One-day course on the strategy required by Clauses 5 and 6 for ongoing conformity of high-risk AI systems
EN 18286 Clauses 5 and 6 require a regulatory compliance strategy. That strategy is how the organisation keeps high-risk AI systems inside the EU AI Act over time: who decides, what counts as a substantial modification, which conformity route applies, and how CE marking is maintained across versions where it applies.
The strategy is a living management instrument. It has to stay current when models, data or intended purpose change. This one-day course covers what the strategy must decide and record, and how those decisions join risk management, data governance and post-market monitoring.
Duration: one day. Format: taught course. Dates are on the training calendar.
Clause 5 puts the strategy under leadership. Top management owns the approach to conformity; operations do not invent it system by system. Clause 6 puts the strategy into planning: quality objectives, actions to address risk, and the rules for change. Article 17 then expects that planned system to exist in practice.
Without a strategy, each update is an argument. With one, the organisation can say in advance which changes stay inside the current conformity file and which reopen assessment.
Which Article 17 items the strategy has to address: documented procedures, risk, design and development, verification, data, post-market monitoring, and change. How EN 18286 Clauses 5 and 6 turn those items into a single approach rather than a clause list.
Criteria for when a change is a substantial modification. The day works through three common triggers:
How those criteria are written so design, operations and suppliers can apply them without a new legal opinion on every commit.
Which assessment route the strategy selects for which type of high-risk system. How CE marking, where it applies, is obtained and then maintained across versions. What the strategy has to say about authorised representatives and declarations of conformity when the provider is outside the Union.
How the strategy points at the risk-management system, data governance and post-market monitoring so those processes know when to escalate a change. A monitoring finding or a supplier update that meets a substantial-modification criterion has to reach the strategy, not stop in a team channel.
Change-control logs, version identity, and the evidence that a decision was taken under the strategy. What an assessor follows when they pick one version of a system and ask whether the strategy was applied.
Leadership, quality and regulatory leads who will own the strategy and the change rules it sets. Product and engineering leads who must apply those rules to model, data and system updates. The course assumes Article 17 and EN 18286 are already known in outline. Fundamentals or the two-day Overview are the usual prior days.
