This course contains the use of artificial intelligence.

The EU AI Act is the most consequential AI regulation in the world, and 2026 is the year it stops being theoretical for your organisation. Prohibited practices are already enforceable. General-purpose AI obligations have been live since August 2025. The May 2026 Digital Omnibus pushed the high-risk obligations to 2 December 2027 — which sounds like a long runway until you realise that conformity assessments, technical documentation, Annex IV files, Fundamental Rights Impact Assessments, and provider-deployer evidence packs all have to be built well before the deadline.

This course is the practitioner toolkit. Not legal scholarship, not exam prep — the actual workbook you need to do AI Act compliance on Monday morning. We cover every Title of the Regulation at practitioner depth, from Article 3 definitions through Article 99 penalties and the Digital Omnibus revisions. You will learn how to classify any AI system against Article 6 and Annex III, how to build the Annex IV technical file, how to scope and run a Fundamental Rights Impact Assessment, and how to plan an 18-month roadmap your board will sign off.

Anchored in one realistic European company. Every concept, every example, every assignment lands inside Lumora HR — a Berlin-headquartered recruitment-tech firm that is simultaneously a provider of a high-risk shortlisting system, a deployer of internal AI tools, and a downstream user of a general-purpose AI model. By the end of Section 7 you will have walked Lumora from a customer evidence-request crisis to a board-ready compliance roadmap. That single narrative spine is what makes the lessons stick.

What you'll be able to do by the end: classify any AI system against Article 6, Annex I, Annex III, and the Article 6(3) exemption test; build the Annex IV technical file, Article 13 instructions for use, and the Article 26 deployer evidence pack; scope and run a Fundamental Rights Impact Assessment under Article 27; map an 18-month compliance roadmap; decode the GPAI Code of Practice; brief your board on penalty exposure across all three Article 99 tiers.

Built for: compliance officers and AI governance leads; data protection officers extending into AI risk; internal auditors and risk managers; GRC consultants advising European clients.

Requirements: working familiarity with GDPR (you should know what a DPIA is); basic management-system literacy (ISO 27001 helpful, not required); no technical ML/AI background needed — this is a compliance course.

By the end of this course, you will not be the person in the meeting who says "I think we need to look into the AI Act." You will be the person with the inventory, the classification, the technical file, the FRIA, and the roadmap on the table.