Week 18 self-check | AI GRCA Practice Lab

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

Which is a provider obligation for a high-risk system, distinct from a deployer obligation?

Providing deployer-specific input dataUsing the system per instructionsEstablishing a risk management system and technical documentation before market placementMonitoring within the deployer's own organisation

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

Why do GPAI providers face obligations around a 'copyright policy'?

GPAI training often involves large volumes of data, raising copyright considerations the Act requires providers to address through policyOnly applies to models trained exclusively on public domain contentCopyright policy obligations only apply to deployers, not providersCopyright is entirely unrelated to GPAI models

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

Why does 'regulatory evidence preservation' matter even years after a high-risk system was first placed on the market?

Evidence can always be safely discarded after conformity assessment passesRegulators or courts may need to review historical evidence well after initial deployment, particularly following an incident or complaintEvidence preservation obligations only apply during the first month of deploymentThis obligation applies only to prohibited practices

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

Under the updated timeline enacted via the EU's 'Digital Omnibus' in 2026, when do Annex III high-risk use case obligations generally apply?

2 August 2026 as originally planned, unchanged2 December 20272 August 2028There is no defined date

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

Why does timely 'serious incident reporting' matter beyond simply satisfying a legal box-ticking requirement?

Prompt reporting enables faster investigation, containment and potentially prevents recurrence or wider harmIncident reporting timelines were removed by the 2026 delaySerious incidents only need to be reported after a full year has passedTiming has no real consequence

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

Which best reflects the relationship between 'quality management system' (QMS) obligations and technical documentation?

They are unrelated requirementsA QMS provides the organisational process discipline that supports consistently producing and maintaining accurate technical documentation and compliance evidenceTechnical documentation replaces the need for a QMS entirelyQMS obligations only apply to GPAI providers

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

Why does the Act distinguish 'training data', 'validation data' and 'testing data' as separate governance concerns?

Testing data requirements were removed by the 2026 delayThe distinction is purely academic with no governance relevanceEach serves a different role in building and verifying a model, so data-quality and representativeness obligations need to be considered for each separatelyOnly training data is ever relevant to compliance

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

What does the Act's 'cybersecurity' obligation for high-risk systems primarily address?

Cybersecurity obligations apply only to GPAI models, not high-risk systemsCybersecurity is addressed solely by a separate, unrelated regulation with no AI Act linkPhysical building security onlyProtecting the AI system against attempts to exploit vulnerabilities that could compromise its behaviour or data

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

What does 'data governance' cover in the EU AI Act's high-risk obligations?

Marketing approval of the dataset nameOnly applies to GPAI models, not high-risk systemsOnly where the servers are physically locatedPractices for training, validation and testing data, including relevance, representativeness and quality