GovCompass
II

Understanding how laws, standards and frameworks apply to AI

~25% of the exam · 4 competencies

How existing data-privacy and other laws reach AI systems, the main elements of AI-specific laws (anchored on the EU AI Act), and the principal standards and frameworks (OECD, NIST AI RMF, ISO).

II.A
Existing data privacy laws and AI

Applying privacy principles and controller obligations to AI systems: lawful basis, purpose limitation, minimisation, DPIAs, data-subject rights, automated decision-making and special-category data.

Lessons are coming as they’re published.

II.B
Other existing laws and AI

How intellectual-property, non-discrimination, consumer-protection and product-liability law apply to AI systems and their training data.

Lessons are coming as they’re published.

II.C
Main elements of AI-specific laws

Risk classification and tiered requirements under AI-specific laws, anchored on the EU AI Act: prohibited and high-risk systems, provider and deployer duties, general-purpose AI models, enforcement and penalties — with awareness of other jurisdictions.

Lessons are coming as they’re published.

II.D
Main standards and frameworks

The OECD AI Principles, the NIST AI Risk Management Framework and Playbook, and the core ISO/IEC standards for AI terminology and management systems.

Lessons are coming as they’re published.