AI GRCA Practice Lab

A company builds a CV-screening tool and sells it under its own brand to EU employers, who configure scoring thresholds. What is the most likely primary EU AI Act role of the company that built and markets the tool?

ProviderOnly a distributorImporter onlyAffected person

An employer buys the same CV-screening tool and uses it to rank real candidates in its own hiring process. What is the employer's most likely EU AI Act role?

ProviderDeployerDeveloperAuthorised representative

What should drive EU AI Act risk classification first?

Whether the interface looks conversationalThe size of the model in parametersThe intended purpose, the actor's role and the context of useWhich country the developer's headquarters is in, exclusively

A CV-screening tool that can automatically reject candidates below a threshold, used for recruitment and candidate selection, is most likely to fall into which EU AI Act category?

Minimal-risk AI with no obligationsExempt because it uses a third-party GPAI modelProhibited practiceHigh-risk AI system

Under the current EU AI Act implementation timeline referenced in this course, when do obligations for Annex III high-risk use cases (like recruitment screening) generally apply?

2 December 20272 August 2028There is no defined timelineImmediately on the Act's entry into force with no transition

Which obligation is most clearly a provider obligation (as opposed to a deployer obligation) under the EU AI Act for a high-risk system?

Using the system only for its documented intended purposeEstablishing a risk management system, technical documentation and conformity assessment before placing the system on the marketMonitoring the system's operation within the deployer's own organisationProviding input data specific to the deployer's use case

Which obligation is most clearly a deployer obligation for a high-risk AI system under the EU AI Act?

Designing the system's original risk management systemDrafting the system's original technical documentationEnsuring human oversight in actual use, monitoring operation and using the system according to the provider's instructionsRegistering the system in the EU high-risk database as the manufacturer

A general-purpose AI model provider must give downstream deployers information to support compliance. Which is a GPAI transparency obligation described in this course?

Guaranteeing the downstream product will never be classified as high-riskTaking over the downstream provider's conformity assessment obligations entirelyRefusing to disclose any information to protect trade secrets in all casesProviding a training data summary and relevant model information to downstream providers

A UK-only company with no EU customers asks why it should still care about the EU AI Act. What is the most accurate answer?

If it later serves EU users, supplies EU providers/deployers, or its outputs are used in the EU, obligations can extend to it — and global convergence around similar risk-based principles is increasingly commonUK law automatically incorporates every EU AI Act obligationThe EU AI Act only applies to models trained in the EUIt never needs to care, since the Act only applies within the EU

Which best reflects why global AI law matters beyond the EU AI Act, per this course's coverage?

US state laws are irrelevant to organisations operating internationallyOther jurisdictions like South Korea, the US (federal and state) and Canada are developing their own AI governance approaches with related themes of risk, transparency and accountabilityNo other jurisdiction has any AI-specific lawOnly the EU regulates AI in any form

A fintech wants to launch a straight-through automated 'decline' decision for loan applications with no human review at any stage. Under UK GDPR Article 22A–22D (post-DUAA), what is the key consideration?

No safeguards are required as long as the model is accurateAutomated significant decisions are always fully prohibited with no exceptionsWhether the decision is solely automated and has a significant/legal effect, and if so, whether the required safeguards (information, representations, human intervention, contest) are in placeArticle 22A–22D only applies to marketing decisions

A caseworker can technically override an automated 'decline' but in practice always accepts the system's output within seconds, without reviewing the underlying data. Does this satisfy the 'meaningful human involvement' test?

Yes, as long as the system is described as 'decision support' in its documentationNo human involvement test applies to lending decisionsYes, because a human role exists in the workflowNo — the test requires genuine capacity and practice of reviewing and being able to change the outcome, not a nominal step

What is a DPIA screening designed to determine?

Whether the proposed processing is likely to result in high risk to individuals and therefore requires a full DPIAWhether consent is always the correct lawful basisWhether all personal data involved must be deleted immediatelyWhether the AI vendor is profitable enough to be trusted

An affordability-assessment tool uses transaction categories that could reveal health conditions, religious payments or union membership. What data protection issue does this most directly raise?

Storage limitation onlyPossible processing of special category data, which requires an additional lawful condition and stronger safeguardsThis raises no additional issue because the data was collected for another purposeOnly relevant if the applicant is a minor

What should a plain-language AI privacy notice for an automated decision include, per this course?

A legal guarantee that the decision is always accurateOnly the name of the AI vendorRelevant data use, the nature and effect of the decision, safeguards in place, and how to challenge the outcomeThe full source code of the model

Checkpoint 4