PEFT-Adapted AI Systems under the EU AI Act

Overview

This course addresses operational compliance for AI systems adapted through Parameter-Efficient Fine-Tuning (PEFT) under Regulation (EU) 2024/1689 (the EU AI Act). For this programme, PEFT includes techniques such as LoRA, QLoRA and adapters that change a base model's behaviour without retraining all parameters.

Whether a PEFT-adapted system is high-risk depends on intended purpose, not on the adaptation method. Where that purpose places the system in a high-risk class, the Act continues after the system is put into service. The adapted system is the system in use. The adapter is part of it.

The course translates the articles named for this programme into purpose-specific controls for a live PEFT deployment: the base model, the adapter, the data used to adapt it, and how that stack is watched after go-live.

Why PEFT needs its own operational treatment

PEFT changes behaviour with a small set of additional parameters. Failures named for this course - bias transferred from adaptation data, catastrophic forgetting of earlier behaviour, and adapter poisoning - sit in that change. A poisoned adapter is not visible if oversight only reviews the base model card. Forgetting is not visible if testing only repeats the adaptation set.

Data governance has to reach the adaptation set. Oversight has to see outputs after the adapter is applied. Logs have to record which adapter and which base version ran. Monitoring has to cover bias transfer, loss of prior behaviour, and integrity of the adapter in production.

Articles in scope

The course is built around the articles already named for this programme.

• Article 8 - compliance with the Chapter III, Section 2 requirements, read through intended purpose, the generally acknowledged state of the art, and the risk-management system.
• Article 9 - the risk-management system across the life cycle.
• Article 10 - data and data governance for the datasets that build, adapt or feed the running system.
• Article 12 - automatic recording of events to a level that supports traceability.
• Article 14 - human oversight designed so natural persons can understand, monitor and intervene.
• Article 15 - appropriate accuracy, robustness and cybersecurity in operation.
• Article 17 - a quality management system covering design, testing, data, change and post-market processes.
• Article 26 - deployer obligations, including use according to instructions and monitoring of operation.
• Article 72 - the provider's post-market monitoring system, including performance in use and serious-incident reporting where it applies.

Classification remains purpose-specific. The course does not treat every deployment of this architecture as high-risk, and it does not treat high-risk status as optional once intended purpose meets the Act's tests.

What you will learn

By the end of the course, participants will be able to:

• classify a PEFT-adapted system under the EU AI Act and identify which high-risk obligations follow from its intended purpose;
• apply Article 8's three interpretive lenses to a live PEFT environment;
• design human oversight for fine-tuned outputs, including when bias transfer or loss of robustness must escalate;
• set out proportionate post-market monitoring covering adapter behaviour, forgetting and the integrity of the adaptation;
• specify runtime observability, audit trails and incident response for the PEFT stack in use.

Course structure

Six modules. Each module stays inside the articles listed above.

1. Regulatory context and the Article 8 lenses

How the Act classifies the adapted system by intended purpose. When a PEFT use is high-risk and when it is not. Why the adapter does not sit outside the system for the purpose of those tests.

2. Human oversight under Article 14

What a person must be able to see in outputs after adaptation. When oversight must disable an adapter or revert to a prior version. Escalation for bias transfer and for sudden loss of earlier behaviour.

3. Logging, traceability and observability

Article 12 as it applies to base version, adapter version and output. Article 10 as it applies to adaptation data. Article 15 as it applies to robustness against adapter poisoning and to accuracy after the change.

4. Post-market monitoring under Article 72

Adapter behaviour over time. Forgetting relative to the pre-adaptation baseline. Integrity of the adapter file in production. The deployer's related duty under Article 26 to use the system as instructed and to watch its operation.

5. Operational risk controls and incident response

Article 9 after deployment: a poisoned or swapped adapter, an adaptation that changes behaviour outside the intended purpose. Isolating the adapter. Recording the incident so the risk-management file can be updated.

6. Integration and audit readiness

How Articles 17 and 8 require the base model, the adapter and the adaptation data to sit inside one quality-management system. What an assessor would need in order to test the live adapted system against the claimed purpose. The record means the information the Act already requires. The course does not add a separate product pack.

Who the course is for

The course is written for people responsible for PEFT-adapted systems that are in production, or that are being prepared for a high-risk intended purpose under the articles above. It assumes familiarity with the EU AI Act. It is not a survey of fine-tuning methods.