Universities and colleges that use AI agents to decide admissions, evaluate learning outcomes or monitor students during exams are deployers of high-risk systems under the EU AI Act. Article 26 requires them to give oversight to staff with the necessary competence, training and authority. That means admissions officers, examiners and invigilators who understand the agent and can overrule it.
What does Article 26 require of a university?
In substance, a deployer of a high-risk system must: use it according to the provider's instructions; assign human oversight to natural persons with the necessary competence, training and authority, and support them; ensure input data under its control is relevant and sufficiently representative; monitor the system, inform the provider of risks and suspend use if a serious risk appears; report serious incidents; keep logs under its control for an appropriate period; inform workers' representatives before using it at work; and inform people subject to its decisions where the Act requires. Public universities, and private institutions providing public services, may also need a fundamental rights impact assessment under Article 27.
Proof of competence, the theme of this article, is set out in general terms in what evidence of competence is.
Which higher education uses are high-risk?
The Act treats several education uses as high-risk, in substance:
- deciding access or admission to education and training;
- evaluating learning outcomes, including when that steers a student's learning path;
- assessing the level of education a person should receive or can access;
- monitoring and detecting prohibited behaviour by students during tests.
So an agent that ranks applicants, marks assessments, places students into levels or flags possible cheating in an online exam is high-risk for that purpose. An agent that answers student questions about timetables, drafts reading lists or summarises lecture notes generally is not, though transparency rules apply when students talk to it. Student services teams often run such agents alongside contact-centre style operations, a setting covered in how contact centres prove staff are trained to oversee AI agents.
What competence does each role need?
Admissions officers overseeing an agent that ranks or filters applicants need to understand what it weighs and what it cannot see. A grade confirmed by an examination board is a signed fact; a personal statement is declared; a reference letter emailed in is external until verified. Officers must recognise proxy criteria, such as school or postcode patterns that stand in for background, and refuse to act on them. They must be able to admit against the agent's ranking.
Examiners and markers overseeing an agent that marks or pre-marks work must check its marks against their own judgement on a sample and on every borderline case, and must own the final mark. A student appealing a mark must find a person who can explain it.
Invigilators and academic integrity staff overseeing exam monitoring agents carry the heaviest responsibility. An agent's flag of possible cheating is not evidence of cheating. Staff must know the agent's false-flag patterns, for instance students who look away to think, students with disabilities, or poor connections, and must investigate before any allegation reaches a student.
Authority must be explicit. An examiner who overrules the agent's mark, or an integrity officer who dismisses its flag, should not need a committee's approval to do so.
Training must keep up. An agent's certificate lapses after 90 days and is renewed against real cases; a run that clears no depth drops it to depth 1 the same day, and marking or monitoring becomes manual at once, which in exam season is a serious capacity question.
How does a university meet Article 26's competence duty?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Oversight assigned to named people | Named overseers per high-risk use, by faculty and exam session | Assignment register |
| Necessary competence | Assessment on the institution's own past cases, including false flags | Assessment records per overseer |
| Training kept current | Briefing before each admissions cycle and exam period, and at agent changes | Briefing records linked to agent change log |
| Necessary authority | Regulations allow examiners and integrity staff to overrule the agent | Academic regulations; overrides in the record |
| Monitor and suspend | Named lead can suspend monitoring or marking agents | Suspension events and fallback plans |
| Inform staff representatives | Consultation before agents change academic staff work | Consultation records |
| Impact assessment (Article 27, where it applies) | Assessment covers the oversight step and staff competence | Assessment versions |
What will a regulator or auditor ask?
A market surveillance authority, a data protection authority following a student complaint, or a quality body may each ask: which agents are high-risk? Who oversees admissions ranking, marking and exam monitoring, and how were they trained? Show an appeal and how the mark was explained. How many integrity flags were dismissed by staff, and how many led to allegations? How are students told an AI system was used? A zero dismissal rate on monitoring flags is a warning sign that oversight is not happening.
What does Article 26 not cover?
It does not decide academic standards or admissions policy. It does not apply to non-high-risk agents. It does not prescribe training content. It does not replace data protection duties, which are heavy when monitoring students. And it does not move responsibility to the provider of an exam monitoring or marking product. Comparable duties in public bodies more widely are covered in Article 26 duties in the public sector, and in a sector with a similarly listed use in insurance.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's Foundations track is open to anyone, including students, takes about four hours and earns a free badge with no expiry, stamped with the product version. For a university, that gives admissions, examination and integrity staff a shared baseline before role-specific training on the agents they oversee. The levels are set out in AI literacy and certification for people who work with agents.
Questions people ask
Is an agent that gives formative feedback high-risk?
If it evaluates learning outcomes in a way that steers a student's learning path, it may be. Feedback that does not affect marks or progression is a weaker case. Check the exact use with counsel.
Can an exam monitoring flag be sent straight to a student?
It should not be. A flag should be reviewed by trained staff, who decide whether there is anything to raise. Sending flags directly treats the agent's output as an allegation.
Who should approve admissions the agent ranked low?
An admissions officer within their mandate, without needing extra approval. Making overrides harder than following the agent builds the agent's bias into the process.