Lion Cipher Lab

Run an EU AI Act conformity assessment for a high-risk AI system

• GRC / Compliance
• Advanced
• ~90 min
• Free · no account required

Why it matters

Classifying a system as high-risk is the easy half; the expensive half is everything that word triggers, and that is what an AI-governance or GRC role actually gets paid to run. Once a system is high-risk under the EU AI Act, a provider cannot lawfully place it on the EU market until it has stood up a risk-management system, governed its training data, written technical documentation, built logging and human oversight, measured accuracy and robustness, run a QUALITY MANAGEMENT SYSTEM, passed a CONFORMITY ASSESSMENT, drawn up an EU declaration of conformity, affixed a CE mark and registered…

What you'll learn

• confirming a high-risk trigger precisely: the Article 6(1)/Annex I product-safety route vs the Article 6(2)/Annex III use-case route, and the Article 6(3) filter with its documentation-and-registration requirement
• walking the Chapter III Section 2 provider requirements end to end: risk management (Art. 9), data & data governance (Art. 10), technical documentation (Art. 11), record-keeping/logging (Art. 12), transparency & instructions for use (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15) and the quality management system (Art. 17)
• drafting an Annex IV technical-documentation outline that a notified body or auditor would actually accept
• choosing the conformity-assessment route: Annex VI internal control vs Annex VII notified body (Art. 43), and knowing WHEN each applies (the Annex III point-1 biometrics exception)
• using harmonised standards / common specifications and the presumption of conformity (Art. 40-41) as evidence
• producing an EU declaration of conformity (Art. 47 + Annex V), affixing CE marking (Art. 48), and registering in the EU database (Art. 49 / Art. 71)
• building a post-market monitoring plan (Art. 72) and a serious-incident reporting procedure (Art. 73) so conformity is a continuing programme, not a certificate
• avoiding the named failure modes: confusing DEPLOYER and PROVIDER obligations (Art. 25), assuming a GDPR DPIA covers the AI Act (it does not; Art. 27 FRIA is a distinct deployer duty), and treating CE marking as one-and-done
• reading the staged application timeline (Art. 113) so a compliance deadline is anchored to a real date

Steps in this lab

1. Where this lab starts: high-risk is confirmed -- now the conformity programme begins
2. Set up the conformity dossier and adopt a worked high-risk system
3. Confirm the high-risk trigger precisely -- Article 6 route, and the Article 6(3) filter
4. Build the obligations register -- Chapter III Section 2 requirements (Articles 9-15) + the QMS (Article 17)
5. Draft the Annex IV technical documentation outline (artifact 1)
6. Choose the conformity-assessment route -- Annex VI internal control vs Annex VII notified body (artifact 2)
7. Draft the EU declaration of conformity (Article 47 + Annex V) and plan the CE marking (Article 48) (artifact 3)
8. Register the system in the EU database (Article 49 / Article 71)
9. Build the post-market monitoring plan and serious-incident procedure (Articles 72-73) (artifact 4)
10. The judgment: the four traps that sink a conformity programme
11. Assemble the dossier and write the sign-off page

Open the full interactive lab →