Generative AI Systems under the EU AI Act

Overview

This course addresses operational compliance for generative AI systems under Regulation (EU) 2024/1689 (the EU AI Act). For this programme, generative systems are those capable of producing text, images, code, audio, video or multimodal content.

Whether such a system is high-risk depends on intended purpose, not on the fact that it generates content. Where that purpose places the system in a high-risk class, the Act continues after the system is put into service. Providers and deployers then carry duties on risk management, data governance, logging, human oversight, accuracy and robustness, quality management, use in operation, and post-market monitoring.

The course translates the articles named for this programme into purpose-specific controls for a live generative pipeline: what is generated, under which conditions, how a person can intervene, and how drift in hallucination or bias is watched after go-live.

Why generative systems need their own operational treatment

A generative system produces new content at runtime. Failures named for this course - hallucination, bias amplification, unauthorised use of protected material, and effects on fundamental rights - appear in that output stream. Oversight that only reviews a model card does not see the live output. Logs that only store a prompt hash do not reconstruct what was shown to a person.

Watermarking and similar marking, where used, are treated as an operational control to be verified in use, not as a substitute for the articles above.

Articles in scope

The course is built around the articles already named for this programme.

• Article 8 - compliance with the Chapter III, Section 2 requirements, read through intended purpose, the generally acknowledged state of the art, and the risk-management system.
• Article 9 - the risk-management system across the life cycle.
• Article 10 - data and data governance for the datasets that build, adapt or feed the running system.
• Article 12 - automatic recording of events to a level that supports traceability.
• Article 14 - human oversight designed so natural persons can understand, monitor and intervene.
• Article 15 - appropriate accuracy, robustness and cybersecurity in operation.
• Article 17 - a quality management system covering design, testing, data, change and post-market processes.
• Article 26 - deployer obligations, including use according to instructions and monitoring of operation.
• Article 72 - the provider's post-market monitoring system, including performance in use and serious-incident reporting where it applies.

Classification remains purpose-specific. The course does not treat every deployment of this architecture as high-risk, and it does not treat high-risk status as optional once intended purpose meets the Act's tests.

What you will learn

By the end of the course, participants will be able to:

• classify a generative AI system under the EU AI Act and identify which high-risk obligations follow from its intended purpose;
• apply Article 8's three interpretive lenses - intended purpose, state of the art, and risk management - to a live generative environment;
• design human oversight for generated content, including when hallucination or bias must escalate;
• set out proportionate post-market monitoring covering hallucination drift, bias in output, and watermark verification where marking is used;
• specify runtime observability, audit trails and incident response for the generative pipeline in use.

Course structure

Six modules. Each module stays inside the articles listed above.

1. Regulatory context and the Article 8 lenses

How the Act classifies systems by intended purpose. When a generative use is high-risk and when it is not. How intended purpose, state of the art and the risk-management system are read together so compliance is attached to the live pipeline.

2. Human oversight under Article 14

What a person must be able to see in generated output. When oversight must stop, correct or withhold content. Escalation for hallucination and for bias that matters to the intended purpose.

3. Logging, traceability and observability

Article 12 as it applies to prompts, outputs and downstream use. Article 10 as it applies to data used to build or adapt the generator. Article 15 as it applies to accuracy and robustness of generated content in operation.

4. Post-market monitoring under Article 72

Collecting and analysing data on how the generative system performs in use. Hallucination drift. Bias in output over time. Checks that any marking still holds. The deployer's related duty under Article 26 to use the system as instructed and to watch its operation.

5. Operational risk controls and incident response

Article 9 after deployment: risks that appear only when the generator is connected to users, tools and other systems. Stopping a run. Recording the incident so the risk-management file can be updated.

6. Integration and audit readiness

How Articles 17 and 8 require these operational controls to sit inside a quality-management system. What a notified body or market-surveillance authority would need in order to assess the live system against the claimed purpose. The record means the technical and operational information the Act already requires. The course does not add a separate product pack.

Who the course is for

The course is written for people responsible for generative systems that are in production, or that are being prepared for a high-risk intended purpose under the articles above. It assumes familiarity with the EU AI Act. It is not a survey of generation methods.