EU AI Act 2026: What Universities Need to Know About Peer Assessment Compliance

Section 1 The August 2, 2026 Deadline — What It Actually Means for Universities

The EU AI Act (Regulation 2024/1689) entered into force on August 1, 2024. The regulation rolled out in phases, and the full high-risk AI obligations apply from August 2, 2026. For university technology and procurement teams, that date should already be on your roadmap.

What changes on that date is significant: any AI system deployed in a "high-risk" context must satisfy a defined set of requirements around transparency, human oversight, data governance, and documentation. Systems that don't comply cannot legally be deployed within the EU — including across EU-hosted institutions and institutions receiving EU public funding.

For context, here's the high-level timeline:

The practical implication: if your university is still running a non-compliant peer assessment platform after August 2, 2026, you are operating an illegal AI system under EU law. Penalties under the EU AI Act reach up to €30 million or 6% of global annual turnover, whichever is higher.

Section 2 Why Peer Assessment Tools Are Classified High-Risk Under Annex III

The EU AI Act defines high-risk AI systems in Annex III. Category 3 covers AI used in education and vocational training. Specifically, AI systems used to:

• Determine access to educational institutions — including assessment of academic performance
• Evaluate learners — grading, scoring, or ranking students using AI
• Monitor and detect prohibited behavior during assessments — AI-based proctoring

Peer assessment platforms that use AI to aggregate peer scores, detect outlier reviewers, assign grades, or guide rubric calibration fall squarely within Annex III. This is not a judgment call — the European Commission has been explicit that automated grading and assessment systems in education are high-risk.

Many legacy peer assessment platforms — including those that rely on algorithmic score aggregation or AI-flagged anomalies — were not designed with these requirements in mind. Vendors who are slow to adapt leave universities holding the regulatory liability.

Section 3 What Compliance Requires: The 7 Key Obligations

Articles 9–16 of the EU AI Act lay out the core obligations for high-risk AI systems. For university procurement and DPOs evaluating peer assessment tools, here are the seven requirements that matter most:

• 1
  Risk Management System (Article 9)

  The AI system must have an ongoing risk management process — documented, reviewed, and updated. Not a one-time assessment: a live process.
• 2
  Data Governance & Training Data Quality (Article 10)

  Training data must meet quality criteria: relevant, representative, free of errors and completeness gaps. Datasets used to train scoring models must be documented and auditable.
• 3
  Technical Documentation (Article 11)

  A technical file must be maintained before market placement and kept up to date throughout the system lifecycle. National authorities may request this file at any time.
• 4
  Record-Keeping & Audit Trails (Article 12)

  Automatic logging of system events "to the extent that such logs are technically possible." Logs must be kept for a period appropriate to the intended purpose — typically the duration of the assessment period plus a defined retention window.
• 5
  Transparency & User Information (Article 13)

  Users — including students — must be informed that they are interacting with an AI system. Instructions for use must be clear, complete, and in an accessible format.
• 6
  Human Oversight (Article 14)

  The system must be designed to allow effective human oversight. Instructors must be able to override, correct, or halt the system's output. The AI cannot operate as a black box with no meaningful human review.
• 7
  Accuracy, Robustness & Cybersecurity (Article 15)

  Performance must be consistent and validated against appropriate benchmarks. The system must be resilient to adversarial manipulation (e.g., students gaming peer scores) and protected against data breaches.

Section 4 Migration Checklist for Peergrade & Eduflow Users

Peergrade was acquired by Babbel in 2021 and has not publicly released an EU AI Act compliance roadmap. Eduflow has similarly been quiet on this front. If your institution runs either platform, the window to migrate before August 2, 2026 is tighter than it looks — EU procurement cycles typically require 3–6 months from contract approval to full deployment.

This checklist covers what your team needs to do before the deadline:

Section 5 How ChallengeMe Addresses Each Compliance Requirement

ChallengeMe was built with EU regulatory compliance as a design requirement, not an afterthought. Here's how the platform addresses each of the seven Annex III obligations:

We acknowledge that SOC 2 Type II certification is still in progress — expected completion by Q2 2026. All other Article 9–16 obligations are active. We provide a complete compliance documentation package to any institution conducting EU procurement due diligence.