The EU AI Act course, in 6 modules.

Module 1 · ~25 min

Understanding the AI Act: origins and scope

Why this regulation?

Proposed by the European Commission in April 2021, adopted in June 2024 and published in the Official Journal of the EU on 12 July 2024, Regulation (EU) 2024/1689 - the AI Act - entered into force on 1 August 2024. Its goal: ensure that AI systems placed on the European market are safe and respect fundamental rights, while supporting innovation (regulatory sandboxes, SME measures). It is a regulation: it applies directly in all Member States, with no national transposition.

What is an "AI system"?

Article 3 adopts the OECD definition: a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness, and that infers from the input it receives how to generate predictions, content, recommendations or decisions that can influence physical or virtual environments. The key word is infer: plain software running on fixed rules is not an AI system within the meaning of the regulation.

The operators in the value chain

Beware of the change of role (Art. 25): a deployer that puts its trademark on a high-risk system, substantially modifies it or repurposes its intended use becomes a provider, with all the associated obligations.

Extraterritorial scope

Like the GDPR, the AI Act reaches beyond EU borders: it covers providers placing systems on the Union market wherever they are established, and third-country providers and deployers whenever the system's output is used in the EU.

What falls outside the regulation

• Exclusively military, defence or national security uses;
• Scientific research and development prior to placing on the market;
• Purely personal, non-professional use;
• Models released as open source - unless they are high-risk, prohibited, subject to transparency obligations, or GPAI models with systemic risk.

Module 2 · ~30 min

Prohibited practices and risk classification

The 4 risk levels

The entire mechanics of the regulation rest on classifying the use case (not the technology):

1. Unacceptable risk → prohibited practice (Art. 5);
2. High risk → strict requirements and conformity assessment (Chapter III, Annexes I & III);
3. Transparency risk → disclosure obligation (Art. 50);
4. Minimal risk → no specific obligation, voluntary codes of conduct.

Prohibited practices (Art. 5) - applicable since February 2025

• Subliminal or manipulative techniques that materially distort behaviour and cause significant harm;
• Exploitation of vulnerabilities (age, disability, social or economic situation);
• Social scoring leading to unjustified or disproportionate detrimental treatment;
• Individual predictive policing based solely on profiling or the assessment of personality traits;
• Untargeted scraping of facial images (internet, CCTV) to build facial recognition databases;
• Emotion recognition in the workplace and in education (except for medical or safety reasons);
• Biometric categorisation to infer sensitive attributes (opinions, sexual orientation, race…);
• Real-time remote biometric identification in publicly accessible spaces for law enforcement purposes - except in strictly framed cases (victims, imminent threat, serious crimes) with prior authorisation.

High risk: two entry doors

Annex I - the system is a product (or a safety component of a product) already covered by Union harmonisation legislation: medical devices, machinery, toys, lifts, aviation, automotive…

Annex III - the system falls within one of 8 sensitive areas:

1. Biometrics (remote identification, categorisation, non-prohibited emotion recognition);
2. Critical infrastructure (energy, water, traffic…);
3. Education and vocational training (admission, assessment, exam proctoring);
4. Employment and HR (recruitment, CV screening, promotion, termination, task allocation);
5. Essential private and public services (credit scoring, life and health insurance pricing, social benefits, emergency calls);
6. Law enforcement;
7. Migration, asylum and border control;
8. Administration of justice and democratic processes.

To apply this classification in practice - decision flowchart, closed questions and a downloadable template sheet - use the dedicated page: classifying an AI system.

The Art. 6(3) filter: an Annex III system escapes the high-risk classification if it only performs a narrow procedural task, improves the result of a prior human activity, or detects patterns without replacing human assessment - but you must document that analysis and register the system. A system that profiles natural persons always remains high-risk.

Module 3 · ~35 min

High-risk AI systems: the 7 requirements

Chapter III, Section 2 imposes seven families of requirements on high-risk systems. They fall first on the provider, who must demonstrate them before placing the system on the market:

The provider's conformity journey

1. Put in place a quality management system (Art. 17);
2. Carry out the conformity assessment (Art. 43) - self-assessment based on harmonised standards in most Annex III cases, or involvement of a notified body (notably biometrics and Annex I products);
3. Draw up the EU declaration of conformity (Art. 47) and affix the CE marking (Art. 48);
4. Register the system in the EU database (Art. 49);
5. Ensure post-market monitoring (Art. 72) and serious incident reporting (Art. 73) - no later than 15 days after becoming aware, with shorter deadlines for the most serious cases.

Module 4 · ~30 min

Operator obligations and transparency

You are a deployer? Your obligations (Art. 26)

• Use the system in accordance with the provider's instructions for use;
• Assign human oversight to people who are competent, trained and vested with the necessary authority;
• Ensure the relevance of the input data under your control;
• Monitor operation, suspend use and alert the provider and the authority in case of risk;
• Keep the automatically generated logs for at least 6 months;
• Inform workers and their representatives before deploying a high-risk system in the workplace;
• Inform the people affected by decisions made or informed by the system; individuals have a right to an explanation of individual decisions (Art. 86).

The FRIA (Art. 27)

Before the first use of an Annex III high-risk system, a fundamental rights impact assessment is required from deployers that are bodies governed by public law or private operators providing public services, as well as for credit scoring and life and health insurance pricing: processes in which the system will be used, categories of affected persons, risks of harm, oversight and redress measures. The FRIA complements the GDPR's DPIA; it does not replace it.

Transparency for everyone (Art. 50)

Module 5 · ~20 min

General-purpose AI models (GPAI)

Model ≠ system

A general-purpose AI model (GPT, Claude, Llama, Mistral…) displays significant generality and can be integrated into a variety of downstream systems. Chapter V applies a dedicated regime to it, applicable since 2 August 2025. The system built on that model (your chatbot, your business copilot) remains subject to the risk classification covered in modules 2 to 4.

Obligations for all GPAI providers (Art. 53)

• Technical documentation of the model (training, testing, evaluations);
• Information and documentation for downstream providers that integrate the model;
• A policy to comply with EU copyright law (including the text and data mining opt-out);
• A sufficiently detailed summary of the training content, using the template published by the AI Office.

Open-source models (published weights and architecture) are exempt from the documentation duties - but not from the copyright policy or the training summary, and never if they carry systemic risk.

Systemic risk (Art. 51 and 55)

A GPAI model is presumed to carry systemic risk when its cumulative training compute exceeds 10²⁵ FLOPs, or upon designation by the Commission. Additional duties then apply: standardised model evaluations, adversarial testing (red teaming), assessment and mitigation of systemic risks, serious incident reporting to the AI Office, reinforced cybersecurity. The GPAI code of practice published in 2025 offers a presumption of conformity while harmonised standards are being developed.

Module 6 · ~25 min

Governance, penalties and the wider regulatory landscape

Who oversees what?

• AI Office (European Commission): supervises GPAI models, develops codes of practice and guidelines;
• European AI Board: coordinates the Member States;
• National authorities: market surveillance and notifying authorities in each Member State - in France, a coordinated multi-authority scheme is taking shape (CNIL, DGCCRF, Arcom… depending on the use case);
• Regulatory sandboxes (Art. 57): at least one per Member State to test innovation under supervision, by August 2026.

And internally: who does what?

External governance has its internal mirror: executive sponsor, AI governance committee, AI Act lead, DPO/legal, CISO, Data & AI team, business system owners, procurement, HR and internal audit. The missions, required skills and cadence of each body are detailed in the target organisation of the implementation roadmap, and the self-assessment recommends the configuration suited to your size and maturity.

Penalties (Art. 99)

The amount applied is the higher of the two (the lower for SMEs and start-ups). Add product recalls, market withdrawals and reputational damage on top.

The AI Act does not live alone