AI Governance, Risk and EU AI Act Compliance by Design

About this course

How to make AI systems lawful, accountable and auditable by design. Learners map the EU AI Act (as amended by the 2026 AI Omnibus), GDPR and sector rules onto concrete architecture, controls and evidence; build an AI management system aligned with ISO/IEC 42001, ISO/IEC 23894 and the NIST AI RMF; and design the documentation, monitoring, incident and procurement processes that keep an AI portfolio compliant while the rules keep changing. Every date is taught as of the session and checked against the Official Journal.

For: architect, tech leader, ml practitioner, business professional.

Learning outcomes

On successful completion you will be able to:

1. 1Explain the structure and timeline of the EU AI Act as amended in 2026, covering risk categories, prohibited practices, high-risk and general-purpose AI obligations, transparency duties and AI literacy, and how it interacts with GDPR and sector law.
2. 2Classify AI systems and value-chain actors (provider, deployer, importer, distributor) under the AI Act and determine which obligations apply and from which date.
3. 3Design an AI management system and an AI risk-management process aligned with ISO/IEC 42001, ISO/IEC 23894 and the NIST AI RMF.
4. 4Evaluate data, model and system controls for fairness, transparency, robustness and human oversight, and specify the evidence each control must produce.
5. 5Produce compliance-by-design artefacts, including DPIA and fundamental-rights impact inputs, technical documentation, model cards, logging specifications and post-market monitoring plans.
6. 6Advise leadership on AI risk appetite, third-party AI procurement and AI incident response, taking responsibility for decisions made under regulatory uncertainty.
7. 7Establish a process that tracks regulatory change (amendments, guidelines, harmonised standards) and keeps the AI inventory and governance artefacts current.

Modules and lessons

1. Week 1The regulatory landscape⌄

   • The EU AI Act: structure, actors and timeline
   • Prohibited practices, transparency duties and AI literacy
2. Week 2Classifying systems and obligations⌄

   • High-risk AI systems: classification and obligations
   • General-purpose AI models and the value chain
3. Week 3Management systems and risk⌄

   • AI management systems with ISO/IEC 42001
   • AI risk management: ISO/IEC 23894 and the NIST AI RMFlab
4. Week 4Data protection and fairness⌄

   • GDPR for AI systemscase study
   • Fairness, bias and fundamental-rights impactlab
5. Week 5Evidence and documentation⌄

   • Technical documentation, model cards and logging
   • Assurance: evaluation, red teaming and conformity
6. Week 6Operating AI governance⌄

   • Post-market monitoring, incidents and third-party AI
   • The AI governance operating model and regulatory change

Assessment

• Quiz (15%)

  Six weekly quizzes drawn from the lesson quiz banks; best five count.

• Case analysis (25%)

  Classification and control analysis of a real regulator decision or a provided AI system, separating what the record says from the learner's assessment.

• Project (40%)

  Compliance-by-design pack for a provided high-risk AI system - AIMS scope, risk register, technical documentation outline, DPIA, post-market monitoring plan and a regulatory change-tracking process.

• Viva (20%)

  Twenty-minute AI risk briefing to a mock board (mentors acting as chair, CRO and general counsel), followed by questions.

Pass mark 60%. Grades: Distinction, Merit, Pass.