EdLaw
Artificial Intelligence Act (Regulation (EU) 2024/1689)
The EU's horizontal AI regulation, published in the Official Journal on 12 July 2024 (OJ L, 2024/1689) and in force since 1 August 2024 (the twentieth day after publication, Art. 113), applying in phases through 2028 (see APPLICATION-TIMELINE.md). It takes a risk-based approach: prohibited practices, high-risk systems with conformity requirements, transparency duties for certain systems, and a separate regime for general-purpose AI models. It applies to providers placing AI systems on the Union market wherever established, to deployers in the Union, and extraterritorially where a system's output is used in the Union (Art. 2(1)). Enforced by national market surveillance authorities; the Commission's AI Office supervises general-purpose AI models.
Amended. This folder reproduces the consolidated text CELEX 02024R1689-20260727: the Regulation as amended by Regulation (EU) 2026/1744 (the "Digital Omnibus on AI", 8 July 2026). The amendment materially changed the parts EdTech cares about — it postponed the application of the high-risk regime for Annex III systems to 2 December 2027 (Annex I systems: 2 August 2028) (Art. 113(c)), added prohibitions on AI generation of non-consensual intimate imagery and child sexual abuse material (points (ba)/(bb), applying from 2 December 2026), softened the Art. 4 AI-literacy duty, and inserted Art. 4a permitting special-category processing for bias detection. Secondary commentary describing the pre-amendment timeline (high-risk from August 2026) is now wrong.
Applicability to EdTech
- Education is a named high-risk area. Annex III point 3 lists AI systems intended to determine access or admission, evaluate learning outcomes (including steering the learning process), assess the appropriate level of education, or monitor and detect prohibited behaviour of students during tests. A vendor whose system is intended for these uses is a high-risk provider (Arts. 8–17); the school using it is a deployer (Art. 26).
- Emotion inference in education institutions is prohibited except for medical or safety reasons (Art. 5(1)(f)) — directly relevant to any classroom affect-detection or engagement-scoring feature. Emotion recognition outside the prohibition is itself Annex III high-risk (point 1(c)) and carries a disclosure duty (Art. 50(3)).
- Transparency duties apply regardless of risk class: telling people they are interacting with an AI system, and marking synthetic (AI-generated) content (Art. 50).
- Deployers that are bodies governed by public law or private entities providing public services — categories education institutions typically fall into — owe a fundamental rights impact assessment prior to deploying an Annex III high-risk system (Art. 27(1)); expect this to surface in procurement questionnaires.
- Integrating a general-purpose AI model (e.g. an LLM behind a classroom assistant) makes the GPAI provider's downstream-information duty (Art. 53(1)(b)) the integrator's entitlement; becoming a provider of a high-risk system by putting one's name on it, substantially modifying it, or repurposing it is governed by Art. 25.
- Both providers and deployers owe AI literacy measures to staff operating AI systems (Art. 4).
Contents
| Document | Covers |
|---|---|
| GENERAL-PROVISIONS.md | Arts. 1–4a — subject matter, scope, definitions, AI literacy, bias-detection processing |
| PROHIBITED-PRACTICES.md | Art. 5 — prohibited practices (incl. education emotion inference) |
| HIGH-RISK-CLASSIFICATION.md | Arts. 6, 7; Annex III — what counts as high-risk |
| HIGH-RISK-REQUIREMENTS.md | Arts. 8–15 — requirements for high-risk systems |
| OPERATOR-OBLIGATIONS.md | Arts. 16, 25–27 — provider/deployer obligations, value chain, FRIA |
| TRANSPARENCY.md | Art. 50 — disclosure and synthetic-content marking |
| GPAI.md | Arts. 51, 53, 55 — general-purpose AI models |
| REMEDIES-AND-PENALTIES.md | Arts. 85, 86, 99, 101 — complaints, explanation right, fines |
| APPLICATION-TIMELINE.md | Arts. 111, 113 — application dates (as amended) and transitional rules |
Scope note: the conformity-assessment machinery (Arts. 28–49), governance chapters and the remaining annexes can be added with the same tooling when needed.
Key obligations at a glance
- No emotion inference on students in education institutions, save medical/safety uses (Art. 5(1)(f)); applies since 2 February 2025 (Art. 113(a)).
- Annex III education systems: providers must meet risk-management, data-governance, documentation, human-oversight and accuracy requirements (Arts. 8–15) and the Art. 16 obligations — applying from 2 December 2027 (Art. 113(c)(i)).
- Deployers of high-risk systems: use per instructions, assign human oversight, ensure input-data relevance, monitor and keep logs (Art. 26).
- Disclose AI interaction and mark synthetic content (Art. 50(1)–(2)); pre-existing generators must comply with Art. 50(2) by 2 December 2026 (Art. 111(4)).
- AI-literacy measures for staff of providers and deployers (Art. 4(1)).
Enforcement
National market surveillance authorities (Chapter IX); the AI Office enforces the GPAI chapter with Omnibus-added powers (Arts. 75a–75d, not reproduced here). Fine ceilings: EUR 35m / 7% of worldwide turnover for prohibited practices (Art. 99(3)); EUR 15m / 3% for most operator obligations (Art. 99(4)); EUR 7.5m / 1% for misleading information (Art. 99(5)); GPAI providers up to 3% / EUR 15m (Art. 101(1)). Affected persons may complain to a market surveillance authority (Art. 85) and obtain explanations of individual decisions based on Annex III systems (Art. 86).
Licence
The corpus reproduces the EUR-Lex consolidated text of Regulation (EU) 2024/1689 (CELEX 02024R1689-20260727).
The EUR-Lex legal notice (eur-lex.europa.eu/content/legal-notice/legal-notice.html, read 2026-10-01 in the Internet Archive copy captured that day, because EUR-Lex refuses non-browser clients) says: "© European Union, 1998-2026 The Commission’s document reuse policy is based on Decision 2011/833/EU. Unless otherwise specified, you can re-use the legal documents published in EUR-Lex for commercial or non-commercial purposes." For consolidated texts it adds: "The copyright for the editorial content of this website, the summaries of EU legislation and the consolidated texts, which is owned by the EU, is licensed under the Creative Commons Attribution 4.0 International licence. This means that you can re-use the content provided you acknowledge the source and indicate any changes you have made."
Commission Decision 2011/833/EU on the reuse of Commission documents (OJ L 330, 14.12.2011, p. 39, read in the Publications Office Cellar copy on 2026-10-01) provides in Article 4 that "All documents shall be available for reuse: (a) for commercial or non-commercial purposes under the conditions laid down in Article 6", and Article 6(2) lists the conditions that may be attached: "(a) the obligation for the reuser to acknowledge the source of the documents; (b) the obligation not to distort the original meaning or message of the documents; (c) the non-liability of the Commission for any consequence stemming from the reuse."
Conditions, and how this corpus meets them:
- Acknowledge the source: each extracted provision carries a
{.meta}provenance line naming EUR-Lex and the CELEX number, and Sources links the EUR-Lex text. - Indicate changes (CC BY 4.0, for the consolidated text): the provision text is unchanged; the changes are the selection of provisions, the Markdown layout and the added anchors, all described in Meta.
- Do not distort the meaning: the text is reproduced verbatim and checked mechanically against the source (see Meta).
- No endorsement or liability: the corpus does not claim that the EU or the Publications Office endorses it, and only the Official Journal text is authentic.
The European Commission AI Office pages listed in Sources are cited, not reproduced.
Related
- EU GDPR — the Act is without prejudice to it (Art. 2(7)); most Annex III education uses also process pupils' personal data