Which of the following are special categories of data under Art. 9? (Select all that apply.)

Biometric data used to uniquely identify a person.

What is the correct order of the four-step Art. 22 test?

Solely automated? Significant effect? Exception available? Safeguards applied?

Significant effect? Solely automated? Safeguards applied? Exception available?

Exception available? Safeguards applied? Solely automated? Significant effect?

Safeguards applied? Significant effect? Exception available? Solely automated?

What is the honest limitation of mnemonics for this exam?

They aid recall, not application.

The lists they encode change often.

The IAPP discourages their use.

They suit the GDPR but not the Act.

In what order does a provider bring a high-risk system to market under the EU AI Act?

Declare, assess, mark, register.

Assess, mark, register, declare.

Register, assess, declare, mark.

Which of these organisations owes a fundamental rights impact assessment under Art. 27 before first use?

A private bank using a high-risk credit-scoring model.

A private retailer using a high-risk CV-screening tool.

A public water utility using a high-risk safety component.

The company that built and sells the credit-scoring model.

How does the EU AI Act divide human oversight of a high-risk system between provider and deployer?

Provider designs it in; deployer assigns the people.

Deployer designs it in; provider assigns the people.

Provider does both before placing on the market.

Deployer does both after first use.

A deployer discovers a serious incident involving a high-risk AI system. Whom must it inform first?

The market surveillance authority.

Which Art. 50 transparency duty falls on the deployer rather than the provider?

Telling users they are chatting with AI.

Marking synthetic content as AI-made.

A free and open-source general-purpose AI model without systemic risk is exempt from which Art. 53 duties?

Technical documentation and downstream information.

Copyright policy and training-content summary.

Under Art. 9(5), which comes first when a provider treats a risk it has identified?

Eliminate or reduce it through design.

Add mitigation and control measures.

Inform and train the deployers.

Accept it with documented sign-off.

Under the Three Lines Model, who owns an AI system’s risk day to day?

The team that builds and runs it.

The risk and compliance function.

A company wants to reuse customer support transcripts to train a model. Which is NOT a factor in the Art. 6(4) compatibility test?

The commercial value of the new purpose.

The link between the two purposes.

The nature of the personal data.

The safeguards, such as pseudonymisation.

Before importing a high-risk system, which of these is the importer NOT required to verify?

That it has repeated the conformity assessment.

That the provider carried out the conformity assessment.

That the technical documentation exists.

That an authorised representative is appointed.

AIGP mnemonics for the lists you must recall

Domain I — Foundations and governance

What artificial intelligence (AI) is, why it is hard to govern, the principles every framework shares, and who inside an organisation owns the risk.

What makes something an AI system

Organisation for Economic Co-Operation and Development (OECD) Recommendation on AI (2019, revised 2024) · European Union Artificial Intelligence Act (EU AI Act), Regulation (EU) 2024/1689, Art. 3(1)

Who: Anyone deciding whether a law applies
When: Scoping — the first question about any system

A machine that infers

Machine-based: software, hardware or both
Varying autonomy: operates with some independence from human involvement
May adapt after deployment: adaptiveness is possible, not required
Explicit or implicit objectives: the goal need not be stated to the system
Infers from input: the defining element — it derives how to produce outputs rather than following fixed rules
Generates outputs: predictions, content, recommendations or decisions
Influences environments: physical or virtual

Why it sticks: The two-word device holds the one element that separates AI from ordinary software. Rule-based automation does not infer, which is why robotic process automation usually falls outside the definition.

Why AI needs its own governance

International Association of Privacy Professionals (IAPP) AIGP Body of Knowledge v2.1, performance indicator I.A.3

Who: The organisation making the case for governance
When: Before a programme exists — the justification for one

Crafty Owls Always Spot Hidden Dormice Promptly

Complexity: too many interacting parts for any one person to hold
Opacity: the reasoning behind an output can be hard or impossible to see
Autonomy: acts with limited human involvement
Speed and scale: one error repeats across millions of decisions before anyone notices
Harm or misuse potential: including uses nobody designed for
Data dependency: inherits every flaw in what it was trained on
Probabilistic outputs: the same input can give a different answer — unlike deterministic software

Why it sticks: Seven owls for seven traits. When a question asks why existing information technology (IT) controls are not enough, the answer is one of these — usually opacity or probabilistic output. Pair each with its control: opacity → explainability; data dependency → data governance; autonomy → human oversight; speed and scale → monitoring and a kill switch.

The principles of responsible AI

IAPP AIGP Body of Knowledge v2.1, performance indicator I.A.4

Who: Every organisation building or using AI
When: Set in policy first; applied at every stage after

Friendly Sheep Prefer Tall Apple Hedges

Fairness: no unjustified disparate outcomes
Safety and reliability: works as intended and fails safely
Privacy and security: protects data and resists attack
Transparency and explainability: people can see that AI is used and understand why it decided
Accountability: a named person answers for it
Human-centricity: humans stay in control and benefit

Why it sticks: The Body of Knowledge (BOK)’s own list. OECD, National Institute of Standards and Technology (NIST) and International Organization for Standardization (ISO) word these differently, but the six ideas recur in every framework — learn this set and the others become translations of it.

The six AI use-case types

IAPP AIGP Body of Knowledge v2.1, performance indicator I.A.1

Who: Whoever is defining the use case
When: Planning — naming what the system is for

Recognise it · Detect it · Forecast it · Personalise it · Optimise it · Talk to it

Recognition: identify what something is — a face, a product in a photo
Detection: find that something is present or anomalous — fraud, threats, defects
Forecasting: predict a future value — demand, churn, prices
Personalisation: tailor to a known individual — recommendations
Optimisation: find the best option under constraints — routing, scheduling
Interaction: converse with people — chatbots, assistants

Why it sticks: The near-miss pairs are where the marks go: recognition names the thing, detection only flags that it is there; forecasting predicts for everyone, personalisation for one person.

Who can be harmed

NIST AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023), §1.1 and Figure 1

Who: The people and things on the receiving end
When: Impact assessment — mapping who could be hurt

People, Organisations, Ecosystems — and people come in three sizes

People — individual: one identifiable person worse off
People — group or community: a rate difference across a class of people
People — societal: damage to the shared environment: trust, democracy, access
Organisations: reputation, operations, fines, security
Ecosystems: interconnected systems, supply chains, the natural environment

Why it sticks: This answers WHO was harmed. It is a different question from where bias came from — which is the list below, from a different NIST publication.

The three sources of bias

NIST Special Publication 1270, Towards a Standard for Identifying and Managing Bias in AI (March 2022)

Who: Whoever is diagnosing a biased outcome
When: Data review, testing, and after an incident

Society · Statistics · Self

Systemic: historical and institutional bias already present in society and in the data
Statistical / computational: sampling, measurement and algorithmic artefacts
Human-cognitive: how people design, read and rely on output — including automation bias

Why it sticks: Each source takes a different fix: reframe the problem, repair the data, or redesign the human process. Classify first, then choose the control.

The three lines

Institute of Internal Auditors, Three Lines Model (July 2020)

Who: Inside one organisation — who owns, who oversees, who assures
When: Standing structure, set up with the governance programme

Own it · Oversee it · Assure it

1 First line — own it: the business and product teams that build and run the AI, and own its risk day to day
2 Second line — oversee it: risk, compliance, privacy and legal: set policy, challenge, monitor
3 Third line — assure it: internal audit: independent assurance to the board that the first two work

Why it sticks: The trap is putting risk ownership in the second line. Compliance oversees the risk; the team that builds or runs the system owns it. Audit must stay independent of both.

Domain II — Privacy law and the GDPR

Where modern privacy law comes from, then the General Data Protection Regulation — first as a sequence for one AI processing activity, then list by list in article order. Under the GDPR the controller owes almost everything; the processor’s duties are named where they differ.

The Fair Information Practices

OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980, revised 2013), Part Two, paras 7–14

Who: The data controller (the OECD’s word too)
When: The whole life of the data

Cats Don’t Purr Until Someone Offers Idle Affection

7 Collection limitation: lawful, fair, with knowledge or consent where appropriate
8 Data quality: relevant, accurate, complete, up to date
9 Purpose specification: purposes stated no later than collection
10 Use limitation: no use beyond those purposes without consent or legal authority
11 Security safeguards: reasonable protection against loss and misuse
12 Openness: policies and practices are transparent
13 Individual participation: access and challenge
14 Accountability: the controller answers for all of the above

Why it sticks: First drafted in a 1973 United States (US) Department of Health, Education, and Welfare report, codified by the OECD in 1980. If a question asks which family of principles underlies privacy law across jurisdictions, this is it.

One AI processing activity, start to finish

General Data Protection Regulation, Regulation (EU) 2016/679 — the articles in the order they bite

Who: The controller throughout, except where marked
When: From the idea to the incident

Purpose, Basis, Special, Assess, Design, Contract, Tell, Record, Secure, Answer, Breach, Transfer

5(1)(b), 6(4) Purpose: Controller fix a specified, explicit purpose — and test any reuse for compatibility
6(1) Basis: Controller choose one lawful basis before processing starts
9 Special: Controller health, biometric and the rest need an Art. 9(2) condition as well
35, 36 Assess: Controller a data protection impact assessment before high-risk processing — consult the authority if high risk remains
25 Design: Controller data protection by design and by default, built in from the start
28 Contract: Controller + processor a processor contract with every vendor processing on your behalf
13–14 Tell: Controller privacy information at collection, including the logic of automated decisions
30 Record: Controller + processor records of processing activities
32 Secure: Controller + processor appropriate security measures
12(3), 15–22 Answer: Controller data subject requests within one month, extendable by two
33–34 Breach: Controller (processor → controller) the authority within 72 hours; people too if the risk is high; processor tells the controller
44–49 Transfer: Controller + processor a Chapter V mechanism before data leaves the European Economic Area

Why it sticks: The order is the answer to most "what should the organisation do first" questions: purpose and basis before anything else, the impact assessment before processing, the contract before the vendor touches data. Every list below is one of these steps in close-up.

The seven principles

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 5

Who: Controller — and it must be able to prove compliance
When: Every stage of processing

Little Penguins Dance Around Seven Icy Arches

5(1)(a) Lawfulness, fairness, transparency: a basis, no unjustified harm, people understand
5(1)(b) Purpose limitation: specified, explicit, legitimate; no incompatible reuse
5(1)(c) Data minimisation: adequate, relevant, limited to what is necessary
5(1)(d) Accuracy: including inferences and outputs about a person
5(1)(e) Storage limitation: identifiable no longer than necessary
5(1)(f) Integrity and confidentiality: appropriate security
5(2) Accountability: comply AND be able to demonstrate it

Why it sticks: Six sit in Art. 5(1); accountability stands alone in Art. 5(2) because it governs the other six. "How many principles" appears as a distractor — the answer is seven.

The six lawful bases

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 6(1)

Who: Controller — the processor relies on the controller’s basis
When: Chosen and documented before processing starts

Cool Cats Love Vanilla Pop Lollies

6(1)(a) Consent: freely given, specific, informed, unambiguous, withdrawable
6(1)(b) Contract: necessary for a contract or pre-contract steps
6(1)(c) Legal obligation: required by EU or member-state law
6(1)(d) Vital interests: life or death
6(1)(e) Public task: official authority or public interest
6(1)(f) Legitimate interests: the AI workhorse — needs the three-part test below

Why it sticks: In article order, (a) to (f). The basis cannot be swapped later to rescue processing — switching to legitimate interests after consent is withdrawn is the classic wrong answer.

The legitimate interests test

GDPR Art. 6(1)(f), as applied in European Data Protection Board (EDPB) Guidelines 1/2024 on processing based on Article 6(1)(f)

Who: Controller
When: Before relying on legitimate interests — documented as an assessment

Purpose, Necessity, Balance

1 Purpose: is there a legitimate interest — lawful, clearly articulated, real and present?
2 Necessity: is the processing necessary for it, or would less intrusive means do?
3 Balance: do the person’s interests, rights and reasonable expectations override it?

Why it sticks: All three must pass, in this order. For AI training on scraped or reused data, the balance usually turns on reasonable expectations and on safeguards such as opt-outs and minimisation.

Is the new purpose compatible?

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 6(4)

Who: Controller
When: Before reusing data for a new purpose — typically, reusing operational data to train a model

Link, Context, Nature, Consequences, Safeguards

6(4)(a) Link: between the original purpose and the new one
6(4)(b) Context: how the data was collected, and the relationship with the people
6(4)(c) Nature: especially special-category or criminal-offence data
6(4)(d) Consequences: the possible consequences of the new processing for the people
6(4)(e) Safeguards: such as encryption or pseudonymisation

Why it sticks: If the new purpose is compatible, no new lawful basis is needed. If it is not, it needs its own basis — usually consent or a new legitimate interests test.

Children’s consent age

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 8(1)

Who: Controllers offering online services directly to children
When: At sign-up, where consent is the basis

16 by default, 13 at the floor

Default: a child can consent to online services at 16
Member-state option: may lower it, but not below 13
Contrast — US: the Children’s Online Privacy Protection Act of 1998 uses 13 flat

Why it sticks: Because member states pick within the range, there is no single EU age — so "one global consent age" is wrong twice over.

The nine special categories

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 9(1)

Who: Controller
When: At design — spotting them is what triggers the extra condition

Three beliefs, three bodily, three identity

Beliefs: political opinions · religious or philosophical beliefs · trade union membership
Bodily: genetic · biometric (only when used to uniquely identify) · health
Identity: racial or ethnic origin · sex life · sexual orientation

Why it sticks: A 3×3 grid beats a nine-letter acronym. Processing needs BOTH an Art. 6 basis and an Art. 9(2) condition. Criminal-offence data is not on the list — it has its own regime in Art. 10.

What to tell people at collection

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 13 (Art. 14 where data comes from elsewhere)

Who: Controller
When: At the time of collection (Art. 14: within a month at the latest)

Who, Why, Who else, Where, How long, Your rights — and the Logic

13(1)(a)–(b) Who: identity and contact details, and the data protection officer’s
13(1)(c)–(d) Why: purposes and lawful basis — and the legitimate interest, if that is the basis
13(1)(e) Who else: recipients or categories of recipients
13(1)(f) Where: any transfer outside the European Economic Area, and the safeguard
13(2)(a) How long: the retention period, or how it is set
13(2)(b)–(d) Your rights: access and the rest, withdrawing consent, complaining to the authority
13(2)(e) Required?: whether providing the data is required, and what happens if not
13(2)(f) The logic: automated decisions: meaningful information about the logic, significance and consequences

Why it sticks: The last item is the AI one. It asks for meaningful information about the logic, not the source code or the model weights.

The data subject rights

General Data Protection Regulation, Regulation (EU) 2016/679, Arts. 13–22

Who: Owed by the controller; the processor must help (Art. 28(3)(e))
When: On request — answered within one month, extendable by two (Art. 12(3))

In All Reasonable Events, Rights Need Protecting Or Appeal

13–14 Information: what is collected and why — directly (13) or indirectly (14)
15 Access: a copy of your data and how it is used
16 Rectification: correct inaccurate data
17 Erasure: the "right to be forgotten", in defined cases
18 Restriction: freeze processing while a dispute is resolved
19 Notification: recipients are told of rectification, erasure or restriction
20 Portability: take your data to another controller
21 Objection: object to processing, absolutely so for direct marketing
22 Automated decisions: not to be subject to solely automated significant decisions

Why it sticks: Nine words, nine rights, and they run in article order from 13 to 22 — so the device also tells you where each one lives.

The four-step solely-automated decision test

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 22

Who: Controller making the decision
When: At design — whether a human stays meaningfully in the loop is a design choice

Solely? Significant? Exception? Safeguards!

22(1) Solely automated?: meaningful human involvement defeats it — rubber stamps do not
22(1) Legal or similarly significant effect?: credit, employment, insurance, benefits
22(2)(a)–(c) Which exception?: contract · law · explicit consent
22(3) Safeguards: human intervention · express a point of view · contest the decision

Why it sticks: Sub-mnemonic for the safeguards: "I Protest, Contest" — Intervention, Point of view, Contest. With special-category data only explicit consent or substantial public interest will do (22(4)).

What a processor contract must say

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 28(3)

Who: Controller and processor, in a contract between them
When: Signed before the vendor processes any data

One I, one C, and six S’s

28(3)(a) Instructions: process only on documented instructions
28(3)(b) Confidentiality: staff bound to confidentiality
28(3)(c) Security: the Art. 32 measures
28(3)(d) Sub-processors: only with authorisation, on the same terms
28(3)(e) Subject rights: help the controller answer requests
28(3)(f) Support: help with security, breaches, impact assessments and consultation (Arts. 32–36)
28(3)(g) Sunset: delete or return the data at the end
28(3)(h) Scrutiny: provide information and allow audits

Why it sticks: Eight clauses in order (a) to (h). A vendor that uses your data to train its own model is acting beyond instructions — for that use it becomes a controller in its own right.

Records of processing

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 30(1)

Who: Controller (a processor keeps a shorter record under 30(2))
When: Kept up to date for as long as the processing runs

Who, Why, Whose, To whom, Abroad, How long, How safe

30(1)(a) Who: controller, joint controller, representative, data protection officer
30(1)(b) Why: the purposes
30(1)(c) Whose: categories of people and of personal data
30(1)(d) To whom: categories of recipients
30(1)(e) Abroad: transfers to third countries, and their safeguards
30(1)(f) How long: envisaged time limits for erasure
30(1)(g) How safe: a general description of the security measures

Why it sticks: The under-250-employees exemption in 30(5) falls away if the processing is not occasional, is likely to be risky, or includes special-category or criminal data — which most AI processing does.

Security of processing

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 32(1)

Who: Controller and processor, each
When: Built in before go-live, then tested regularly

Hide it, Hold it, Heal it, Hammer it

32(1)(a) Hide it: pseudonymisation and encryption
32(1)(b) Hold it: ongoing confidentiality, integrity, availability and resilience
32(1)(c) Heal it: restore availability and access promptly after an incident
32(1)(d) Hammer it: regularly test and evaluate the measures

Breach notification

General Data Protection Regulation, Regulation (EU) 2016/679, Arts. 33–34

Who: Controller notifies; the processor tells the controller
When: After a personal data breach — the clock runs from awareness

72 to the regulator, straight away to the person — but only if it hurts

33(1) To the supervisory authority: Controller within 72 hours of becoming aware, unless unlikely to result in risk
33(2) Processor to controller: Processor without undue delay
34(1) To affected individuals: Controller without undue delay, but only where the risk is high

Why it sticks: The threshold rises as you go outward: any risk for the regulator, high risk for the individual. Record every breach internally either way (33(5)).

When a data protection impact assessment is mandatory

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 35(3)

Who: Controller (the processor helps)
When: Before the processing starts

Profile · Sensitive · Surveil

35(3)(a) Profile: systematic, extensive evaluation with legal or similarly significant effects
35(3)(b) Sensitive: large-scale special-category or criminal-offence data
35(3)(c) Surveil: systematic monitoring of a publicly accessible area on a large scale

Why it sticks: The general trigger is "likely to result in a high risk" (Art. 35(1)); these three are the cases the Regulation names outright. A deployer of a high-risk AI system uses the provider’s instructions to do this one (EU AI Act Art. 26(9)).

What a data protection impact assessment contains

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 35(7)

Who: Controller, seeking the data protection officer’s advice (35(2))
When: Before processing; revisited when the risk changes (35(11))

Don’t Neglect Risk Management

35(7)(a) Description: the processing and its purposes
35(7)(b) Necessity: necessity and proportionality
35(7)(c) Risks: to the rights and freedoms of individuals
35(7)(d) Measures: to address those risks

Why it sticks: If high risk remains after the measures, Art. 36 requires prior consultation with the supervisory authority before processing starts.

When a data protection officer is mandatory

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 37(1)

Who: Controller and processor alike
When: A standing appointment, once any trigger applies

Public · Watching · Sensitive

37(1)(a) Public: a public authority or body (courts acting judicially excepted)
37(1)(b) Watching: core activities involve regular and systematic monitoring on a large scale
37(1)(c) Sensitive: core activities involve large-scale special-category or criminal data

Why it sticks: Deliberately rhymes with the impact-assessment triggers above: two of the three are the same idea, so learn them as a pair.

International transfers — order of preference

General Data Protection Regulation, Regulation (EU) 2016/679, Chapter V, Arts. 44–49

Who: The exporting controller or processor
When: Before any personal data leaves the European Economic Area

Always Seek Derogations last

45 Adequacy: the simplest route where a Commission decision exists
46–47 Appropriate safeguards: standard contractual clauses, binding corporate rules, codes, certifications — plus a transfer risk assessment
49 Derogations: narrow, occasional, non-repetitive — genuinely a last resort

Why it sticks: Standard contractual clauses are adopted by the Commission; binding corporate rules are approved by the competent supervisory authority.

Which fine tier?

General Data Protection Regulation, Regulation (EU) 2016/679, Art. 83(4)–(5)

Who: Imposed by the supervisory authority on the controller or processor
When: After an infringement

4 for the Fundamentals, 2 for the To-dos

83(5) €20M or 4%: principles (5, 6, 7, 9), data subject rights (12–22), transfers (44–49)
83(4) €10M or 2%: process duties — by design, records, security, impact assessments, processors, officers

Why it sticks: Breach a principle or a right: the higher tier. Fail a process: the lower one. Always whichever is higher, measured against worldwide annual turnover.

Domain II — Other law that already applies to AI

No AI statute needed: sectoral privacy, anti-discrimination and consumer protection law bite in full.

US sectoral privacy — which sector holds the data

US federal statutes, by year enacted

Who: Whoever holds that sector’s data — each law names its own covered entities
When: Scoping a US scenario — the first question

Credit, School, Health, Kids, Banks — 1970 to 1999

1970 Fair Credit Reporting Act: consumer reports and background screening
1974 Family Educational Rights and Privacy Act: education records at funded institutions
1996 Health Insurance Portability and Accountability Act: protected health information at covered entities and business associates
1998 Children’s Online Privacy Protection Act: online data from children under 13
1999 Gramm-Leach-Bliley Act: nonpublic personal information at financial institutions

Why it sticks: In date order. The US has no general privacy statute, so the first question in any US scenario is which sector the data sits in — each of these reaches exactly one.

US anti-discrimination statutes that reach AI

US federal statutes, by year enacted

Who: The employer, lender or landlord using the tool — not only the vendor
When: Whenever the tool is used to decide

Jobs, Age, Homes, Credit, Disability — 1964 to 1990

1964 Title VII, Civil Rights Act: employment — race, colour, religion, sex, national origin
1967 Age Discrimination in Employment Act: employment — workers aged 40 and over
1968 Fair Housing Act: housing sales, rentals and lending
1974 Equal Credit Opportunity Act: credit, including specific adverse-action reasons
1990 Americans with Disabilities Act: disability, including reasonable accommodation

Why it sticks: Disparate impact is the theory that catches AI: a neutral tool with an unjustified adverse effect on a protected group is unlawful with no intent at all.

Unfair versus deceptive

Federal Trade Commission Act of 1914, §5 (15 U.S.C. §45); unfairness test at §45(n)

Who: Any business, enforced by the Federal Trade Commission
When: Marketing claims (deception) and practices that cause harm (unfairness)

Unfair is three I’s; deceptive is three M’s

§45(n) Unfair — Injury: the injury to consumers is substantial
§45(n) Unfair — Inescapable: consumers could not reasonably have avoided it
§45(n) Unfair — Imbalanced: it is not outweighed by benefits to consumers or competition
Deceptive — Message: a representation, omission or practice
Deceptive — Misleads: likely to mislead a consumer acting reasonably in the circumstances
Deceptive — Matters: material — it would affect the consumer’s decision

Why it sticks: Pick the prong from what the stem gives you: a false statement is deception; a harm is unfairness. Remedy to remember: algorithmic disgorgement — delete the model built on unlawful data.

Automated hiring tools in New York City

New York City Local Law 144 of 2021 (enforced from 5 July 2023)

Who: The employer or employment agency using the tool
When: Before use, then yearly

Audit, Publish, Warn

1 Audit: an independent bias audit within the year before use
2 Publish: a summary of the audit results on the employer’s website
3 Warn: notify candidates at least 10 business days before the tool is used

Why it sticks: Independent is the operative word — a self-audit does not satisfy it. The duty sits on the employer, not the vendor that built the tool.

Domain II — The EU AI Act, in the order things happen

Regulation (EU) 2024/1689, following one high-risk system from classification to incident report. The provider builds it and proves it; importers and distributors check it on the way down the chain; the deployer assesses, uses and watches it; the provider keeps watching after sale. Every item carries its article.

When each part applies

EU AI Act, Regulation (EU) 2024/1689, Art. 113 — as enacted

Who: Everyone in scope, staged by subject
When: The calendar — which duties exist yet

Bans at 6, Big models at 12, Bulk at 24, Built-in at 36 (months)

113 Entry into force: 1 August 2024
113(a) Bans — prohibitions and AI literacy: 2 February 2025 (6 months)
113(b) Big models — general-purpose AI, governance, penalties: 2 August 2025 (12 months)
113 Bulk — most of the rest, including Annex III high-risk: 2 August 2026 (24 months)
113(c) Built-in — high-risk AI inside regulated products: 2 August 2027 (36 months)

Why it sticks: These are the enacted dates, which is what BoK v2.1 tests. The 2026 Digital Omnibus later moved Annex III high-risk to 2 December 2027 and product-embedded high-risk to 2 August 2028 — see the AI Act updates page.

The operators

EU AI Act, Regulation (EU) 2024/1689, Art. 3(3)–(8)

Who: The roles every duty below attaches to
When: Decide the role first — it decides which duties apply

Please Pay Due Attention In Distribution

3(3) Provider: Provider develops it, or has it developed, and places it on the market under its own name
25(3) Product manufacturer: Provider treated as the provider when the AI is a safety component of its own regulated product
3(4) Deployer: Deployer uses it under its own authority, other than for personal use
3(5) Authorised representative: Chain EU-based agent appointed in writing by a non-EU provider
3(6) Importer: Chain places a non-EU provider’s system on the EU market
3(7) Distributor: Chain makes it available further down the chain

Why it sticks: Art. 3(8) defines "operator" as all six together. One organisation can hold two roles at once: a bank that builds its own credit model and uses it is both provider and deployer, and owes both sets of duties.

Who owes what — the one-line map

EU AI Act, Regulation (EU) 2024/1689, Arts. 16, 22–24, 26–27, 72–73, 85–86

Who: Every role in the chain, and the person at the end of it
When: Keep beside every other list in this section

Build it, Stand in, Bring it, Pass it on, Use it — and the person on the end

16, 72, 73 Build it: Provider makes the system meet Arts. 9–15, proves it, registers it, then monitors and reports after sale
22 Stand in: Authorised representative holds the documents and answers the authorities for a non-EU provider
23 Bring it: Importer checks the provider did its job before importing
24 Pass it on: Distributor checks the marking and paperwork before making it available
26, 27 Use it: Deployer uses it as instructed, with human oversight; monitors; keeps logs; tells workers and people affected; some owe a rights assessment
26(11), 86, 85 The person on the end: Affected person is told, can ask for an explanation, can complain

Why it sticks: The favourite distractor is a real duty offered to the wrong role: the conformity assessment to the deployer, the fundamental rights impact assessment to the provider, log-keeping to the importer. Name the role before reading the options.

The eight prohibited practices

EU AI Act, Regulation (EU) 2024/1689, Art. 5(1)(a)–(h)

Who: Provider AND deployer — Art. 5 bans placing on the market, putting into service or use
When: Classification — the first test; banned since 2 February 2025

Many Vultures Scavenge Past Farms, Eating Brown Rats

5(1)(a) Manipulation: subliminal or deceptive techniques that distort behaviour and cause significant harm
5(1)(b) Vulnerabilities: exploiting age, disability or social or economic situation
5(1)(c) Social scoring: scoring people on behaviour or traits, leading to unjustified detrimental treatment
5(1)(d) Predictive policing: predicting crime from profiling or personality traits alone
5(1)(e) Facial scraping: untargeted scraping of faces from the internet or closed-circuit television (CCTV) to build databases
5(1)(f) Emotion recognition: in the workplace or education, save for medical or safety reasons
5(1)(g) Biometric categorisation: inferring race, politics, union membership, religion, sex life or orientation
5(1)(h) Real-time remote biometric identification: in public spaces for law enforcement, save narrow exceptions

Why it sticks: In article order. Because "use" is banned too, a deployer cannot shelter behind a compliant vendor. The 2026 Digital Omnibus adds two more — AI-generated non-consensual intimate imagery and child sexual abuse material — from 2 December 2026.

The four risk tiers

EU AI Act, Regulation (EU) 2024/1689, Arts. 5, 6, 50 and 95

Who: Provider classifies; the tier then sets every role’s duties
When: Classification, before design is fixed

Pyramids Have Lovely Masonry

5 Prohibited: the eight practices above — may not be sold or used
6 High-risk: Annex I products and Annex III uses — the full regime below
50 Limited — transparency: chatbots, deepfakes, synthetic content — disclosure duties only
95 Minimal: everything else — voluntary codes of conduct

Why it sticks: Descending severity. The tiers are not exclusive at the edges: a high-risk system that also chats with people owes the Art. 50 disclosure as well.

The eight Annex III high-risk areas

EU AI Act, Regulation (EU) 2024/1689, Annex III, points 1–8

Who: Provider classifies by intended purpose
When: Classification

Big Cats Eat Every Evening, Lions Munch Jackals

1 Biometrics: remote identification, categorisation, emotion recognition
2 Critical infrastructure: safety components in digital infrastructure, traffic, utilities
3 Education and vocational training: admission, assessment, proctoring
4 Employment: recruitment, promotion, termination, task allocation, monitoring
5 Essential services: public benefits, credit scoring, life and health insurance pricing, emergency triage
6 Law enforcement: risk assessment, evidence evaluation
7 Migration, asylum and border control: risk assessment, application examination
8 Justice and democratic processes: assisting judges; influencing elections

Why it sticks: Point 5 is the one to know in detail: its credit (5(b)) and insurance (5(c)) uses are what pull private deployers into the fundamental rights impact assessment. Point 2 is the one carved out of that assessment and of the right to an explanation.

The Annex III escape hatch

EU AI Act, Regulation (EU) 2024/1689, Art. 6(3)–(4)

Who: Provider
When: Classification — documented before placing on the market

Narrow, Improve, Pattern, Prep — unless it Profiles

6(3)(a) Narrow: performs a narrow procedural task
6(3)(b) Improve: improves the result of a completed human activity
6(3)(c) Pattern: detects decision patterns without replacing human assessment
6(3)(d) Prep: performs a preparatory task for an assessment
6(3) final Unless it Profiles: an Annex III system that profiles people is always high-risk

Why it sticks: A provider relying on this documents its assessment before placing the system on the market (6(4)), must still register it (49(2)), and must hand the assessment over if an authority asks.

The life of a high-risk system, start to finish

EU AI Act, Regulation (EU) 2024/1689 — the articles in the order they bite

Who: Every role, in turn
When: From design to incident

The provider builds it and proves it; the chain checks it; the deployer assesses, uses and watches; the provider keeps watching

5, 6 Classify: Provider prohibited? Annex I or III? escape hatch?
9–15, 17 Build to the requirements: Provider risk management, data, documentation, logging, instructions, oversight, accuracy — under a quality management system
43 Assess conformity: Provider internal control for most Annex III systems; a notified body for some
47, 48, 49 Declare, mark, register: Provider EU declaration of conformity, Conformité Européenne (CE) marking, EU database
23, 24 Check on the way down: Importer / distributor marking, declaration and instructions present before import or resale
27, 26(9) Assess before first use: Deployer fundamental rights impact assessment where owed; data protection impact assessment using the provider’s information
26(7), 26(8) Tell the workforce: Deployer inform workers’ representatives before using it at work; public bodies register their use
26(1), 26(2), 26(11) Use it properly: Deployer follow the instructions for use; trained people with authority to oversee; tell the people it decides about
26(5), 26(6) Watch it: Deployer monitor it; keep its logs for at least six months; report risks and serious incidents to the provider
72, 73, 20 Keep watching after sale: Provider post-market monitoring; serious incident reports to the authority; corrective action

Why it sticks: This is the order-of-operations list for the Act. "What should the deployer do first?" is nearly always the assessment before first use; "what must happen before the CE marking?" is the conformity assessment and the declaration.

The high-risk requirements

EU AI Act, Regulation (EU) 2024/1689, Chapter III, Section 2, Arts. 9–15

Who: Provider — the system itself must meet them, and Art. 16(a) makes the provider ensure it does. The deployer’s side of each is in brackets.
When: Design and build, before the conformity assessment — maintained for the system’s life

Really Dull Tasks Require Thorough Human Attention

9 Risk management system: Provider continuous and iterative across the life cycle (deployer: monitors and reports back)
10 Data and data governance: Provider training, validation and test data relevant, representative, examined for bias (deployer: its own input data, 26(4))
11 Technical documentation: Provider drawn up before market, per Annex IV, kept 10 years (18)
12 Record-keeping: Provider the system logs events automatically (deployer: keeps the logs six months, 26(6))
13 Transparency to deployers: Provider instructions for use written for the deployer (deployer: follows them, 26(1))
14 Human oversight: Provider designed so people can oversee it (deployer: assigns those people, 26(2))
15 Accuracy, robustness and cybersecurity: Provider declared levels, maintained over the life cycle

Why it sticks: Seven words, seven consecutive articles from 9 to 15. The pattern in the brackets is the exam point: the provider designs the capability, the deployer operates it.

The risk management system, step by step

EU AI Act, Regulation (EU) 2024/1689, Art. 9(2) and 9(5)

Who: Provider
When: Throughout the life cycle — before market and after it

Identify, Estimate, Learn, Act

9(2)(a) Identify: known and reasonably foreseeable risks to health, safety and fundamental rights, in intended use
9(2)(b) Estimate: estimate and evaluate those risks, including under reasonably foreseeable misuse
9(2)(c) Learn: evaluate risks emerging from post-market monitoring data
9(2)(d) Act: adopt targeted risk management measures

Why it sticks: The measures follow a hierarchy (9(5)): first eliminate or reduce the risk by design, then mitigate and control what cannot be eliminated, then give deployers information and training. Warning people is the last resort, never the first.

What human oversight must let people do

EU AI Act, Regulation (EU) 2024/1689, Art. 14(4)(a)–(e)

Who: Provider designs it in; the deployer’s assigned overseers use it (26(2))
When: Designed before market; exercised in use

Understand, Beware, Interpret, Override, Stop

14(4)(a) Understand: the system’s capacities and limitations, and monitor its operation
14(4)(b) Beware: stay aware of automation bias — over-relying on output
14(4)(c) Interpret: correctly interpret the output
14(4)(d) Override: decide not to use it, or disregard, override or reverse its output
14(4)(e) Stop: intervene, or halt it with a stop button or similar

Why it sticks: It escalates from knowing to acting: understand it, distrust it appropriately, read it, overrule it, switch it off. For remote biometric identification, two people must verify a match before anyone acts on it (14(5)).

What the instructions for use must contain

EU AI Act, Regulation (EU) 2024/1689, Art. 13(3)(a)–(f)

Who: Written by the provider, for the deployer
When: Supplied with the system, before the deployer uses it

Who made it, What it can do, What will change, Who watches, What it needs, How it logs

13(3)(a) Who made it: identity and contact details of the provider and any authorised representative
13(3)(b) What it can do: intended purpose, accuracy and robustness levels, known limits, foreseeable misuse, performance on specific groups, input data specifications
13(3)(c) What will change: changes the provider has pre-determined
13(3)(d) Who watches: the human oversight measures, including aids to interpret output
13(3)(e) What it needs: computing resources, expected lifetime, maintenance and updates
13(3)(f) How it logs: how to collect, store and interpret the logs

Why it sticks: Every deployer duty leans on this document: the deployer must follow it (26(1)), uses it to monitor (26(5)), and draws on it for the data protection impact assessment (26(9)). Not to be confused with Art. 50 transparency, which is to the public.

What a provider of a high-risk system must do

EU AI Act, Regulation (EU) 2024/1689, Art. 16(a)–(l)

Who: Provider
When: Before placing on the market, then for the system’s life

Comply, Label, Quality, Keep, Logs, Assess, Declare, Mark, Register, Correct, Prove, Accessible

16(a) Comply: ensure the system meets the Arts. 9–15 requirements
16(b) Label: name, trade name and contact address on the system, packaging or documents
16(c) Quality: a quality management system (Art. 17)
16(d) Keep: the documentation for 10 years (Art. 18)
16(e) Logs: keep the logs under its control, at least six months (Art. 19)
16(f) Assess: the conformity assessment before placing on the market (Art. 43)
16(g) Declare: the EU declaration of conformity (Art. 47)
16(h) Mark: the CE marking (Art. 48)
16(i) Register: in the EU database (Art. 49(1))
16(j) Correct: corrective action and information when it does not conform (Art. 20)
16(k) Prove: demonstrate conformity on a reasoned request from an authority
16(l) Accessible: meet EU accessibility requirements

Why it sticks: Twelve duties, (a) to (l), and the middle run f–g–h–i is the market-entry sequence in its own right: assess, declare, mark, register.

From built to on the market

EU AI Act, Regulation (EU) 2024/1689, Arts. 43, 47, 48, 49

Who: Provider
When: After build, before placing on the market or putting into service

Assess, Declare, Mark, Register — and the numbers only go up

43 Conformity assessment: internal control for Annex III points 2–8; a notified body may be needed for biometrics
47 EU declaration of conformity: the provider signs that it complies
48 CE marking: affixed to show conformity
49 Registration: Annex III systems in the EU database (point 2 nationally)

Why it sticks: The order is the article order. Registering before assessing, or marking before declaring, is the standard wrong sequence. A substantial modification later means a fresh conformity assessment.

What the supply chain checks

EU AI Act, Regulation (EU) 2024/1689, Arts. 22(3), 23(1), 24(1)

Who: Authorised representative, importer, distributor — each checking the provider
When: Before the system is imported or made available

The rep holds it, the importer checks it, the distributor looks at the label

22(3) Verify and hold: Authorised representative check the declaration, documentation and conformity assessment exist; keep them 10 years; cooperate with authorities
23(1)(a) Assessed?: Importer the provider carried out the conformity assessment
23(1)(b) Documented?: Importer the technical documentation exists
23(1)(c) Marked?: Importer CE marking, declaration of conformity and instructions for use present
23(1)(d) Represented?: Importer the provider has appointed an authorised representative
24(1) Label check: Distributor CE marking, declaration and instructions present; provider and importer labelling done

Why it sticks: Each checks and none re-does the provider’s work — an importer does not repeat the conformity assessment. If they suspect non-conformity they must not pass the system on. Put your own name on it and you become the provider (Art. 25).

What a fundamental rights impact assessment contains

EU AI Act, Regulation (EU) 2024/1689, Art. 27(1)(a)–(f)

Who: Deployer — only public bodies, private providers of public services, and users of Annex III 5(b) credit scoring and 5(c) life and health insurance pricing
When: Before first use; updated if things change (27(2)); results notified to the market surveillance authority (27(3))

Six P’s: Process, Period, People, Perils, People-in-the-loop, Plan B

27(1)(a) Process: how the deployer will use the system
27(1)(b) Period: how long and how often
27(1)(c) People: who is likely to be affected
27(1)(d) Perils: the specific risks of harm to them
27(1)(e) People-in-the-loop: the human oversight measures
27(1)(f) Plan B: what happens if the risks materialise, including complaints

Why it sticks: Never a provider duty, and not owed by an ordinary private employer using a hiring tool. Critical-infrastructure systems (Annex III point 2) are excluded. Where a data protection impact assessment already covers some of it, the rights assessment complements it rather than repeating it (27(4)).

What a deployer of a high-risk system must do

EU AI Act, Regulation (EU) 2024/1689, Art. 26

Who: Deployer
When: Before first use and throughout use

I Only Invite Monkeys, Lions, Wolves and Tigers

26(1) Instructions: use it as the instructions for use say
26(2) Oversight: assign competent, trained people with authority and support
26(4) Inputs: input data relevant and representative, where you control it
26(5) Monitor: watch it; on a risk, tell the provider and authority and suspend; on a serious incident, tell the provider first
26(6) Logs: keep automatic logs for at least six months
26(7) Workers: inform workers’ representatives before workplace use
26(11) Tell people: inform people subject to its decisions

Why it sticks: Public-body deployers must also register their use (26(8)), and every deployer uses the provider’s information for its data protection impact assessment (26(9)). Change the purpose or substantially modify it and you become the provider (Art. 25).

What the affected person gets

EU AI Act, Regulation (EU) 2024/1689, Arts. 26(11), 86 and 85

Who: The person a high-risk system decides about — owed mainly by the deployer
When: Before the decision (told), after it (explanation), any time (complaint)

Told, Explained, Heard

26(11) Told: Deployer informed that a high-risk system is used in decisions about them
86 Explained: Deployer clear, meaningful explanation of the system’s role and the main elements of a significant decision
85 Heard: Authority may complain to the market surveillance authority

Why it sticks: The explanation right covers Annex III decisions with legal or similarly significant effects, except point 2. It sits alongside the GDPR’s Art. 22 safeguards rather than replacing them.

When you become the provider

EU AI Act, Regulation (EU) 2024/1689, Art. 25(1)

Who: Deployer, importer, distributor or any third party
When: At the moment of the change — after the system is on the market

Name it, Modify it, Repurpose it

25(1)(a) Name it: put your name or trademark on a high-risk system
25(1)(b) Modify it: make a substantial modification that keeps it high-risk
25(1)(c) Repurpose it: change its intended purpose so it becomes high-risk

Why it sticks: Any one is enough, and you then owe every provider duty in Art. 16. The original provider is no longer the provider for that system but must cooperate and hand over what you need (25(2)).

Serious incident reporting clocks

EU AI Act, Regulation (EU) 2024/1689, Art. 73

Who: Provider reports to the market surveillance authority; the deployer tells the provider first (26(5))
When: After a serious incident — the clock runs from awareness

15, 10, 2 — the worse it is, the shorter the clock

73(2) Standard: within 15 days of becoming aware
73(4) A death: within 10 days
73(3) Widespread or critical infrastructure: immediately, and no later than 2 days

Why it sticks: Part of post-market monitoring (Art. 72), which the provider plans before market. A different recipient, trigger and clock from the 72-hour GDPR personal data breach — one incident can need both.

The four transparency duties

EU AI Act, Regulation (EU) 2024/1689, Art. 50(1)–(5)

Who: Two for providers, two for deployers — at any risk tier
When: At the latest at the first interaction or exposure (50(5))

Chat, Mark, Feel, Fake — two for providers, two for deployers

50(1) Chat: Provider tell people they are interacting with AI, unless obvious
50(2) Mark: Provider machine-readable marking of synthetic audio, image, video and text
50(3) Feel: Deployer disclose emotion recognition or biometric categorisation
50(4) Fake: Deployer disclose deepfakes, and AI text published on matters of public interest

Why it sticks: The providers build it in (the chatbot notice, the watermark); the deployers disclose how they use it. Not to be confused with Art. 13, which is transparency from provider to deployer about a high-risk system.

General-purpose model duties

EU AI Act, Regulation (EU) 2024/1689, Arts. 51, 53, 54 and 55

Who: Provider of the general-purpose AI model — not the company building an app on it
When: Before placing the model on the market, and ongoing

Everyone: Document, Downstream, Copyright, Content. Systemic: Test, Treat, Tell, Toughen

53(1)(a) Document: All models technical documentation for the AI Office
53(1)(b) Downstream: All models information for providers building on the model
53(1)(c) Copyright: All models a policy to respect EU copyright, including opt-outs
53(1)(d) Content: All models a public summary of training content
51(2) Systemic risk threshold: Systemic presumed above 10²⁵ floating-point operations of training compute
55(1)(a) Test: Systemic model evaluations, including adversarial testing
55(1)(b) Treat: Systemic assess and mitigate systemic risks
55(1)(c) Tell: Systemic track and report serious incidents
55(1)(d) Toughen: Systemic adequate cybersecurity

Why it sticks: Four duties for every model, four more for systemic-risk models, both (a) to (d). Free and open-source models skip Document and Downstream (53(2)) — but never if they carry systemic risk. Non-EU model providers appoint an authorised representative (54).

Penalty tiers

EU AI Act, Regulation (EU) 2024/1689, Arts. 99 and 101

Who: Member-state authorities fine operators; the Commission fines model providers
When: After an infringement

Ban, Break, Bluff — 7, 3, 1

99(3) €35M or 7% — Ban: breaching the Art. 5 prohibitions
99(4) €15M or 3% — Break: breaching most other operator obligations
99(5) €7.5M or 1% — Bluff: incorrect or misleading information to authorities
99(6) Small firms: whichever is lower — the reverse of everyone else
101 General-purpose model providers: up to €15M or 3%, imposed by the Commission

Why it sticks: Descending 7-3-1: banned practices, broken duties, bluffing the regulator. The small-firm reversal is the favourite trap.

Domain II — Standards and frameworks

Voluntary, certifiable or both. Every one cited by its formal number and year.

The four core functions

NIST AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023), §5

Who: Any organisation, voluntarily — AI actors across the life cycle
When: Govern throughout; Map, Measure, Manage as a repeating loop

Govern is the hub; Map, Measure, Manage is the loop

Govern: cross-cutting culture, policy, roles, accountability
Map: establish context and identify risks
Measure: analyse, assess, benchmark, track
Manage: prioritise, respond, monitor

Why it sticks: Govern is not step one of four — it wraps the other three. Companion documents: the Playbook, and the Generative AI Profile (NIST AI 600-1, July 2024).

The seven trustworthiness characteristics

NIST AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023), §3

Who: Properties of the system, pursued by everyone who builds or runs it
When: Design targets, then tested and monitored

Very Safe Systems Are Explained, Private, Fair

3.1 Valid and reliable: the base condition the others build on
3.2 Safe: no endangerment of life, health, property, environment
3.3 Secure and resilient: withstands attack and adverse events
3.4 Accountable and transparent: who answers, and is information available
3.5 Explainable and interpretable: mechanism and meaning of output
3.6 Privacy-enhanced: anonymity, confidentiality, control
3.7 Fair, with harmful bias managed: equality and equity

Why it sticks: Valid and reliable is drawn as the foundation beneath the rest — the others mean nothing if the system does not work.

The ISO/IEC numbers

International standards, by number and year of publication

Who: Voluntary — only 42001 is certified, and it certifies an organisation
When: Vocabulary first, then risk, management system, impact, life cycle

22989 names it, 23894 risks it, 42001 runs it, 42005 weighs it, 5338 lives it

International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 22989:2022: concepts and terminology — the vocabulary
ISO/IEC 23894:2023: AI risk management, adapting ISO 31000:2018
ISO/IEC 42001:2023: the AI management system — the one you certify against
ISO/IEC 42005:2025: AI system impact assessment
ISO/IEC 5338:2023: AI system life cycle processes

Why it sticks: Options are built by swapping these numbers. Only 42001 certifies anything, and it certifies an organisation — not a model, and not a person.

The management system clauses

ISO/IEC 42001:2023, Clauses 4–10 (plus Annex A controls)

Who: The organisation seeking certification — top management owns Clause 5
When: Plan-Do-Check-Act, round and round

Clever Leaders Plan, Support, Operate, Evaluate, Improve

4 Context of the organisation: scope, stakeholders, the AI system’s role
5 Leadership: top management commitment and AI policy
6 Planning: risks, opportunities, objectives, impact assessment
7 Support: resources, competence, awareness, documentation
8 Operation: run the processes, assessments and treatments
9 Performance evaluation: monitoring, internal audit, management review
10 Improvement: nonconformity, corrective action, continual improvement

Why it sticks: Maps onto Plan-Do-Check-Act: Plan is 4–7, Do is 8, Check is 9, Act is 10. The same clause structure as every modern ISO management system standard.

The OECD AI Principles

OECD Recommendation of the Council on Artificial Intelligence (May 2019, revised May 2024), §1.1–1.5

Who: AI actors — soft law adopted by governments
When: Values for the whole life cycle

Inclusive Humans Trust Robust AI

1.1 Inclusive growth, sustainable development and well-being: AI should benefit people and the planet
1.2 Human rights and democratic values: including fairness and privacy
1.3 Transparency and explainability: meaningful information, and the ability to challenge outcomes
1.4 Robustness, security and safety: functions appropriately throughout its life cycle
1.5 Accountability: actors answer for proper functioning

Why it sticks: Section 2 adds five recommendations to governments. The EU AI Act adopted the OECD’s definition of an AI system, which is why this soft-law text matters so much.

The Blueprint for an AI Bill of Rights

White House Office of Science and Technology Policy, Blueprint for an AI Bill of Rights (October 2022)

Who: Aimed at designers, developers and deployers of automated systems — non-binding
When: Values for the whole life cycle

Safe, Fair, Private, Told, Human

1 Safe and effective systems: pre-deployment testing, risk identification, ongoing monitoring
2 Algorithmic discrimination protections: equity assessments and disparity testing
3 Data privacy: protection from abusive data practices, and agency over your data
4 Notice and explanation: know an automated system is used, and how it affects you
5 Human alternatives, consideration and fallback: opt out to a person where appropriate, and a remedy when it fails

Why it sticks: A white paper: no enforcement and no penalties. Offered beside binding law to see whether you will treat it as an equivalent.

The UK’s five principles

United Kingdom (UK) Government, A pro-innovation approach to AI regulation (white paper, March 2023)

Who: Existing UK sector regulators apply them — there is no AI act
When: Whenever a regulator’s remit meets an AI system

Safe, Clear, Fair, Owned, Challengeable

1 Safety, security and robustness: works as intended, resists attack
2 Appropriate transparency and explainability: proportionate to the risk
3 Fairness: no unfair discrimination or unfair outcomes
4 Accountability and governance: clear lines of responsibility
5 Contestability and redress: people can challenge a harmful decision

Why it sticks: The opposite design choice to the EU: principles applied by the regulators that already exist (the Information Commissioner’s Office (ICO), the Financial Conduct Authority (FCA), the Competition and Markets Authority (CMA) and others) rather than one horizontal statute.

The international soft-law timeline

Principles, declarations and treaties, by date adopted

Who: Governments — none binds a company directly
When: In date order, 2019 to 2024

Only Good Unions Help Build Consensus — 2019 to 2024

May 2019 OECD AI Principles: the first intergovernmental AI standard
June 2019 Group of Twenty (G20) AI Principles: the OECD text, adopted by the G20
Nov 2021 United Nations Educational, Scientific and Cultural Organization (UNESCO) Recommendation on the Ethics of AI: adopted by all member states
Oct 2023 Group of Seven (G7) Hiroshima AI Process: guiding principles and code of conduct for advanced AI
Nov 2023 Bletchley Declaration: the first AI Safety Summit, on frontier risk
Sep 2024 Council of Europe Framework Convention: the first binding AI treaty (Council of Europe Treaty Series (CETS) No. 225)

Why it sticks: All soft law except the last: the Council of Europe Convention is a treaty, binding the states that ratify it — though still not companies directly.

Domains III and IV — Building and deploying

Sequences and checklists from the life cycle, in the order a project meets them: plan, assess risk, prepare data, test, release, monitor, respond. For why each order holds, see the order-of-operations page.

The planning sequence

IAPP AIGP Body of Knowledge v2.1, performance indicators III.A.1–III.A.2

Who: The project team, with the business owner
When: Plan — before any data or design work

Pigs Use Lipstick, Goats Don’t

1 Problem: the business problem to be solved
2 Use cases: the specific intended uses
3 Law: the laws that apply to those uses
4 Gaps and risks: where the use cases could fail or harm
5 Data: what data the system will need

Why it sticks: Purpose fixes the law, the law fixes the design, the design fixes the data. The distractor nearly always moves data to the front.

The risk mitigation hierarchy

IAPP AIGP Body of Knowledge v2.1, performance indicator III.A.4

Who: The risk owner (first line), with the second line’s challenge
When: Design — once each risk is scored for probability and severity

Avoid, Reduce, Transfer, Accept — best first

1 Avoid: do not build it, or remove the feature that creates the risk
2 Reduce: controls that lower probability or severity — the usual answer
3 Transfer: insurance or contract — the risk is shared, not removed
4 Accept: residual risk, signed off by someone with the authority to accept it

Why it sticks: Buying insurance is transfer, not mitigation. A rare but catastrophic harm still demands treatment — severity alone can rule out accepting it. The EU AI Act’s own version is in Art. 9(5): design it out, then control, then inform.

Data attributes to assess before training

IAPP AIGP Body of Knowledge v2.1, performance indicator III.B.1

Who: The data and model team, checked by governance
When: Build — before training

Two Q’s, an I, an F — and the right to use it

Quality: accurate, complete, consistent
Quantity: enough to train and test
Integrity: unaltered, with known lineage
Fitness for purpose: representative of where it will be used
Lawful rights: a basis, licences and permissions to use it at all

Why it sticks: The fifth is what makes this governance rather than data science: perfect data you may not lawfully use is no use at all.

The kinds of testing

IAPP AIGP Body of Knowledge v2.1, performance indicator III.B.3

Who: The development and assurance teams
When: Build — before release

Unusually Industrious Volunteers Perform Several Big Inspections

Unit: each component alone
Integration: components working together
Validation: does it meet its requirements
Performance: accuracy and speed against thresholds
Security: resistance to attack, including adversarial inputs
Bias: outcomes across groups
Interpretability: can its outputs be explained

Why it sticks: In the order the BOK lists them, which roughly runs from the smallest part to the whole system and then out to its effects.

Four assurance activities that get confused

IAPP AIGP Body of Knowledge v2.1, performance indicators III.C.3 and IV.C.3

Who: Security, assurance and audit teams — or independent outsiders
When: In the order a system meets them: design, pre-release, pre-release, then periodically

Imagine it, Attack it, Probe it, Check it

1 Threat modelling — imagine it: map how the system could be attacked or abused, to prioritise defences
2 Red teaming — attack it: people actively trying to make the system fail or produce harmful output
3 Security testing — probe it: test for specific exploitable weaknesses, including the surrounding infrastructure
4 Audit — check it: verify that the controls on record are actually followed

Why it sticks: Threat modelling is thinking, red teaming is doing, security testing is targeted, audit looks at controls rather than the model. The EU AI Act asks systemic-risk model providers for adversarial testing (Art. 55(1)(a)).

Deployment context factors

IAPP AIGP Body of Knowledge v2.1, performance indicator IV.A.1

Who: The deploying organisation
When: Deploy — deciding whether and how to adopt

Bosses Prefer Data, Ethics and Workers

Business objectives: what the deployment is for
Performance requirements: how good it must be
Data availability: whether the data exists and can be used
Ethical considerations: who could be harmed and how
Workforce readiness: whether people can use and oversee it

The four ways to tell models apart

IAPP AIGP Body of Knowledge v2.1, performance indicator IV.A.2

Who: The deployer choosing a model
When: Deploy — model selection

Four yes-or-no questions: Generates? Open? Large? Multimodal?

Classic or generative: predicts and classifies, or creates new content
Proprietary or open source: licensed and closed, or inspectable and modifiable
Small or large: narrow and cheap, or broad and costly
Language-only or multimodal: text alone, or text with images, audio and video

The adaptation ladder

IAPP AIGP Body of Knowledge v2.1, performance indicator IV.A.3

Who: The deployer adapting a model — who may become a provider
When: Deploy — before release

Prompt, Retrieve, Refine, Rebuild — lightest first

1 Prompt: prompt engineering on the model as it is
2 Retrieve: retrieval-augmented generation over your own documents
3 Refine: fine-tuning on your own data
4 Rebuild: training a model from scratch

Why it sticks: Governance favours the least invasive step that meets the need. Each rung up adds data exposure, cost and obligations — at the top you may become a provider.

Release patterns, safest first

IAPP AIGP Body of Knowledge v2.1, performance indicator III.C.1

Who: The team releasing the model
When: Release — between testing and full production

Shadow, Canary, Challenger, Switch

1 Shadow: runs on live inputs alongside the current process; its outputs are not acted on
2 Canary: serves a small share of real traffic, widened if it holds up
3 Champion / challenger: the new model competes with the current one on live traffic
4 Blue-green: two full environments; traffic switches from one to the other, and can switch back

Why it sticks: Shadow is the only one where no real decision depends on the new model — the answer when a question stresses "without affecting anyone".

The three drifts

IAPP AIGP Body of Knowledge v2.1, performance indicator III.C.5

Who: Whoever monitors the model in production
When: Operate — post-deployment monitoring

The inputs moved, the rule moved, the mix moved

1 Data drift (covariate shift): the inputs look different from the training data
2 Concept drift: the relationship between inputs and the right answer has changed
3 Label drift (prior shift): the share of each outcome has changed

Why it sticks: Concept drift is the dangerous one: the inputs can look perfectly normal while the model has quietly become wrong. Only outcome monitoring catches it.

Incident response

IAPP AIGP Body of Knowledge v2.1, performance indicator III.C.4

Who: The system owner, with legal, privacy and communications
When: Operate — after something goes wrong

Can All Nurses Remain Reasonable

1 Contain: suspend it or take it out of the decision path
2 Assess: severity, scope and root cause
3 Notify: users, regulators and integrated third parties as required
4 Remediate: fix the defect and validate the fix
5 Review: feed the lessons back into the controls

Why it sticks: Containment is unconditionally first — every other step can happen while the harm is stopped, but none should happen instead of stopping it. Notify runs on legal clocks: 72 hours under the GDPR, 2, 10 or 15 days under the EU AI Act.