Mapping AI obligations

How can you turn an inventory of AI use cases into a substantiated and verifiable matrix of obligations?

1960 € per session, excl. VAT

In short

This seven-hour day, excluding breaks, enables legal and compliance teams to classify AI uses, examine potentially applicable obligations and organise the expected evidence. Generative AI assists with document review without replacing legal interpretation. Each participant produces a source-referenced matrix, an uncertainty register and prioritised actions.

Why this training?

An inventory of tools is not enough to determine the relevant obligations: the purpose, context of use, actors involved and system characteristics must be documented. An insufficiently substantiated classification weakens requests to suppliers and internal decision-making. Generative AI can help extract and compare regulatory passages, but it can also invent a reference or omit a condition. The training requires sources to be critically cross-checked and distinguishes substantiated conclusions, assumptions and questions reserved for the legal department. Continuing case study: The fictitious organisation « Orvance Services » uses an internal document assistant and is considering a system for pre-screening job applications supplied by a service provider. The legal department must examine both uses before any decision is made, using entirely fictitious contracts, functional descriptions and instructions for use. Transfer to the workplace: Reuse the matrix for an authorised business use, have its classification validated by a qualified professional, then track missing evidence and update references when the system or applicable framework changes.

Objectives of this training

  • Describe the purposes and conditions of use of two AI systems
  • Justify a provisional classification of the uses and roles
  • Link each included obligation to a verified official source
  • Build a matrix of obligations, responsible parties and evidence
  • Measure the completeness of the file and prioritise validations

Who is it for and what are the prerequisites?

Roles and tasks concerned

  • Legal professionals and compliance managers responsible for AI uses
  • Data protection officers and risk managers involved in AI reviews
  • Procurement or project managers preparing supplier files

Prior skills

  • Know your organisation’s compliance and risk management processes.
  • Be able to use a generative assistant and check its responses against documents.

What you will work on

  1. Define the scope of the uses to be examined

    Objective: Compile a description suitable for legal analysis. Purposes, users, data, decisions concerned and system limitations.

  2. Organise the review of sources

    Objective: Distinguish between the applicable text, interpretation and a generated summary. Official sources, version consulted, scope of the guidance and application timetable to be checked with your legal department.

  3. Classify the systems and roles

    Objective: Formulate reasoned classification hypotheses. Scope, risk categories, provider and deployer; classification based on documented facts.

  4. Build the obligations matrix

    Objective: Translate the analysis into traceable requirements. Applicability, justification, responsible party, evidence and status; relationship with the GDPR without conflating the analyses.

  5. Examine supplier evidence

    Objective: Identify inadequate supporting documents. Consistency between the contract, instructions for use, intended use and supporting evidence.

  6. Check and submit the file

    Objective: Assess quality before professional validation. Completeness, traceability, blocking uncertainties and prioritisation of actions.

What you take away

  • Classification sheets for the two uses
  • Source-referenced matrix of obligations and expected evidence
  • Register of uncertainties and questions for suppliers
  • Compliance action plan with responsible parties and validation points

Method and assessment

  • Short instructional inputs followed by immediate practice on the continuing case study.
  • Individual work followed by work in pairs, with peer review of the outputs.
  • Guided group discussion: what works, what needs correcting and what remains a human decision.
  • Preparation: Prepare a fictitious or anonymised description of an AI use, without personal data or confidential information. Arrange a tool authorised by the organisation and access to the AI Act regulation on EUR-Lex, as well as the relevant official resources.

Observable criteria: Each use specifies its purpose, actors and missing information. ; Each included obligation refers to an official passage consulted and a justification of applicability. ; References proposed by AI are checked; errors are recorded. ; The completeness rate is calculated against the expected fields in the matrix. ; Each blocking uncertainty has a person responsible for clarification and a planned validation..

Frequently asked questions

Can the assistant conclude that compliance has been achieved?

No. It prepares the analysis; the conclusions require validation by a qualified professional.

Can we use our internal documents?

The exercises use only fictitious or anonymised documents in tools authorised by the organisation.

Does the HR case study automate a selection process?

No. No sensitive decision is automated; the exercise focuses solely on the legal examination of the proposed system.

Are the regulatory deadlines presented as established facts?

No. Their applicability is checked against official sources and still needs to be verified with your legal department.

Last updated: