Under the AI Act four education uses are high-risk: deciding access or admission, evaluating learning outcomes, assessing someone's appropriate level of education, and monitoring prohibited behaviour during tests. Those obligations now start on 2 December 2027, not August 2026. One education duty did not move at all: inferring emotions in an educational institution has been prohibited outright since 2 February 2025.
This post is for the informatiemanager, IT director, CISO or privacy officer at a Dutch ROC, hogeschool or university. OCW in cijfers put hbo staffing at about 43,700 FTE in October 2023 and mbo at about 48,800 FTE in October 2025; those are sector totals over a few dozen institutions each, which puts the typical institution in the 250 to 5,000 FTE band this is written for. Research universities mostly sit above it and the obligations below apply to them unchanged. Crux Digits classifies and builds AI systems alongside your ICT partner and your SIS and LMS suppliers; we do not run your service desk, your network or your Microsoft tenant.
Which four education uses does Annex III point 3 actually list?
Annex III point 3 of the AI Act names four, for institutions at every level: (a) AI used to determine access or admission, or to assign people to institutions or programmes; (b) AI used to evaluate learning outcomes, including where those outcomes steer how a learner is taught; (c) AI used to assess the appropriate level of education a person will receive or can access; and (d) AI used for monitoring and detecting prohibited behaviour of students during tests.
Mapped onto a Dutch institution, that is not an abstract list. Point (a) covers an algorithm ranking applicants in decentrale selectie for a numerus fixus programme, or turning a studiekeuzecheck into an advice. Point (b) covers automated scoring in Ans or a Brightspace quiz, and AI feedback that reorders what a student sees next. Point (c) covers a bindend studieadvies model or a dropout-prediction dashboard. Point (d) covers online proctoring and exam-fraud flagging.
Note who owns each one, because the AI Act will ask. The SIS (OSIRIS at many hogescholen, Eduarte at many mbo instellingen) has a functioneel beheerder; the LMS (Brightspace, Canvas, Moodle) another; the examencommissie owns the assessment rules but not the software, and the supplier owns the model. Four owners, one classification, nobody who currently signs it.
Why does the sector's own AI Act summary now carry the wrong dates?
Most Dutch mbo, hbo and wo institutions work from AI Act in het kort, published by SURF and Npuls on 4 February 2025. It is a good document: it lists the four point-3 uses, names emotion recognition in the workplace and in education among the prohibited practices, explains aanbieder versus gebruiksverantwoordelijke, and recommends inventorying first. We cite it rather than claim the ground is empty.
Its timeline is what has aged. That document puts Annex III high-risk at August 2026 and Annex I at August 2027. The Digital Omnibus on AI, Regulation (EU) 2026/1744, dated 8 July 2026 and in force since 27 July 2026, moved Annex III to 2 December 2027 and Annex I to 2 August 2028. Npuls's kennisbank page Aan de slag met de AI Act (12 March 2026) points at tools and an algorithm inventory list rather than at dates, so it does not correct the table either.
A twenty-month-old summary is not wrong about the law. It is wrong about the clock. If your AI Act roadmap was built from that PDF, your classification deadline is sixteen months later than you planned, and the two duties you may have parked under "2026" are already live: Article 4 AI literacy since 2 February 2025, reworded by the Omnibus to supporting the development of literacy rather than guaranteeing a level, and Article 50 transparency since 2 August 2026. We wrote up what the Omnibus moved and what it did not when it landed.
Is online proctoring high-risk, or is it already prohibited?
Both are possible, and the difference sits in the feature list rather than in the category of product. Article 5(1)(f) prohibits AI systems used "to infer emotions of a natural person in the areas of workplace and education institutions", except where the system is intended for medical or safety reasons. That prohibition has applied since 2 February 2025 and the Omnibus did not touch it; the two prohibitions the Omnibus added, on non-consensual intimate imagery and on child sexual abuse material, apply from 2 December 2026 and are unrelated.
So monitoring behaviour (head movement, a second screen, another voice in the room) is point 3(d) high-risk from December 2027. Inferring an emotional or affective state (stress, nervousness, attention, engagement scoring) is prohibited today, in an educational institution, full stop.
Dutch institutions have been through the behaviour half of this once already. In the 2020 kort geding over the UvA's use of Proctorio (ECLI:NL:RBAMS:2020:2917) and in the Hof Amsterdam's ruling of 1 June 2021, the courts accepted the necessity of proctoring against exam fraud and Article 6(1)(e) AVG as the basis, and described a system producing an abnormal-behaviour score that authorised staff reviewed only on significant deviation. That score is behaviour. Those are Dutch rulings about a Dutch institution, and they settle nothing about the narrower new question: does any component of the product you bought infer an emotional state? That is answered from supplier documentation, not from a brochure.
Does AI-detection on coursework fall under point 3(d)?
Point 3(d) reads "during tests". Those two words do real work. A proctored session is during a test. A plagiarism or AI-writing check that runs on a thesis uploaded nine days later is not, on the text of the Annex.
That is a reading, not a settled point: others route the same tool through the Article 6(3) preparatory-task ground, or treat it as a transparency case, and arrive somewhere similar. Nor does it make the tool unregulated. It still processes personal data, it still feeds an examencommissie decision, and an accusation of fraud is among the heaviest decisions an institution takes about a student. What changes is the regime: the AVG, your examenreglement and, where the tool speaks to the student, Article 50 transparency, rather than Annex III provider documentation and a deployer log.
Can the Article 6(3) filter get your BSA model out of scope?
Article 6(3) lets a system listed in Annex III escape high-risk classification on one of four grounds: a narrow procedural task; improving the result of a previously completed human activity; detecting decision patterns or deviations without replacing or influencing a completed human assessment without proper review; or a preparatory task. Two things close it. Article 6(3) closes with a sentence saying an Annex III system is always high-risk where it performs profiling of natural persons. That is the Regulation's own text, not guidance, and it cannot soften. Article 6(4) then requires the provider who relies on the filter to document that assessment before the system is placed on the market or put into service. The European Commission's draft guidelines on classifying high-risk AI systems (out for feedback until 23 June 2026, and still draft rather than final as this is written) add detail on how that documentation should read.
For education, the profiling override decides most of the hard cases, and that application is the part nobody has written down. A bindend studieadvies model or a dropout-prediction score evaluates individual students to predict their performance; that is profiling, so the filter is closed and the system stays high-risk whatever its supplier's compliance page says. An AI that drafts formative feedback a lecturer then rewrites fits ground two far better. Keep the assessment per system, name the ground, and date it. A classification you cannot show an auditor is a classification you do not have.
Which AI Act duties land on you as deployer, and which on the supplier?
You are almost always the gebruiksverantwoordelijke, not the aanbieder. Article 26 duties are operational: use the system per the provider's instructions, assign human oversight to people with the competence and authority to act, keep the automatically generated logs at least six months, and inform workers' representatives and the affected students. Provider duties (risk management, technical documentation, data governance, conformity assessment) sit with whoever placed the AI inside OSIRIS, Eduarte, Brightspace or the proctoring tool on the market.
Article 25 moves provider duties to you in two situations an institution walks into by accident: you put your own name or brand on the system, or you change its intended purpose. A model that was sold to flag irregular attendance and is repointed at predicting study success has had its intended purpose changed by you, not by the supplier.
Then there is a duty private companies do not carry. Because a Dutch onderwijsinstelling is a body governed by public law or a private entity providing a public service, Article 27 adds a fundamental rights impact assessment for Annex III systems, from the same 2 December 2027 date. The Omnibus made that lighter in one practical way: the FRIA may now refer to, or incorporate parts of, the AVG data protection impact assessment you already hold, and in education that one is often central, the way SURF concluded its Microsoft 365 Copilot DPIA in May 2026 with two risks still rated orange. A central DPIA is a useful input. It is not your classification and not your FRIA.
How should an informatiemanager triage the stack before December 2027?
Five steps, in this order, and none of them need a budget round.
1. Inventory every system that touches a student decision, using the algorithm inventory list Npuls publishes rather than a new spreadsheet. 2. For each one record three fields: your role, the Annex III point if any, and the Article 6(3) ground if you are relying on one. 3. Pull the emotion question out of the pile and send it, in writing, to every proctoring and engagement-analytics supplier this quarter: that answer governs a live prohibition, not a 2027 deadline. 4. Fold the FRIA into the DPIA process you already run instead of building a second assessment. 5. Set a change trigger, so that a supplier's silent model upgrade re-opens the classification rather than quietly invalidating it.
Two failure modes are common. AI arriving without passing IT at all (the pattern we described in an earlier piece on AI ownership landing with IT) leaves you classifying a stack you cannot see, and the detect-and-channel design we set out in our post on shadow AI detection is the less expensive fix. A blanket ban on staff AI use also raises your Article 4 exposure rather than lowering it, because literacy is now a duty to support, not to forbid.
Where Crux Digits fits
We are the AI partner that works next to your ICT partner, not a replacement for one. For an institution in this band that means three things: classifying the AI you already own against Annex III and Article 6(3) so the file exists before an auditor asks; building what is not high-risk (document search, ticket triage, back-office automation) where the return is quickest; and writing the deployer artefacts for what is. Our AI implementation work for mid-sized organisations describes how that runs alongside an existing supplier landscape; the EU AI Act risk checker places a single system, and drawing up an AI policy covers the Article 4 side.
Last updated 26 October 2026. The deadlines above reflect Regulation (EU) 2026/1744; the Commission's high-risk classification guidelines were still in draft at that date.
Our AI Act Check (€950 fixed) gives you your risk classification, obligations and a concrete to-do list within one week, including what you can safely ignore.
See the AI Act Check →A consultant tells you where AI pays off; Crux Digits also builds it. A fixed price per step, one named expert, from Utrecht.
AI consultancy in the Netherlands →
