usually, yes. An AI system that scores, ranks or filters applicants to decide who gets a place at a university, college, school or vocational training institution fits Annex III, point 3(a) almost word for word, and so does a system that decides which programme or campus an admitted person is placed on. Under Article 6(2) that makes it high-risk, unless the Article 6(3) derogation applies, and a system that profiles applicants cannot use the derogation. In our reading, ranking individual applicants will usually be profiling. Reading applicants' emotions from their face, voice or other biometric data in an admission interview or test is not merely high-risk but prohibited under Article 5(1)(f), which the Commission's guidelines apply to candidates in the admissibility process. The answer turns on three things: what the output is used for (admission and placement are listed; scholarships and applicant FAQs are not), how much the system does (de-duplicating files is different from ranking people), and whether it infers emotions.

This is an information service to help you orient, not legal advice. To see the obligations that attach to your own AI use, answer three questions about it.

Your situation at a glance

Your situation	High-risk?	Why (article / annex point)
AI scores or ranks applicants, and the ranking is used to decide who is admitted	Yes	Annex III, point 3(a), read with Article 6(2). In our reading, scoring individual applicants is usually profiling, so Article 6(3) is closed
The same tool only recommends; an admissions officer takes every decision	Usually still yes	Point 3(a) describes the system's intended purpose, not who decides. Article 6(3) never applies where the system profiles natural persons
AI assigns admitted students to programmes, campuses or study tracks	Yes, in our reading	Point 3(a) covers systems intended to "assign natural persons to educational and vocational training institutions". Recital 56 adds "or programmes"
AI marks an entrance test or scores a personal statement, and the score feeds the admission decision	Yes, in our reading	Point 3(a), because the output is used to determine admission. Point 3(b) (evaluating learning outcomes) may apply as well, but is written around learners already "in" an institution
Placement test that sets the level or course an applicant may enter, for example at a language school	Yes, in our reading	Point 3(c): assessing "the appropriate level of education that an individual will receive or will be able to access"
AI allocates scholarships or financial aid	Not listed in point 3, in our reading. Public grants: open	Point 3 does not mention financial aid. Point 5(a) covers public assistance benefits evaluated by or for public authorities; whether a student grant is one, the Act does not say
Chatbot that answers applicants' questions about deadlines and requirements	Not listed	No Annex III point covers it. Article 50(1): the provider must design it so that applicants are informed they are interacting with an AI, unless that is obvious
AI-text or plagiarism detector run on application essays	Unclear	Point 3(d) covers "prohibited behaviour of students during tests"; an applicant writing an essay at home is a poor fit. If the flag is used to decide admission, point 3(a) is the stronger argument
Proctoring an online entrance exam	See the proctoring analysis	Point 3(d), plus the question whether applicants are "students". We cover it in AI exam proctoring
AI only de-duplicates, sorts or extracts data from application files, with no assessment of the applicant	Possibly not, under Article 6(3)(a)	A "narrow procedural task". Recital 53 names detecting duplicates "among a large number of applications". Must not profile; must be documented (Article 6(4)) and registered (Article 49(2))
Secondary school, private language school or vocational training provider using AI to select entrants	Yes, in our reading	Point 3(a) applies "at all levels". The Act does not define "educational and vocational training institutions", so the edges (for example a company academy) are open
AI infers applicants' emotions from face, voice or posture in an admission interview or test	Prohibited	Article 5(1)(f). The Commission's guidelines apply it to candidates in the admissibility process (paragraph 255)

The legal test

Article 6(2) says that AI systems referred to in Annex III "shall be considered to be high-risk". Annex III, point 3 covers education and vocational training. Point 3(a) lists:

"AI systems intended to be used to determine access or admission or to assign natural persons to educational and vocational training institutions at all levels."

Four elements do the work:

• "Intended to be used" points to the purpose the provider gives the system. A general spreadsheet or language model is not caught because an admissions office could use it; an applicant-ranking product sold to universities is. A university that turns a general tool into an admissions ranker can become its provider (below).
• "Determine access or admission" is the core case: deciding who gets a place, or who goes through to the next round. In our reading, a system whose ranking or shortlist decides who an officer reads first, or at all, is used to determine admission even if a human signs off.
• "Assign" is a separate limb. It covers deciding where an admitted person goes. Recital 56 of the original 2024 text describes it as "assigning persons to educational and vocational training institutions or programmes at all levels", which in our reading covers allocation to programmes and campuses, not only to institutions.
• "At all levels" means the point is not limited to universities. Secondary schools, colleges, language schools and vocational training providers are within the words. The Act does not define the institutions, so whether a private course provider or a company academy is one has to be argued from the ordinary meaning.

The neighbouring points can also apply to the same product. Point 3(b) covers AI "intended to be used to evaluate learning outcomes, including when those outcomes are used to steer the learning process of natural persons in educational and vocational training institutions at all levels". Point 3(c) covers AI "intended to be used for the purpose of assessing the appropriate level of education that an individual will receive or will be able to access, in the context of or within educational and vocational training institutions at all levels". In our reading, an entrance test marker is caught by point 3(a) when its score decides admission, whether or not point 3(b) also fits, and a placement test is the clearest point 3(c) case.

Recital 56 gives the reason for the whole point: these systems "may determine the educational and professional course of a person's life and therefore may affect that person's ability to secure a livelihood", and when improperly designed and used they may violate "the right to education and training as well as the right not to be discriminated against".

Scholarships and financial aid

Annex III, point 3 does not mention scholarships, bursaries or financial aid, and we found no other point that names them. Two cases follow from the text, in our reading:

• Where the money is the place. If a funded place or a scholarship is in practice the admission decision (no award, no place), the system is used to determine access or admission and point 3(a) applies.
• Where a public authority decides grants. Annex III, point 5(a) covers AI "intended to be used by public authorities or on behalf of public authorities to evaluate the eligibility of natural persons for essential public assistance benefits and services". Whether a public student grant is an "essential public assistance benefit" the Act does not say. Treat that case as open.

A merit scholarship scored separately, after admission, is in our reading not listed. That does not make the scoring unregulated: the GDPR applies, and a system that is not in Annex III is not made high-risk by profiling alone, because the profiling rule in Article 6(3) only applies to systems "referred to in Annex III".

AI-text detectors on application essays

Point 3(d) covers AI "intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions at all levels". An applicant drafting a personal statement at home is, in our reading, neither clearly a "student" nor "during tests". The closer question is point 3(a): if the detector's flag is used to reject applications, it is part of determining admission. A general-purpose detector is not intended for that, but a detector sold for admissions screening is, and a university that repurposes a general detector for that purpose should read Article 25(1)(c) (below). This case is not settled.

The Article 6(3) derogation and the profiling rule

Article 6(3) lets an Annex III system escape the high-risk label where it "does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making", and at least one of four conditions is met. The system is intended to:

• (a) perform a narrow procedural task;
• (b) improve the result of a previously completed human activity;
• (c) detect decision-making patterns or deviations from prior decision-making patterns, where it is not meant to replace or influence the previously completed human assessment without proper human review; or
• (d) perform a preparatory task to an assessment relevant for the purposes of the Annex III use cases.

Recital 53 of the original text gives examples of a narrow procedural task, including "an AI system that is used to detect duplicates among a large number of applications". In our reading, a tool that only removes duplicate files, checks that required documents are attached or turns transcripts into structured fields is the kind of system condition (a) is meant for.

The limit is profiling. Under the third subparagraph of Article 6(3), an Annex III system "shall always be considered to be high-risk where the AI system performs profiling of natural persons". Article 3(52) borrows the GDPR definition: "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements" (Article 4(4) GDPR). A system that scores an applicant's likelihood of succeeding on a course, or ranks applicants against each other on their records, is in our reading usually doing that. "Usually", because a tool that applies a fixed published threshold (for example a minimum grade) without evaluating anything else is harder to call profiling. The question is the system's function, not its label.

A "preparatory" shortlisting tool under condition (d) runs into the same wall: if it shortlists by evaluating each applicant, it profiles them, and it also tends to materially influence the outcome.

If you still conclude a system is not high-risk, Article 6(4) requires the provider to document the assessment before placing it on the market or putting it into service, and Article 49(2) requires registration in the EU database. See when an Annex III system is not high-risk.

Article 5: emotion recognition in admissions is banned

Article 5(1)(f) prohibits "the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons". Applicants are not yet students, but the Commission's guidelines on prohibited practices (C(2025) 5052 final), which are not binding, say "The prohibition should be understood to also apply to candidates during the admissibility process" and list "Using an emotion recognition AI system by an education institution during admissibility tests for new students" as prohibited (paragraph 255). The same paragraph reads "education institutions" broadly, to include "both public and private institutions" at all levels.

In our reading, a video-interview tool that scores an applicant's "confidence", "enthusiasm" or "nervousness" from their face or voice is in the sights of this ban. In the Commission's reading, the ban needs biometric data (paragraph 250): Article 3(39) defines an emotion recognition system by reference to "biometric data", and the guidelines say an AI system "inferring emotions from written text (content/sentiment analyses)" is not based on biometric data and does not fall within the prohibition (paragraph 251). Sentiment analysis of a personal statement is therefore not banned under Article 5(1)(f), although if it feeds the admission decision it is a point 3(a) question. The prohibition has applied since 2 February 2025, and breaches can carry fines of up to EUR 35 million or, for an undertaking, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(3)); for SMEs, including start-ups, whichever is lower (Article 99(6)).

For where the line falls, see emotion recognition at work and in education, and for the full list, prohibited AI practices.

If it is high-risk: who does what, and when

When. The Digital Omnibus on AI (Regulation (EU) 2026/1744) amended Article 113. Chapter III, Sections 1, 2 and 3 apply to Annex III systems from 2 December 2027. Under Article 111(2), as amended, and without prejudice to Article 5, the Act applies to operators of high-risk systems placed on the market or put into service before that date only if, from that date, those systems are subject to significant changes in their designs. But "the providers and deployers of high-risk AI systems intended to be used by public authorities shall take the necessary steps to comply" by 2 August 2030 in any case. Registration (Article 49) and conformity assessment (Article 43) sit in Chapter III, Section 5, which Article 113 does not list among the postponed sections; in our reading they still bite only once a system is high-risk under Article 6, so for Annex III systems in practice from 2 December 2027, not earlier. See what the Digital Omnibus changed.

Provider or deployer? A university that buys an admissions tool from a vendor and uses it under its authority is a deployer (Article 3(4)). A university that develops its own ranking model, or has one developed, and puts it into service under its own name is its provider (Article 3(3)), even if it never sells it. Under Article 25(1), a deployer also becomes the provider if it puts its name or trademark on a high-risk system, makes a substantial modification to one, or modifies the intended purpose of a system that was not high-risk so that it becomes high-risk, for example by using a general language model to rank applicants.

Providers carry the Section 2 requirements (risk management, data governance, technical documentation, logging, transparency and instructions for use, human oversight, accuracy, robustness and cybersecurity), a quality management system, an EU declaration of conformity, CE marking and registration in the EU database before placing the system on the market or putting it into service (Article 49(1)). For points 2 to 8 of Annex III, providers "shall follow the conformity assessment procedure based on internal control as referred to in Annex VI, which does not provide for the involvement of a notified body" (Article 43(2)). Point 3 systems therefore do not need a notified body.

Deployers must take appropriate technical and organisational measures to use the system in accordance with the instructions for use (Article 26(1)), assign human oversight to people "who have the necessary competence, training and authority, as well as the necessary support" (Article 26(2)), ensure input data under their control is relevant and sufficiently representative (Article 26(4)), monitor the system (Article 26(5)), keep the logs under their control for at least six months unless other law provides otherwise (Article 26(6)), and use the provider's information for any GDPR data protection impact assessment (Article 26(9)). Two duties face the applicant directly:

• Telling applicants (Article 26(11)). Deployers of Annex III systems "that make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk AI system".
• Explaining decisions (Article 86). A person subject to a decision taken by the deployer on the basis of a high-risk Annex III system's output, which "produces legal effects or similarly significantly affects that person" in a way they consider adverse to their health, safety or fundamental rights, has the right to obtain from the deployer "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken". In our reading, a rejected applicant is the typical case. The right does not apply where exceptions or restrictions follow from Union or national law in compliance with Union law (Article 86(2)), and applies only to the extent it is not otherwise provided for under Union law (Article 86(3)).

See deployer obligations under Article 26.

Public universities and schools. Three further rules depend on whether the deployer is public:

• Fundamental rights impact assessment (Article 27(1)). Before deploying a high-risk system, "deployers that are bodies governed by public law, or are private entities providing public services" must assess its impact on fundamental rights. The AI Act does not define "bodies governed by public law". In our reading, most public universities and state schools will be such bodies. Recital 96 of the original text names education among the areas where private entities provide public services, so a private institution should not assume it is outside.
• Registration of the use (Article 49(3)). Before putting into service or using an Annex III system, "deployers that are public authorities, Union institutions, bodies, offices or agencies or persons acting on their behalf shall register themselves, select the system and register its use in the EU database". Whether a given public university is a "public authority" depends on national law; in our reading many will be.
• Do not use unregistered systems (Article 26(8)). Public-authority deployers that find the system they envisage using is not registered in the EU database "shall not use that system and shall inform the provider or the distributor".

What applies regardless

• AI literacy (Article 4). Applies since 2 February 2025. As replaced by the Digital Omnibus, it requires providers and deployers to "take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf", such as admissions officers who read the scores, and it "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". See the AI literacy duty.
• Prohibited practices (Article 5). Applies since 2 February 2025, including the Article 5(1)(f) emotion ban above. The two prohibitions the Omnibus added, Article 5(1)(ba) and (bb), on AI generation or manipulation of non-consensual intimate imagery and of child sexual abuse material (by reference to Article 2, points (c) and (e), of Directive 2011/93/EU), apply from 2 December 2026.
• Transparency (Article 50(1)). Applies since 2 August 2026. Providers must design AI systems intended to interact directly with people so that they "are informed that they are interacting with an AI system, unless this is obvious" to a reasonably well-informed person. An applicant FAQ chatbot is the typical case. See transparency obligations.
• The GDPR, in parallel. Article 22(1) GDPR gives an applicant "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her", subject to the exceptions in Article 22(2). In our reading, a fully automated rejection is likely to engage it, whatever the system's AI Act classification, and the AI Act does not replace the GDPR.

What to do now

1. List every AI feature in the admissions process separately: ranking or scoring, shortlisting, essay or test marking, placement, programme allocation, scholarship scoring, AI-text detection, interview analysis, chatbots and file handling.
2. Switch off any emotion inference in interviews or entrance tests. The ban already applies, and the Commission reads it as covering applicants.
3. Assume high-risk for anything that scores, ranks or allocates applicants, and plan for 2 December 2027, or, for systems already on the market or in service before then that are intended to be used by public authorities, 2 August 2030 at the latest. If you rely on Article 6(3), check first whether the system profiles anyone, and write your reasoning down.
4. Decide whether you are a provider. An in-house model, or a general tool repurposed to rank applicants, makes the institution the provider, with the full Section 2 load.
5. Public institutions: plan the fundamental rights impact assessment and the database registration now, and check that your vendor's system is registered before you use it.

For the general test behind this page, see is your AI system high-risk?. To get the obligations that match your own use, sorted by deadline, start the obligation check. To get a weekly email of verified changes to these rules, join the waitlist.

The official text is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. This article is an information service to help you orient — it is not legal advice.