Course (Part 725)

Course: Understanding the EU AI Act

The EU AI Act marks a decisive step toward harmonized governance of artificial intelligence across the European Union, aiming to reconcile technological innovation with the protection of fundamental rights. It emerged from the European Commission’s digital strategy to provide a risk‑based legal framework that can be applied to both EU and non‑EU systems impacting people in the Union. The Act organises AI applications into four tiers — unacceptable, high, limited, and minimal risk — and prescribes prohibitions, strict requirements, or light-touch measures accordingly. High‑risk systems face obligations such as robust risk management, data governance, technical documentation, transparency, and human oversight before deployment. Transparency requirements ensure users are informed about an AI system’s capabilities and limitations, thereby fostering public trust. By mandating human oversight for critical applications, the Act seeks to preserve human agency and guard against automated harms. Businesses and developers will need to adapt processes, invest in compliance, and embed ethical design principles in their lifecycles. Consumers are granted stronger protections and clearer rights when interacting with regulated AI systems. Regulators at national and EU levels will be tasked with enforcement, monitoring, and updating standards as technology evolves. The Act’s tiered approach aims to avoid over‑regulation of benign uses while preventing harmful applications from entering the market. In doing so, it attempts to balance incentives for innovation with societal expectations for safety, non‑discrimination, and privacy. As the law advances through implementation, stakeholders should expect ongoing guidance, conformity assessment procedures, and potential penalties for non‑compliance. Ultimately, the EU AI Act seeks to shape a trustworthy AI ecosystem where benefits of AI are realised within accountable and human‑centric boundaries.

Lesson

Topic: Chapter 1: Introduction to the EU AI Act

Learning Outcomes

• Understand the purpose and scope of the EU AI Act.
• Recognise the four risk categories and their regulatory implications.
• Identify core obligations for high‑risk AI systems (risk management, data governance, transparency, human oversight).
• Assess implications for businesses, developers, consumers, and regulators.

Conceptual Explanation

The EU AI Act is a risk‑based regulatory framework proposed by the European Commission to govern the design, deployment, and use of artificial intelligence across the European Union. It applies to AI systems placed on the EU market or used within the EU, including some systems from non‑EU providers that affect EU residents.

Risk tiers:

1. Unacceptable risk: prohibited applications (e.g., social scoring by public authorities, certain biometric mass surveillance).
2. High risk: systems impacting safety or fundamental rights (e.g., critical infrastructure, employment, law enforcement) — subject to strict requirements.
3. Limited risk: systems requiring transparency measures (e.g., chatbots need user notification).
4. Minimal risk: largely unregulated; voluntary codes of conduct encouraged.

Key provisions for high‑risk AI include: mandatory risk assessment and mitigation throughout the lifecycle, data governance to reduce bias, technical documentation for conformity assessment, transparency and explainability obligations, and enforceable human oversight mechanisms. The Act also establishes enforcement mechanisms and penalties to ensure compliance.

Bilingual (EN → বাংলা)

English	বাংলা (Bengali)
The EU AI Act is a risk‑based regulatory framework for AI.	EU AI আইনটি কৃত্রিম বুদ্ধিমত্তার জন্য ঝুঁকি‑ভিত্তিক নিয়ন্ত্রণ কাঠামো।
High‑risk systems must implement risk management and human oversight.	উচ্চ‑ঝুঁকির সিস্টেমগুলোকে ঝুঁকি ব্যবস্থাপনা ও মানব‑নিয়ন্ত্রণ বাস্তবায়ন করতে হবে।
Unacceptable AI applications are prohibited.	অগ্রহণযোগ্য AI প্রয়োগগুলি নিষিদ্ধ।
Transparency measures build public trust.	স্বচ্ছতার ব্যবস্থা জনসাধারণের বিশ্বাস নির্মাণ করে।

Answer

Use these paired phrases for teaching bilingual students; translate additional terms as needed for clarity.

Important Notes

• The Act is horizontal: it affects many sectors; therefore sectoral rules may interact with it.
• Risk classification drives obligations — correct categorisation is critical for compliance.
• Documentation and traceability are enforcement focal points: keep auditable records.
• Human oversight is context‑dependent; design it so humans can reasonably intervene.

Exercises

True / False

1. 1. The EU AI Act bans all uses of facial recognition technology.

   Answer

   False. The Act bans certain real‑time biometric identification in public spaces in many contexts (unacceptable risk), but not all uses of facial recognition; some uses may be classified as high‑risk and regulated rather than banned.

2. 2. Limited‑risk AI systems require only voluntary codes of conduct.

   Answer

   Partially True. Minimal‑risk systems encourage voluntary codes; limited‑risk systems generally require transparency obligations (e.g., informing users they interact with AI).

3. 3. The Act applies to non‑EU providers if their systems affect people in the EU.

   Answer

   True.

Fill in the Blanks

1. 1. The EU AI Act classifies AI systems by __________ level.

   Answer

   risk

2. 2. High‑risk systems must produce thorough __________ documentation for assessment.

   Answer

   technical

3. 3. One key goal of the Act is to protect __________ rights.

   Answer

   fundamental

Multiple Choice Questions (MCQ)

1. 1. Which obligation is NOT typically required for a high‑risk AI system?

   1. Risk management system
   2. Data governance
   3. Mandatory open‑source licensing of models
   4. Human oversight
   Answer

   C. Mandatory open‑source licensing of models — the Act does not generally require open‑sourcing models.

2. 2. "Unacceptable risk" category means:

   1. Light transparency rules apply
   2. Systems are banned
   3. Only documentation is required
   4. Voluntary codes encouraged
   Answer

   B. Systems are banned.

Matching

Term	Match
A. Transparency	1. Informing users about AI capabilities
B. Human Oversight	2. Ability of a person to intervene or override
C. Risk Management	3. Lifecycle identification and mitigation of hazards

Answer

A → 1; B → 2; C → 3.

Descriptive

1. Explain in 2–3 sentences why data governance matters for high‑risk AI.

   Answer

   Data governance ensures the quality, representativeness, and provenance of training and evaluation datasets, reducing bias and improving accuracy. For high‑risk AI, poor data governance can lead to discriminatory outcomes or unsafe behaviour, so documented controls and testing are essential.

2. Summarise the main obligations a deployer must follow for a high‑risk system.

   Answer

   Deployers must ensure conformity assessments are complete, implement monitoring and incident reporting, maintain technical documentation, provide transparency to users, and enable effective human oversight and rollback mechanisms.

Creative

1. Draft a short user notification (one sentence) that a chatbot must display under the limited‑risk rules.

   Answer

   "Note: You are interacting with an AI‑powered virtual assistant; responses are generated automatically and may not substitute professional advice."

Activities

1. Group discussion: classify five real‑world AI tools into the four risk tiers and justify the choices.
   Answer

   Instructor to supply sample tools and lead justification; emphasise context and intended use matter.

2. Role play: regulator vs provider — negotiate conformity assessment requirements.
   Answer

   Roles: regulator asks for documentation and tests; provider explains development lifecycle and mitigation measures.

Vocabulary

Conformity assessment

Answer

Process to verify that a product or system complies with regulatory requirements.

Human oversight

Answer

Mechanisms enabling people to monitor, intervene or override AI decisions.

Technical documentation

Answer

Records describing design, datasets, testing, and risk management measures for an AI system.

Homework

1. Read the EU Commission’s AI Act summary (April 2021) and list three open questions for your organisation.
   Answer

   Bring questions to the next session for peer review.

2. Identify one AI system used in your context and draft a short risk‑classification memo (one page).
   Answer

   Use the four‑tier taxonomy and justify your classification with use‑case details.

Practice Task

Prepare a one‑page checklist that a small company could use to verify whether an AI system might be high‑risk under the Act. Include at least five checkpoints.

Answer

1. Does the system affect safety, legal status, or fundamental rights of individuals? (Y/N)
2. Does it process sensitive personal data (e.g., health, biometric)? (Y/N)
3. Is the system used in employment, education, law enforcement, or critical infrastructure? (Y/N)
4. Are there existing mitigation measures for bias and robustness? (Y/N)
5. Is there a plan for human oversight and incident reporting? (Y/N)

Prepared for: Chapter 1 — Introduction to the EU AI Act. Use this sheet as a compact teaching and revision aid.