Watching Conformly audit Lumio
Lumio is a EdTech platform putting AI into production, sure the EU AI Act doesn't apply to them. Scroll down to see what a two-minute audit actually finds — and what each finding means, without the legal jargon.
Lumio
Learning that adapts. · Online education platform
“We help students learn — our AI just grades quizzes and answers questions. That's harmless, surely?”
- Auto-GraderScores exams and assignmentsdeclared
- Study botAnswers student questions 24/7declared
- npm:@proctor-vision/focusWebcam attention & stress detection during examsundeclared
- openai:gpt-4oGenerates lesson scripts and video voiceoversundeclared
- Content RecommenderSuggests the next lessonundeclared
The founder named 2. A read-only scan of the code found 5. Here is what each one means — in plain words.
Exam Proctoring — Stress Detection
Watches students through the webcam during exams and flags 'stress' or 'suspicious emotion'.
Not allowed. Reading students' emotions with AI is banned in education — exactly like it's banned at work. An exam room is a classroom, so this feature has to come out.
In plain words: You can't point a computer at a student's face to judge their feelings. In schools, the law forbids it.
Art. 5Article 5(1)(f) prohibits AI that infers the emotions of a person in the areas of workplace and education (narrow medical/safety exceptions aside). In force since 2 February 2025.
Remove emotion/stress detection from proctoring. Integrity checks that don't infer emotion are a separate question.
Conformly flags it as prohibited on classification, citing Article 5 — so it's caught in review, not in a complaint.
An inspector would open with: "List every system that analyses a student's face, voice or emotional state, and the basis for it."
Auto-Grader
Scores exams and assignments that affect whether a student passes or advances.
Because these scores shape a student's education and future, the law makes this high-risk. Keep it — but prove it's accurate and unbiased, keep a teacher able to override it, and document how it grades.
In plain words: If the computer decides your grade, it has to be checkable and a human has to be able to step in.
Annex IIIAnnex III(3)(b) lists AI evaluating learning outcomes as high-risk, triggering Articles 9–15.
Start the high-risk checklist: accuracy and bias testing, a teacher-override path, and the Annex IV technical file.
Conformly turns the classification into the obligation list, tracks evidence, and generates the technical file.
An inspector would open with: "Show the accuracy and bias evaluation for the grading model, and the human-review process."
Study Bot
Answers student questions in the app, around the clock.
Just add honesty: students must be told they're talking to an AI, not a tutor. One line of text.
In plain words: A homework helper is fine — as long as it admits it's a bot.
Art. 50Article 50(1) requires people interacting with an AI system to be told so, unless it is obvious. Applies from 2 August 2026.
Add "You're chatting with Lumio's AI study assistant" to the chat.
Conformly hosts the public transparency page and the embeddable disclosure chip for you.
AI Lesson Videos
Generates narrated lesson videos from a script.
AI-made lesson media has to carry a machine-readable 'made by AI' mark. No one has to see it, but it has to be there.
In plain words: If a computer made the video, it needs an invisible 'AI-generated' tag under the hood.
Art. 50(2)Article 50(2) requires generative systems to mark synthetic outputs machine-readably, with a transition to 2 December 2026 for systems already on the market.
Enable content credentials (C2PA) or provenance metadata on generated videos.
The obligation lands on your task list, and the free watermark checker confirms whether your output already carries provenance metadata.
Content Recommender
Suggests which lesson a student should do next.
Nothing to do. Suggesting a next lesson doesn't decide anything binding about the student. Minimal risk.
In plain words: A 'you might like this next' nudge doesn't touch anyone's rights. It's fine.
—Not high-risk and outside Article 50 — minimal-risk, voluntary good practice only.
No action required. Keep it in your inventory so the record is complete.
Conformly keeps it listed, so 'we have nothing else' is documented, not assumed.
The verdict
Lumio thought grading quizzes was harmless. The audit found a proctoring feature that had to be switched off, a grader that now needs a real compliance file, and two honesty fixes — while the recommender was fine.
That startup was made up. Your AI isn't.
The same deterministic engine can classify your real systems in two minutes — no sign-up, no sales call. Or drop the read-only scanner into your codebase and see what it finds.
npx conformly-scan --dry-run
An example audit — a realistic walkthrough of how Conformly's deterministic engine classifies this kind of AI product. Not legal advice.