> For the complete documentation index, see [llms.txt](https://experience-digital-transform.gitbook.io/experience-digital-transformation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://experience-digital-transform.gitbook.io/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/ai-governance-regulations-regulatory-reference-and-the-education-sector.md). # AI Governance — Regulatory Reference and Education Published regulations and treaties, the seven core governance obligations, high-risk application categories, and AI's promise and risk for assessment, learner registries, and EdTech in education. {% hint style="info" %} Second of two pages on Component 3 Category 4 (AI Governance Regulations). This page surveys published regulations and treaties, summarises key regulatory elements, and addresses the AI governance challenges specific to the education sector. The first page covers the global landscape, the three foundational regulatory questions, the four governance approaches, and best-practice applications. {% endhint %} ## 3. Key Published Regulations and References | Jurisdiction | Instrument | Year | Scope / status | Key features and Primer relevance | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Council of Europe | Framework Convention on AI, Human Rights, Democracy and Rule of Law (CETS 225) | 2024 | International treaty; 37 signatories incl. US, EU, Japan, Canada | First binding international AI treaty. Public sector focus. Principles-based — achievable without EU-level institutional infrastructure. Best entry-level international anchor for developing countries. | | European Union | EU AI Act (Regulation EU 2024/1689) | 2024 / phased to 2027 | EU + extraterritorial; in phased implementation | Most comprehensive reference architecture. Risk classification: prohibited, high-risk, transparency obligations, minimal risk. Education AI classified as high-risk. GPAI model obligations from Aug 2025. High-risk requirements Aug 2026. | | Singapore | Model AI Governance Framework for Generative AI (2024); AI Playbook for Small States (2024) | 2024 | National + regional guidance | Principles-based with sector guidance. AI Playbook co-developed with Rwanda specifically for smaller states. Reference for proportionate governance adapted to development context. | | African Union | Continental AI Strategy (2024); Africa Declaration on AI (2025) | 2024 / 2025 | Continental; non-binding strategy | Development-focused, Africa-centric approach. Endorsed by 49 countries at Kigali 2025 summit. Data governance as pathway to AI governance. Most relevant regional framework for African developing countries. | | ASEAN | ASEAN Guide on AI Governance and Ethics | 2024 | Regional; voluntary principles | Non-binding principles: transparency, fairness, security, reliability, privacy, accountability, human centricity. Innovation-friendly approach. | | United States | NIST AI Risk Management Framework (AI RMF) v1.0; Executive Order on Safe, Secure and Trustworthy AI (rescinded 2025 but influential) | 2023 / 2023 | National; voluntary + sector guidance | NIST AI RMF widely adopted globally as a voluntary governance tool. Six functions: govern, map, measure, manage. Complement to the EU risk-based approach. | | China | Generative AI Interim Measures; Algorithm Recommendation Measures; Deep Synthesis Provisions | 2022–2023 | National; sector-specific binding | State-directed approach with content moderation focus. Relevant for countries using Chinese AI infrastructure. Risk: governance oriented toward state interests rather than individual rights. | | UNESCO | Recommendation on the Ethics of Artificial Intelligence | 2021 | Global; non-binding recommendation | Adopted by 193 UNESCO member states. Establishes global ethical AI principles. Useful foundation for developing countries before binding legislation is ready. | | OECD | OECD AI Principles; OECD AI Policy Observatory | 2019 / ongoing | Global; non-binding principles | Foundational principles adopted by G20 nations. Definition of AI system used by the EU AI Act and CoE Convention. AI Policy Observatory provides a comparative national policy database. | ## 4. Summary of Key Regulatory Elements ### 4.1 Scope — what AI applications to govern and at what level The scope design choice in AI governance is more consequential than in most other regulatory domains because AI systems span an enormous range of risk profiles — from spam filters and recommendation algorithms with minimal societal impact to life-or-death medical diagnosis systems, creditworthiness assessors, and criminal justice tools. A governance framework applying the same requirements to all AI systems will either impose unacceptable compliance burdens on low-risk applications or provide inadequate governance for high-risk ones. The risk-based approach — calibrating requirements to risk level — is the emerging consensus, embodied in both the EU AI Act and the Council of Europe Convention. For developing countries, the practical scope recommendation is sequential: begin with an inventory of AI applications already deployed or under active development in government systems; classify them by risk level using the EU's high-risk category list as a reference (adapted to the country context rather than applied verbatim); impose governance requirements proportionate to risk; and expand scope as institutional capacity develops. ### 4.2 Core governance obligations Seven governance obligations appear consistently across effective AI governance frameworks and represent the minimum viable set for any national framework: * **Transparency** — affected individuals must know when a consequential decision about them has been made or significantly influenced by an AI system. The minimum accountability requirement, achievable without significant technical infrastructure. * **Explainability** — individuals affected by AI-driven decisions must have access to an understandable explanation of the factors that influenced the decision, in a form they can act on. The level of technical explainability required should be calibrated to what the affected individual can use. * **Human oversight** — AI systems making or significantly influencing decisions affecting individual rights must have human oversight mechanisms that allow errors to be identified and corrected before or after they cause harm. For high-risk applications this means human review before decisions are acted on; for lower-risk applications it may mean audit mechanisms and complaint channels. * **Non-discrimination** — AI systems must not discriminate against individuals or groups based on protected characteristics. This obligation is closely linked to data governance: AI systems trained on biased data will produce biased outputs regardless of algorithmic design. * **Data governance** — AI systems can only be as trustworthy as the data on which they are trained and the data they process. Strong data governance — accurate, complete, relevant, and bias-audited training data — is the foundation on which AI trustworthiness rests. This obligation connects directly to the [data protection framework](/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/data-protection-and-privacy-global-landscape-and-foundations.md). * **Documentation and auditability** — AI systems used in high-risk applications must be documented throughout their lifecycle: development data, design choices, performance testing results, known limitations, and deployment parameters must be recorded and accessible to oversight bodies. * **Redress mechanisms** — individuals affected by AI-driven decisions must have accessible mechanisms to challenge those decisions and seek correction of errors. The enforcement dimension of transparency and explainability: rights without enforcement mechanisms are declarations rather than operational protections. ### 4.3 High-risk applications requiring enhanced governance Drawing on the EU AI Act's Annex III and adapting for developing country contexts, the following categories of AI application should be treated as requiring enhanced governance regardless of the maturity of the overall AI governance framework: * **AI in education** — systems that determine access to education, assess learner capabilities, provide adaptive learning interventions, or generate educational credentials. The EU AI Act explicitly classifies these as high-risk. For the education sector, all AI-based assessment and admissions systems fall in this category. * **AI in government benefit allocation** — systems that determine eligibility for social assistance, healthcare, housing, or other government benefits. The AI applications with the most direct impact on the most vulnerable populations and the highest risk of discriminatory outcomes when training data reflects existing inequalities. * **AI in law enforcement and justice** — systems used for risk assessment in criminal proceedings, predictive policing, parole and sentencing recommendations, and border control. Direct effects on fundamental rights requiring the strongest governance provisions. * **AI in health care** — diagnostic systems, treatment recommendation systems, triage systems, and pharmaceutical development systems. Medical AI errors can have life-or-death consequences, and the asymmetry of expertise between AI systems and patients requires strong human oversight and explainability obligations. * **AI for biometric identification** — facial recognition, voice recognition, behavioural analysis systems used to identify individuals. The EU AI Act prohibits most real-time biometric identification in public spaces for law enforcement purposes. Developing countries should treat all biometric AI with heightened scrutiny given the surveillance risk. ### 4.4 Institutional responsibilities AI governance requires a designated authority with the technical capacity to assess AI systems — not just legal compliance assessors but people who can evaluate whether an AI system's claimed properties are technically credible. This is the most acute capacity constraint in developing countries: the skills required to audit AI systems are among the scarcest in any government's human capital. The institutional design options mirror the cybersecurity institutional home question: should AI governance sit in the data protection authority (existing mandate over data but may lack AI technical expertise), a dedicated AI authority (would have the mandate but require new institutional construction), or a digital development ministry (technical proximity but may lack independence and individual rights focus)? The most defensible developing country approach is to empower an existing authority — typically the data protection authority — with an explicit AI mandate and invest in building the technical capacity to exercise it, rather than creating a new institution that will face the same talent constraints from scratch. ## 5. Implications for Digital Government and the Education Sector ### 5.1 AI in education — promise, risk, and the governance imperative Artificial intelligence is already being used in educational contexts globally in ways that are consequential for learners' futures: adaptive learning systems that personalise instruction, automated essay assessment systems, early warning systems that flag students at risk of dropping out, admissions algorithms that influence university entry, and plagiarism detection systems that can end academic careers. The promise is real — AI can make quality personalised instruction available at scale in ways human teaching alone cannot achieve. The risk is equally real — AI systems in education can entrench biases present in training data, make opaque decisions that students cannot understand or challenge, and create surveillance environments that undermine the conditions for genuine learning. The EU AI Act's explicit classification of education AI as high-risk is the most significant international regulatory statement about AI in education to date: it means that AI systems that determine or significantly influence access to education — admissions algorithms, national examination assessment systems, learning path systems — must meet the full set of high-risk requirements: conformity assessment, documentation, human oversight, transparency, and registration. For developing countries designing AI governance frameworks, this classification is a strong signal that education AI deserves the same regulatory attention as health AI and law enforcement AI. ### 5.2 AI-based assessment — the governance priority Automated assessment of student work — essays, examinations, oral responses, project submissions — is the category of education AI that most immediately requires governance. Assessment decisions directly determine educational progression, credentialing, and access to further education. Errors in automated assessment have concrete consequences for individual learners. Assessment systems trained on data from specific demographic groups will perform differentially across other groups, and systems that are opaque — where students cannot understand why they received a particular score — undermine the educational function of assessment, which is not just measurement but feedback for learning. {% hint style="success" %} The governance requirements for AI-based assessment follow directly from the seven core obligations above: students must know when their work has been assessed by an AI system (transparency); must have access to an understandable explanation of their score (explainability); must be able to request human review (human oversight); must be protected from discriminatory assessment (non-discrimination); the system must use high-quality, representative training data (data governance); the system must be documented and auditable by education authorities (documentation); and students must have accessible routes to challenge assessments they believe are wrong (redress). A national AI governance framework that does not address assessment AI as a high-risk category is failing its most fundamental obligation to learners. {% endhint %} ### 5.3 AI and the learner registry — automated decision-making about children National learner registries — when combined with AI analytical tools — create conditions for algorithmic decision-making about children that has no equivalent in physical education systems. AI systems applied to learner registry data can identify 'at-risk' students, recommend differentiated educational pathways, flag learners for targeted interventions, and predict future educational and employment outcomes. Each application has genuine potential value for educational policymaking and individualised support. Each also creates risks: the at-risk classification system that systematically misclassifies students from certain ethnic or socioeconomic backgrounds; the pathway recommendation system that channels disadvantaged students toward lower-status educational tracks; the outcome prediction system whose predictions become self-fulfilling through the interventions they trigger. The governance requirement for AI applied to learner registry data is not that such AI should not be used — it may be genuinely beneficial — but that its use must be governed with the same seriousness as any other high-risk AI application affecting individual rights. The seven core obligations apply, with particular emphasis on non-discrimination (systematic bias testing disaggregated by protected characteristics), human oversight (education professionals must review and take responsibility for AI-influenced decisions about individual students), and redress (students and families must be able to challenge algorithmically-influenced educational decisions through accessible mechanisms). ### 5.4 EdTech AI and the knowledge sovereignty question A large and growing proportion of AI systems used in education in developing countries are supplied by international EdTech companies whose AI systems were developed, trained, and validated in other national contexts — typically advanced economy contexts with different demographic compositions, linguistic structures, pedagogical traditions, and curriculum frameworks. An AI-based reading assessment system trained primarily on English-language text from American students will not perform equivalently for students reading in Swahili, Tamil, or Amharic. An adaptive mathematics system designed around a Western curriculum framework will not align with a national curriculum that sequences concepts differently. This knowledge sovereignty dimension of AI governance in education is underaddressed in existing international frameworks. It requires developing countries to ask not only whether EdTech AI is transparent and accountable in general terms, but whether it is validated for the specific population it is being used with and whether its training data and design assumptions are appropriate for the country's educational context. Procurement requirements for EdTech AI should include evidence of local context validation as a baseline condition, parallel to the cybersecurity requirements proposed in [Component 3 Category 3](/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/cybersecurity-regulations-regulatory-reference-international-frameworks-and-the-education-sector.md) (Cybersecurity). This is not protectionism — it is the basic quality assurance that any consequential tool deployed with children should be required to demonstrate. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://experience-digital-transform.gitbook.io/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/ai-governance-regulations-regulatory-reference-and-the-education-sector.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.