Eight-module practitioner certification: stand up an EU AI Act compliance programme, produce the risk register, the Annex IV file and the data governance evidence, and run the cadence that keeps them current. Includes the three working templates.
Sit the examination and get the certificate
299 € excl. VAT
The modules on this track are free to read — we do not paywall the explanation of a regulation. What you buy is the examination, the verifiable certificate it issues, and the Open Badge.
One payment · retakes included, best score kept · certificate carries a public id anyone can verify · sit the exam under the address that paid
A private certificate issued by Regulation AI, not an official EU credential: no such thing exists for individuals, because the Regulation's conformity assessment applies to AI systems rather than to people.
Most AI Act work fails in the same place. The obligations get read, summarised and presented; then somebody asks to see the file, and there is no file. The gap is not knowledge of the Regulation — it is the absence of an operating model that turns the obligations into dated, owned, defensible records.
This track is that operating model. It is role-agnostic and artefact-driven: rather than working through Chapter III from one seat, it works through the artefacts a supervisor, a notified body or a customer's procurement team will actually ask to see, and the cadence that keeps them true. The three working templates the track is built around are included.
The eight modules
Module 1 — The programme, its mandate and its file What a compliance programme has to produce, who owns it, and why the role determination under Art. 3(3), Art. 3(4) and Art. 25 is step zero rather than a legal footnote.
Module 2 — Inventory and classification as a process Finding the systems you did not know you had, a decision path that puts the carve-outs before Annex III, and recording the derivation rather than the conclusion.
Module 3 — The risk register: Art. 9 as a running system Identification, estimation, evaluation, mitigation and residual risk, in a register with owners and dates. Why a risk assessment produced once is not a risk management system.
Module 4 — Data governance you can evidence (Art. 10) Provenance, representativeness against the intended population, error and completeness, bias examination, and the narrow Art. 10(5) permission to process special-category data to detect it.
Module 5 — The Annex IV technical file The file element by element, with an evidence owner and a completeness state for each — and what a deployer should be demanding under Art. 13 instead.
Module 6 — Oversight and logging that survive a review Designing for the Art. 14(4) measures, automation bias, the authority the overseer actually needs, and the difference between a log and an audit trail (Art. 12, Art. 19, Art. 26(6)).
Module 7 — Assurance: QMS, internal audit, conformity readiness The Art. 17 quality management system as the wrapper, internal control under Annex VI against a notified body under Annex VII, and getting supplier evidence out of a provider under Art. 25(4).
Module 8 — The operating cadence The Art. 72 post-market monitoring plan, serious incident reporting and its deadlines under Art. 73, and what a substantial modification reopens.
What the examination asks
Twenty-five questions drawn per candidate from a bank of 104, stratified so all eight modules are covered on every paper, graded on our server. The pass mark is 70%.
The bias of the paper is deliberate: it asks what you would put in a record, in what order you would settle two questions, and which of two defensible-sounding answers a supervisor could actually challenge. Recall questions exist, but they are not what the certificate rests on.
Before you start
The modules are free to read — we do not paywall the explanation of a regulation. What is paid is the examination, the verifiable certificate it issues, the Open Badge, and the three templates. Sit the examination under the address you buy with: access is granted to that address and no other.
AI Act meets DORA and NIS2
Is your organisation subject to both the AI Act and DORA? The two regulations intersect on the operational resilience of financial AI systems. Our sister site regulation-dora.eu covers DORA in depth — including what the AI Act adds on top of an existing DORA programme.
The AI Act for financial institutions ↗ Explore regulation-dora.eu ↗This is not the same examination
The Fundamentals examination checks that you have read the Regulation. This one checks that you could apply it to a real case — same subject, different question.
| Fundamentals (free) | Risk Management Pro (this track) | |
|---|---|---|
| Questions served | 15 | 25 |
| Question bank | 60 | 104 |
| Modules covered | 5 | 8 |
| What is tested | Whether you are in scope, and by what | Whether you could produce the file, not whether you could name the article |
| Access | Open, no card required | Track holders only |
Two sample questions on the same article. They are written for this page and appear in no bank.
Fundamentals — free
Which article of the EU AI Act requires a risk management system for high-risk AI systems?
- Art. 9
- Art. 10
- Art. 14
- Art. 17
Show the answer and the reasoning
Answer 1. Art. 9 is the risk management system; Art. 10 is data governance, Art. 14 human oversight and Art. 17 the quality management system. Recall of a reference, and nothing more.
Risk Management Pro — this track
Your risk register records a residual risk as 'accepted' for a credit-scoring model, signed by the model owner. A market surveillance authority asks you to justify the acceptance. Which element of your record is the one that actually carries the justification?
- The signature of the model owner, as evidence that an accountable person decided
- The post-mitigation score falling inside the tolerance band set in the programme mandate
- The stated residual risk judged acceptable against the system's intended purpose, with the mitigation measures and the testing that demonstrates them
- The date of acceptance, showing the decision preceded placing on the market
Show the answer and the reasoning
Answer 2. Art. 9(5) requires that residual risk be judged acceptable, and Art. 9(2)(d) ties that judgement to the measures adopted; Art. 9(6)-(8) make testing the demonstration. A signature records who decided and a tolerance band records against what, but neither is the justification — the reasoning plus the evidence that the measures work is. A register whose 'accepted' rows carry a name and a score but no measures and no test result is the commonest finding in a readiness review.
Every paper is drawn per candidate and stratified across all modules; the order of the options differs between candidates. Grading happens on the server — the answer key never reaches the browser.
Frequently Asked Questions
The role tracks answer what the Regulation requires of you. This one answers how you produce it. The Provider track teaches Chapter III from the seat of the organisation placing a system on the market; this track is role-agnostic and artefact-driven — it walks through standing up the programme and building the register, the data governance evidence and the Annex IV file, with the three working templates it needs. Practitioners typically take a role track for the law and this one for the operating model.
The eight modules and the 25-question examination with its verifiable certificate, plus the three working XLSX templates the track is built around: the AI Risk Register mapped to Annex III, the Annex IV Technical Documentation File, and the Art. 10 Data Governance Checklist. Bought separately those templates are EUR 277.
No. The register, the data governance evidence and the oversight design are needed by any organisation running AI systems that matter, and a deployer who modifies a system can inherit provider obligations under Art. 25 without intending to. Modules 1 and 2 settle which obligations are actually yours before any artefact is built.
None is enforced, but the free AI Act Fundamentals course covers the scope, classification and deadline material this track assumes. If you cannot say today whether a given system is high-risk and who its provider is, start there — it is free and takes an afternoon.
No, and none exists. In the AI Act, conformity assessment and notified bodies apply to AI systems, not to people (Art. 3(20)-(22), Art. 48), so no body can be notified to certify a person. This is a private certificate with a public id anyone can verify, issued by Regulation AI, and we say so on the certificate itself.
Take compliance further with the AI Act Academy
A free course, a server-graded exam, a verifiable certificate — and the working templates.