2.5 · Sector-Specific Regulatory ConsiderationsDownload

Course 2 Key Takeaways

5 minCourse 02

A summary of the essential frameworks, principles, and action points from Course 2 — AI Governance, Compliance & Regulatory Strategy.

Course 2 Key Takeaways

The EU AI Act
  • ◆The law is in force in stages — prohibited practices since February 2025, GPAI model obligations since August 2025, transparency (Article 50) obligations since August 2026, Annex III high-risk requirements deferred by the 2026 Digital Omnibus to 2 December 2027
  • ◆Classification is everything: prohibited → high-risk → limited risk → minimal risk
  • ◆If you build on third-party foundation models, your vendor's GPAI documentation is part of your own compliance — put it on your due diligence list
  • ◆High-risk AI requires: risk management, technical documentation, transparency, human oversight, conformity assessment, and EU database registration
  • ◆Fines up to €35M or 7% of global turnover — higher than GDPR
GDPR & AI
  • ◆Every AI system processing personal data is a GDPR system
  • ◆Training data needs its own lawful basis — you cannot assume consent from the original collection
  • ◆EU Article 22 prohibits solely automated significant decisions by default; UK Articles 22A–22D (from 5 Feb 2026) permit them by default, subject to safeguards — either way, "rubber stamp" human review does not satisfy the requirement
  • ◆DPIAs are mandatory for most AI systems processing personal data at scale
  • ◆The right to erasure creates a technical challenge for trained models — plan for this before training
Internal Governance
  • ◆Start with inventory, not policy
  • ◆Your AI Register is the foundation of everything — it must be current and complete
  • ◆Every system needs a named Business DRI and Technical DRI
  • ◆Governance must be a process embedded in how new AI is deployed, not a document that gets reviewed annually
Accountability & Explainability
  • ◆As an AI deployer, you bear liability for what your AI systems do — even if someone else built them
  • ◆Document your due diligence: it is your legal defence
  • ◆Explainability must be case-specific, plain-language, and genuinely faithful to the model's logic
  • ◆Post-hoc explanations (SHAP, LIME) may not satisfy regulatory requirements without additional design-time explainability measures
Sector-Specific Compliance
  • ◆Horizontal frameworks (AI Act, GDPR) stack on top of sector-specific regulation — they do not replace it
  • ◆Financial services: AI Act + DORA + Consumer Duty + PRA model risk + EBA guidance
  • ◆Healthcare: AI Act + MDR/IVDR + MHRA/EMA guidance + GDPR (special category data)
  • ◆Map your full regulatory stack before building your compliance programme