- Classify your AI systems: role, prohibited practices, high-risk AI systems, transparency
- Clear focus on the deployer obligations, deepened with nine case studies
- Logging and cyber security in focus: Why compliance alone is not enough
- Know the current state and how to stay up-to-date
- Use this workshop as part of your AI literacy measures (Article 4)
CLASSIFY
AI system? Provider or Deployer? Prohibited? High-risk?
Manage your AI portfolio.
COMPLY
All deployer duties: From procurement to incident, incl. FRIA, logging and reporting.
CONNECT
Connect the AI Act with the regulations and responsibilities that apply alongside it.
Why the EU AI Act Workshop from SECUINFRA!
Where the law stands
The Digital Omnibus on AI (Regulation (EU) 2026/1744) has moved the high-risk dates – but several obligations already apply today.
Simplified overview, as of November 2026. Not legal advice.
Training concept – is our workshop right for you?
The workshop enables deployers to work with the AI Act themselves: classify their systems, derive their duties and close the gaps – using the law text and official guidance.
Right for you if …
- you use AI systems built by others (e.g. SaaS tools, AI embedded in standard software)
- you work in one of the following areas
- Compliance / Governance
- IT / Information Security
- Product Ownership / Procurement.
- A Security Operations Centre (SOC) using an AI-based UEBA (User and Entity Behaviour Analytics) solution.
- an employer screening applicants with a CV-screening SaaS
- a bank or insurer using third-party scoring or pricing models
- a municipality using an AI assistant to triage requests
- a company rolling out copilots and image generators
Not right for you if …
- you develop AI systems or General-Purpose AI (GPAI) models and need a technical conformity assessment, CE marking or the implementation of a Quality Management System (QMS)
- you need legal advice on a specific case
Note: Day 3 includes a dedicated chapter on the AI Act in Germany (KI-MIG, Bundesnetzagentur, works council).
What does the course offer?
- Deployer focus
- Working directly with the law text and official guidance
- 9 case studies, quizzes and your own AI inventory
- Vendor due diligence and clauses to check for in contracts
- Security lens: logging gaps and cybersecurity considerations
- German enforcement including topics such as "KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz" (KI-MIG) and Bundesnetzagentur
What does the course not offer?
- Legal advice or a binding assessment of your systems
- Provider topics in depth (conformity assessment, technical documentation, QMS, CE marking)
What you take home
Slide handout with sources
Text-rich slides that work as a reference without the trainer. You receive them without solutions before each day and the complete version afterwards. Every slide cites the article, recital or guideline.
Your own AI inventory
Built step by step over three days for 3–5 of your tools: classification, applicable duties, gaps, competent authority and next steps.
Certificate of attendance
Documents your participation and can be used as evidence for one of your AI-literacy measures (Art. 4).
Agenda and training content
Three days, three questions – each day combines theory, case studies and quizzes, and ends with the next step of your own AI inventory.
Day 1: Classify – Who are we and what are we dealing with?
Agenda
- The AI Act after the Digital Omnibus: legal status, calendar, transition rules (Art. 111)
- Scope and definition of an AI system
- GPAI model vs. GPAI system
- AI literacy (Art. 4, as amended)
- Provider vs. deployer and the Art. 25 role shift
- Risk classification: Annex I, Annex III, Art. 6(3)
- The 10 prohibited practices (Art. 5)
Learning objectives
- Classify any AI system in the right order
- Recognise when your use makes you a provider
- Know which obligations apply today – and which from when
Day 2: Comply – What must a deployer do?
Agenda
- The deployer duties under Art. 26 along their lifecycle: pre-deployment, at deployment, ongoing
- Vendor due diligence
- Fundamental rights impact assessment – FRIA (Art. 27)
- Logging and cybersecurity: what Art. 12 and 15 do not cover
- Serious incident reporting (Art. 73)
Learning objectives
- Map the deployer duty chain to your own high-risk systems
- Decide whether a FRIA is required and what it must contain
- Set up monitoring and logging that also hold up from a security perspective
- Know how to report serious incidents
Day 3: Connect – How does it fit into the wider system?
Agenda
- Transparency obligations (Art. 50) incl. Commission guidelines and Code of Practice
- GPAI value chain, Art. 25 cooperation and contract clauses
- Adjacent law: GDPR, works council (BetrVG), product liability, CRA, NIS2, DORA
- EU ecosystem: standards, AI Office, notified bodies, regulatory sandboxes
- The AI Act in Germany: KI-MIG, Bundesnetzagentur, fines, rights of affected persons
- Guidance, voluntary tools – and how to stay up to date
Learning objectives
- Decide when and how to disclose AI-generated content
- Secure the provider inputs you depend on through contracts
- Identify the competent authority and build a 2026–2030 roadmap
- Know how to stay up to date
Dates & costs
volume discount, see FAQ
Next open dates
Reach out to us for more information
Most organisations adopt AI rather than develop it themselves. This workshop looks at what that means for your role, your responsibilities and what comes next.
The most important FAQ – EU AI Act Workshop
Is this legal advice?
No. We are cyber defense and compliance practitioners, not lawyers. The workshop explains the law and the official guidance, but Commission guidelines are not binding, and only the Court of Justice of the EU can interpret the AI Act authoritatively. For your specific case, please involve your legal department or counsel.
Is the content up to date?
Yes. The content reflects the AI Act as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), the published guidelines and the German KI-MIG. We review it before every run, and the materials state their legal status date.
Is the workshop also for developers of AI systems?
The workshop focuses on deployers. Provider topics such as conformity assessment, technical documentation, QMS or CE marking are covered only as far as deployers need to check them. It does, however, show when a deployer becomes a provider (Art. 25) – relevant if you build on third-party models or rebrand systems.
The high-risk rules only apply from December 2027 – why now?
Because AI literacy (Art. 4), the prohibited practices (Art. 5) and the transparency obligations (Art. 50) already apply, as do GDPR and works-council rights. And contracts you sign today may run into 2027/28. Therefore, you need to secure the instructions, logs and information on which your future deployer duties depend.
Does the workshop count towards AI literacy (Art. 4)?
It is one part of the legal aspects of AI literacy, and the certificate of attendance can be added to your documented Art. 4 measures (Art. 4 does not require a specific certificate). Staff still need training on the specific AI systems they use, which cannot be provided by this workshop.
In which languages is the workshop available?
The workshop is held in German or English. The slides are in English and include the German key terms, so you can research both the English and German versions of the law and official sources.
Is the workshop remote or onsite?
Open dates are held remotely via MS Teams. Exclusive in-house runs can also take place onsite at your premises.
Is there a certificate?
Yes, every participant receives a certificate of attendance. There is no exam.
What is the maximum number of participants? Are exclusive trainings possible?
A maximum of 10 participants per date. Reach out to us for exclusive in-house runs.
What are the technical requirements for remote participation?
A PC with a stable internet connection, MS Teams (local client preferred) and a current browser (Firefox or Chrome) to research law texts and guidelines, as well as to participate in quizzes. A second screen is helpful for working with the law text alongside the slides.
What does participation cost? Is there a volume discount?
€1,450 net per participant for the 3-day workshop. For more than three registrations on the same date, a volume discount is possible.
