AI in Schools – Student Assessment, Teacher Monitoring, and High-Risk Testing under the AI Act | Word/PDF/Excel

AI-assisted student assessment in schools – templates for high-risk assessment, independent teacher review, and data protection. When an AI solution analyzes test answers, suggests knowledge assessments, or affects students' educational paths, the school authority needs to know what the tool actually does, whether it may be subject to the high-risk rules of the EU AI Act, and how the teacher's responsibility should be ensured.

Quick answer: This document package helps schools and educational providers document that assessment. It contains 7 editable Word files, 7 corresponding searchable PDF files, and 1 Excel workbook with 9 tabs, totaling 15 files. Five working documents and a guide are in Swedish; the seventh Word/PDF file is an English user guide. It is not a legal certification or an AI tool that grades students' tests.

Who is the document package for?

For school authorities, principals, teachers, data protection officers, and educational providers who want to control AI-based grading, grading support, and assessment of learning outcomes before a pilot or deployment. For example:

• A school is testing an AI service that suggests partial grades based on student assignments and wants to document actual teacher control.
• An educational provider needs to assess whether a digital assessment tool falls under AI Act Annex III point 3(b) and what requirements apply.
• An authority wants to distinguish information to students and guardians from the legal basis under GDPR, and DPIA from a possible FRIA.

When is this not the right template? If the need is a pure test template without AI, a complete standalone GDPR impact assessment, technical model audit, final grading decision, or a legal final opinion. Not all AI feedback in teaching is automatically a high-risk system.

File by file – 15 delivery files

Excel – nine clear working tabs

Start provides an overview and scope. System contains the supplier, version ID, and intended purpose. Risk assessment collects manual AI Act assessments. Supplier stores references to instructions and contract documentation. Student info helps follow up on actual information. Teacher review logs the review and stopping of incorrect AI recommendations. DPIA-FRIA separates privacy and fundamental rights assessments. Decision registers only human decisions. Sources lists public legal and authority sources.

The workbook has been tested with both missing and registered fields. The result can show “Missing documentation” or “Documentation registered”, but never “legally approved”. Do not enter identifiable students or sensitive student information; instead, use internal references to a secure system.

Regulations – what applies in 2026 and 2027?

EU AI Act (EU) 2024/1689: Annex III point 3 covers, among other things, certain AI systems intended to assess learning outcomes and monitor prohibited student behavior during tests. The classification depends on the system's intended and actual use, as well as the assessment of Article 6, including any exceptions. AI-based exercise feedback without corresponding functionality should not automatically be described as high-risk.

Important date: After amending regulation (EU) 2026/1744, relevant high-risk requirements for systems under Annex III should apply from December 2, 2027. Transitional provisions, such as Article 111, and other previously applicable requirements must be assessed separately.

GDPR already now: Personal data processing needs an actual legal basis and correct information. IMY's guidance on impact assessment highlights risks with new technology, systematic assessments, and the processing of children's data. A DPIA under GDPR and a possible FRIA under AI Act Article 27 should not be merged into an automatic claim that both are completed. Assess the requirements for the specific activity.

Teacher's responsibility: According to Skolverket's advice on AI, AI may not replace the teacher's professional competence or decision on grades. It is therefore central to document independent review and actual corrections.

How to use the package

1. Describe the AI tool's intended purpose, supplier, and actual use in teaching.
2. Assess Annex III point 3 and Article 6; document legal uncertainties instead of guessing.
3. Test that teachers can override, correct, and stop AI results in relevant scenarios.
4. Perform legal basis and data protection assessment and design information that suits students' age and situation.
5. Assess separately whether a full DPIA and possible FRIA are needed. Use responsible specialists when requirements demand it.
6. Make a reasoned pilot, change, or stop decision and follow up on deviations with evidence references.

Frequently asked questions

Is AI grading automatically high-risk under the AI Act?

Not always. AI that assesses learning outcomes and affects students' educational paths may be covered by Annex III. A support for general exercise feedback may have a different function. Assess the actual use and Article 6.

Can an AI model set grades without a teacher?

The package assumes that the teacher's professional responsibility and grading decision cannot be replaced by AI. Built-in human review must be real and documentable, not a formal “Approve” button.

Must the school conduct a DPIA for all AI?

Not automatically. Assess the concrete processing and risks according to GDPR Article 35. Children, new technology, and extensive individual assessment are important risk factors.

What is the difference between DPIA and FRIA?

DPIA is an impact assessment of personal data processing under GDPR. FRIA assesses certain fundamental rights effects when using high-risk AI under AI Act Article 27. The obligations may overlap but are not identical.

When do the relevant high-risk requirements for AI in education apply?

For affected AI systems under Annex III, the main date is December 2, 2027, according to 2026/1744. Other GDPR and school law rules may already apply.

Are the English documents the same as the Swedish working templates?

No. Five working templates and Excel are in Swedish. There is a Swedish user guide and a separate English User Guide, but not a complete English translation of the working templates.

Are the PDF files interactive forms or an authority form?

No. The PDF versions are searchable and printable, the Word files are editable, and Excel is a register support. No file is authority-approved or automatically performs the legality assessment.

Related document templates

If a full assessment of personal data processing is needed, see DPIA / GDPR Impact Assessment. For broader governance of AI activity, see AI Governance Package. For a standalone course knowledge test without this legal AI focus, see Knowledge Test & Assessment Matrix.

Sources and review

EU AI Act in consolidated version, amending regulation 2026/1744, EU Commission's AI Act Service Desk on education, Skolverket's advice, and IMY's guidance on DPIA and FRIA.

Version 1.0. Source review: November 12, 2026. AI-assisted review of public sources; not independent legal review, quality-assured authority certification, or individual legal opinion. The product is an administrative documentation support. Delivery format is digital ZIP with Word/PDF/Excel. No purchase or download link is active before the product is published and the delivery file is attached separately.