EU AI Act — High-Risk Systems

A working practitioner’s guide to the substantive obligations that fall on providers and deployers of high-risk AI systems.

Who this is for

• Compliance leads building an AI governance file
• In-house counsel supporting a high-risk deployment
• Risk and audit professionals designing controls
• CTO / product leaders whose products fall within Annex III

What you will be able to do

• Establish whether a system is high-risk under Article 6 and Annex III
• Design a risk management system that meets Article 9
• Structure data governance and dataset documentation to Article 10
• Produce technical documentation to Annex IV
• Design meaningful human oversight per Article 14
• Prepare for and evidence conformity assessment

Syllabus

Each module comprises a mix of structured reading, worked examples, and applied exercises. Every programme concludes with an integrated written assessment marked against the published rubric.

Module 1. Determining high-risk status

Article 6, Annex III, and the derogations under Article 6(3). Common misclassifications.

Module 2. The risk management system (Art. 9)

Identification, estimation, evaluation, mitigation. Continuous, iterative process across the lifecycle. Documenting residual risk.

Module 3. Data and data governance (Art. 10)

Training, validation, testing datasets. Relevance, representativeness, accuracy. Bias examination. Special category data.

Module 4. Technical documentation (Art. 11 & Annex IV)

Nine chapters of Annex IV, section by section, with worked examples from real deployments.

Module 5. Record-keeping and logging (Art. 12)

What must be logged, retention periods, traceability by design.

Module 6. Transparency to deployers (Art. 13)

Instructions for use, characteristics, limitations, oversight measures.

Module 7. Human oversight (Art. 14)

What “meaningful” means in practice. Oversight design patterns. When automation levels break down.

Module 8. Accuracy, robustness, cybersecurity (Art. 15)

Metrics that regulators will actually accept. Adversarial resilience. Cybersecurity controls.

Module 9. Quality management system (Art. 17)

The overarching QMS obligation and how it interacts with existing management systems (ISO 9001, ISO 42001).

Module 10. Conformity assessment and post-market monitoring

Choosing the right procedure. CE marking. Serious incidents and reporting. The full post-market monitoring plan.

Assessment

Sample question

Your organisation deploys a credit-scoring model. Regulators have raised concerns that the model performs worse for one protected group than another. Walk through how you would evidence Article 10 compliance and what changes to your data governance you might make.

Assessments are marked by a named human examiner against the four-dimension rubric: regulatory accuracy (30%), applied judgement (30%), artefact quality (25%), communication (15%). Pass at 60, distinction at 75.

Prerequisites

EU AI Act Foundations (or equivalent working knowledge of the Act)

Certification

On successful completion (pass mark 60), you receive a SAAII Certified Practitioner (CP) — EU AI Act — High-Risk Systems credential. The credential is CPD-accredited, verifiable at thesaaii.com/verify, and forms one component toward higher-tier credentials. See the certification ladder for how it stacks.

Cohort licensing available from £395/seat (10+). Public sector, education, and registered charity: 20% discount. Instalment plans available for programmes at £495 and above. See For organisations and the FAQ for detail.