AI Regulation and Compliance: The EU AI Act and Beyond
Work out which AI rules apply to your systems, what they require of providers and deployers, and how to build a compliance programme that keeps up as the rules are phased in.
Intermediate · Responsible AI · about 10 hours · 4 modules · certificate on completion
Taught by Siobhàn O'Briénn, Michèl Lambertè, AI Learning Companions.
About this course
The EU's AI Act, which the EU describes as the first comprehensive legal framework on AI anywhere, reaches organisations well beyond Europe: any that place AI systems on the EU market, or whose systems' outputs are used there. This course explains what it requires and how to comply, in plain language. You'll learn why AI is regulated, how the Act defines an AI system, and how its risk-based approach and staged timeline work. You'll work out your organisation's role for each system, recognise the practices the Act bans, decide whether a system is high-risk and list what providers and deployers must then do. You'll apply the rules for general-purpose AI models, and the transparency duties for chatbots, generated content and deep fakes, to products built on those models. Then you'll connect the Act with the GDPR and with frameworks used around the world, the NIST AI Risk Management Framework and ISO/IEC 42001, and plan a compliance programme from inventory to monitoring. Because the Act's obligations apply in stages, and some dates may be adjusted, you'll also learn where to check the current official timeline. The labs are classification and drafting exercises on realistic scenarios, and the course ends with a compliance plan for a fictional company.
What you'll learn
- Explain why AI is regulated, and how the EU AI Act's risk-based approach and staged application work
- Identify whether your organisation is a provider, a deployer or another operator for each AI system
- Classify AI systems as prohibited, high-risk, subject to transparency duties or minimal risk, and list the obligations that follow
- Apply the rules for general-purpose AI models, and the transparency duties, to products built on them
- Connect the AI Act with the GDPR, the NIST AI RMF and ISO/IEC 42001, and plan a compliance programme
Skills you'll gain
EU AI Act, AI risk classification, High-risk AI requirements, General-purpose AI rules, AI transparency duties, GDPR and AI, NIST AI RMF, ISO/IEC 42001, Compliance programmes
Before you start
No legal training is needed, but it helps to know how AI systems are built or bought, and the basics of data protection. The course explains the law so you can work well with your legal and compliance advisers; it isn't legal advice.
Modules
Why AI is regulated, and the EU AI Act's approach
The risks that lead governments to regulate AI, the AI Act's scope, definition, risk-based approach and staged application, and the roles it gives organisations.
- Why AI is regulated (10 min)
- The EU AI Act at a glance (14 min)
- Roles: providers, deployers and others (12 min)
- Hands-on lab: Build an AI inventory and identify roles
Prohibited practices and high-risk systems
The practices the AI Act bans, how to tell whether a system is high-risk, and what providers and deployers of high-risk systems must do.
- Prohibited practices (12 min)
- What makes a system high-risk (12 min)
- Obligations for high-risk systems (14 min)
- Hands-on lab: Classify AI systems under the AI Act
General-purpose AI and transparency
The rules for general-purpose AI models, what changes when you build a product on someone else's model, and the transparency duties for chatbots, generated content and deep fakes.
- General-purpose AI models (12 min)
- Building on general-purpose AI models (10 min)
- Transparency obligations (12 min)
- Hands-on lab: Write the transparency measures for a product
The GDPR, other frameworks and your compliance programme
How the AI Act works alongside the GDPR, how the NIST AI RMF and ISO/IEC 42001 can structure your work, and how to build a compliance programme that keeps up with a changing timeline.
- How the AI Act fits with the GDPR (12 min)
- Beyond the EU: NIST AI RMF, ISO/IEC 42001 and international principles (12 min)
- Building a compliance programme (14 min)
Project: An AI Act compliance plan for an HR-technology company
A fictional HR-technology company of 300 staff, based in the EU, has asked for a compliance plan. It sells a CV-screening and candidate-ranking product, built on its own models, to employers across the EU. It's piloting an add-on that infers employees' emotions from their webcams during video calls, to give managers a team mood score. It offers a chatbot for candidates on clients' career sites, built on another firm's general-purpose AI model through an API. Internally, it uses a vendor's tool that monitors its own staff's productivity and flags low performers for review. Its marketing team makes blog illustrations with an image generator, and its finance team calculates commissions in a spreadsheet with fixed rules. Write the plan: classify every system and the company's role for it, say what must happen to anything prohibited, analyse the gaps for the high-risk systems as provider and as deployer, set out the transparency measures, explain how the GDPR applies alongside the Act, and design the governance and programme that will keep the company compliant. Describe obligations by stage rather than relying on fixed future dates, and say where the company should check the current timeline.