Compliance: the EU AI Act
This course treats the EU AI Act as product-safety regulation aimed at software. The Act classifies an AI system by its intended purpose and assigns obligations by the role you play around it. The lessons cover the four risk tiers, the Annex III and safety-component routes to high-risk, and the provider, deployer, importer and distributor roles. They also cover GPAI model obligations and systemic risk, high-risk duties as Rails engineering work mapped to ISO 42001, transparency duties, conformity assessment, enforcement, and how the Act and GDPR apply to one system.
What you'll learn
- ✓How the AI Act sorts systems into unacceptable, high-risk, transparency and minimal-risk tiers
- ✓The Annex III use cases and the safety-component route that make a system high-risk
- ✓The provider and deployer roles, and the conditions that turn a deployer into a provider
- ✓Obligations for general-purpose AI model providers and the systemic-risk tier
- ✓High-risk obligations built as Rails engineering work and mapped onto an ISO 42001 AIMS
- ✓Transparency duties, conformity assessment, CE marking, enforcement and how GDPR applies alongside the Act
The AI Act is product safety, not data protection
The senior courses "Compliance: GDPR deep dive", "Compliance: LGPD deep dive" and "Compliance: HIPAA deep dive" regulate the same thing from different angles. Each targets a category of data (personal data, health data) and, for HIPAA, a category of entity. The EU AI Act does neither. It's closer…
Read the full lesson free →Curriculum
7 lessonsThe AI Act is product safety, not data protection
Why the AI Act works like product-safety law, classifying systems by purpose and role instead of by data.
High-risk: Annex III and the safety-component route
What makes a system high-risk through Annex III use cases or the safety-component route, and what stays minimal-risk.
Roles, and the deployer-becomes-provider trap
The provider, deployer, importer and distributor roles, and the conditions under which a deployer becomes a provider.
GPAI obligations and systemic risk
Obligations for general-purpose AI model providers, the systemic-risk tier, and how they reach teams building on models.
High-risk obligations as engineering work
The high-risk provider obligations as buildable Rails engineering work, mapped onto ISO 42001 AIMS artifacts.
Transparency, conformity, and enforcement
Transparency duties for chatbots and synthetic content, plus conformity assessment, CE marking, the EU database and enforcement.
Putting it together: tier and role in a Rails app
How tier and role combine, why GDPR and the AI Act both apply, and a checklist for new features.