Module 18 self-check | AI GRCA Practitioner Programme

Which is a provider obligation for a high-risk system, distinct from a deployer obligation?

Establishing a risk management system and technical documentation before market placementMonitoring within the deployer's own organisationProviding deployer-specific input dataUsing the system per instructions

Why do GPAI providers face obligations around a 'copyright policy'?

Only applies to models trained exclusively on public domain contentCopyright policy obligations only apply to deployers, not providersCopyright is entirely unrelated to GPAI modelsGPAI training often involves large volumes of data, raising copyright considerations the Act requires providers to address through policy

Why does 'regulatory evidence preservation' matter even years after a high-risk system was first placed on the market?

This obligation applies only to prohibited practicesEvidence can always be safely discarded after conformity assessment passesRegulators or courts may need to review historical evidence well after initial deployment, particularly following an incident or complaintEvidence preservation obligations only apply during the first month of deployment

Under the updated timeline enacted via the EU's 'Digital Omnibus' in 2026, when do Annex III high-risk use case obligations generally apply?

2 August 2026 as originally planned, unchanged2 December 20272 August 2028There is no defined date

Why does timely 'serious incident reporting' matter beyond simply satisfying a legal box-ticking requirement?

Incident reporting timelines were removed by the 2026 delaySerious incidents only need to be reported after a full year has passedTiming has no real consequencePrompt reporting enables faster investigation, containment and potentially prevents recurrence or wider harm

Which best reflects the relationship between 'quality management system' (QMS) obligations and technical documentation?

They are unrelated requirementsA QMS provides the organisational process discipline that supports consistently producing and maintaining accurate technical documentation and compliance evidenceTechnical documentation replaces the need for a QMS entirelyQMS obligations only apply to GPAI providers

Why does the Act distinguish 'training data', 'validation data' and 'testing data' as separate governance concerns?

Only training data is ever relevant to complianceTesting data requirements were removed by the 2026 delayThe distinction is purely academic with no governance relevanceEach serves a different role in building and verifying a model, so data-quality and representativeness obligations need to be considered for each separately

What does the Act's 'cybersecurity' obligation for high-risk systems primarily address?

Cybersecurity is addressed solely by a separate, unrelated regulation with no AI Act linkPhysical building security onlyProtecting the AI system against attempts to exploit vulnerabilities that could compromise its behaviour or dataCybersecurity obligations apply only to GPAI models, not high-risk systems

What does 'data governance' cover in the EU AI Act's high-risk obligations?

Only applies to GPAI models, not high-risk systemsOnly where the servers are physically locatedPractices for training, validation and testing data, including relevance, representativeness and qualityMarketing approval of the dataset name

EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence