If you use AI to grade assessments and you operate in or sell into the EU, the EU AI Act applies to you. Assessment is one of the areas the Act treats most seriously, because a grading decision can affect whether someone gets a qualification or a job. This is a plain-language summary of what matters for assessment teams. It is not legal advice - confirm your own obligations with a qualified adviser.
Why assessment is treated as high-risk
The Act sorts AI systems by risk. Systems used in education and vocational training to evaluate learning outcomes, or to determine access to education, are explicitly listed in the high-risk category. The logic is straightforward: if a system's output decides whether someone passes a course or earns a credential, the stakes for the individual are high, so the obligations on the provider and the deployer are high too.
That means an AI tool that scores or grades assessments is not in the same low-stakes bucket as a chatbot that suggests study tips. Treat any AI that contributes to a grading decision as high-risk by default until you have confirmed otherwise.
The obligations that matter most for grading
You do not need to memorise the whole Act, but a few requirements show up directly in how you run assessments:
- Human oversight. High-risk systems must be designed so a person can understand, oversee, and override the output. For grading, this lands as a hard rule: a qualified person reviews and can change the AI's score.
- No solely-automated consequential decisions. Letting the machine decide a pass or fail with no human in the loop is exactly the pattern the Act is built to prevent in high-risk use.
- Transparency. People should know an AI system is being used and understand, in broad terms, how it reaches its output. Candidates being graded with AI assistance should be told.
- Record-keeping and traceability. High-risk systems need logging so decisions can be reconstructed and audited. For grading, that means an audit trail showing what was submitted, what the AI proposed, what evidence it cited, who reviewed it, and what they decided.
- Data governance. This sits on top of your existing GDPR obligations. Submissions are personal data, often sensitive, and need lawful basis, retention limits, and proper handling.
What this means in practice for your team
Translate the legal requirements into operational steps:
- Keep a human in the loop, and prove it. Do not just have a reviewer - record that the review happened, who did it, and what they decided. See why a person still has to sign off.
- Make every score explainable. A score with no cited evidence cannot satisfy transparency or traceability. Insist on reasoning you can show a candidate or an auditor.
- Tell candidates. Update your assessment policy and candidate information to disclose AI use in grading.
- Lock down the data path. Know where submissions are processed and stored, how long you keep them, and that processing is GDPR-compliant.
- Keep the audit trail. One coherent record per assessment: submission, AI output, evidence, reviewer, decision, timestamp.
This is not a reason to avoid AI
The Act does not ban AI in assessment. It bans careless AI in assessment. A well-designed system - human oversight built in, evidence cited, audit trail kept, data handled properly - is fully compatible with the Act and genuinely better than the alternatives. The teams that get caught out are the ones who bolt AI onto a process with no oversight and no records.
Where Scorafy fits
Scorafy is built compliance-first for this reason. A qualified assessor reviews and signs off every result, so no grading decision is solely automated. Every score is backed by cited evidence from the submission, which gives you the explainability the Act expects. The full chain - submission, AI proposal, evidence, reviewer, decision - is recorded as an audit trail. Data handling is GDPR-aligned with EU AI Act readiness in mind.
It is the assessment layer, not your whole compliance programme - you still own your policies and your legal advice. But it is built so that using AI in grading does not put you on the wrong side of the Act.
If you assess into the EU and want to see a compliant grading workflow end to end, book a demo. RTOs and VET providers can also see our RTO page for the sector-specific detail.