Certificate Verification
GAGE (Global Academy of Generative-AI Education) credential verification
Sample credential: this is what you will see
On a real credential, this banner is a live signature check: issued by GAGE, never altered. Everything below shows the exact layout with example scores.
Verified Completion Record
EU AI Act Implementation Expert
Issued to Sample Learner
The day every mastery assessment is passed
GovernanceSample
The GAGE seal. On a real credential it opens that learner’s living record; only GAGE can mint a code whose signature validates.
Mastery Evidence
64 of 64 topics passed✓Every topic mastery assessment passed, server-graded
✓Average assessment score across the program
✓Scenario responses evaluated for applied judgment
Mastery Score
Example numbers, real formulaContinuous assessment (50%)
93%
Average of every topic exam best score
Mastery Exam (50%)
91%
Timed, open book, scenario based final exam
Mastery Score92%
Half earned topic by topic, half earned at the summit: a timed open book exam of applied judgment, or a rubric-graded capstone build. A real credential shows the learner’s true numbers, live; until the summit is passed, it says so plainly.
Competency map
Real topics, example scoresThe EU AI Act Expert Role
Role Definition: What an EU AI Act Expert Does (and Doesn't)
The Act created the profession but never defined it · One sentence is your product · The role touches everything and does nothing alone
Organizational Positioning: Legal, Compliance, IT, or Operations?
Position determines potential; authority mechanisms determine actual power · Article 26(2) makes authority a regulatory requirement, not an organizational preference · Article 17(1)(m) requires an accountability framework
Building Credibility Without Being a Lawyer or Engineer
Credibility is a regulatory requirement, not soft skill decoration · The Credential Stack has four layers and most practitioners stop at two · Artifacts defeat objections that arguments cannot
Career Pathways and Salary Positioning
Credentials are starting gates, not finish lines · Stack, do not collect · AIGP and ISO/IEC 42001 signal literacy and management-system capability respectively; neither certifies delivery
Act Foundations and Current Timeline
Is It an AI System? Article 3 Definition and Guidelines
Article 3(1) is the jurisdictional gate for the entire EU AI Act · The definition is functional and technology-neutral · Inference (Element 5) is the critical discriminator
The Risk Pyramid and Key Principles
The risk pyramid is the Act's core design choice · Four tiers, two cross-cutting tracks · Tier follows purpose and context, not architecture
The Full Phased Implementation Timeline
Article 113 is the master switch · Three legal statuses, not one · Prohibitions are already in force and have been for over 16 months
The Digital Omnibus: Conditional and Long-Stop Delays
The Omnibus is a single, specific instrument · Status precision is a professional competency · The conditional mechanism is gone
Building a Compliance Calendar with Contingency
Article 113 is the planning spine · The Omnibus is agreed, not in force · The Omnibus shifts two phases, not all five
Prohibited AI Practices: The Hard Lines (Article 5)
Article 5 is a flat ban, not a requirements tier · The prohibitions have been in force since 2 February 2025 · Intent is not the only test for manipulation and exploitation
AI System Inventory and Classification
Building Your AI Register: Inventory, Ownership, Governance
The register is infrastructure, not paperwork · Discovery requires four lanes · Two gates before every classification
High-Risk Classification: Annex III and Annex I
Article 6 contains two independent tracks · Annex III contains eight domains, each with intended-purpose sub-entries · The Article 6(3) filter can lower a Track 2 system from high-risk to not-high-risk
Annex I Integration: AI in Regulated Products
Article 6(1) is a two-condition gate, not a single check · The safety component concept includes software · Third-party assessment must be REQUIRED, not merely used
Annex III Deep Dive: The High-Risk Domains
Annex III is a domain-plus-function test, not a sector test · Article 6(2) sets the default: Annex III means high-risk · The Article 6(3) filter is structured and sequential
Limited-Risk and Minimal-Risk: Transparency Duties (Article 50)
Article 50 is behavior-triggered, not risk-tier-triggered · Four independent paragraphs, each with its own trigger, duty, and exceptions · Provider versus deployer is not the same split as in Chapter III
Provider vs Deployer and the Value Chain
"We only buy AI" is not a compliance position · Provider status is about name-on-market, not about who wrote the code · Article 25 has three distinct triggers, each with different operational implications
Third-Party AI Vendor Compliance Assessment
Article 26 is a deployer obligation, not a vendor assignment · A vendor attestation letter is not compliance evidence · Classify before you assess
High-Risk AI Requirements: The Technical File
Risk Management System (Article 9)
Article 9 is a lifecycle engine, not a one-time checklist · The four steps are sequential and interdependent · Foreseeable misuse is a legal obligation, not an optional best practice
Data Governance and Dataset Documentation (Article 10)
Article 10 is a provider obligation, not a data-team practice · Documentation IS compliance · Article 10(6) changes the scope for non-training systems
Technical Documentation: Annex IV (Article 11)
Annex IV is an evidence file, not a form · Three obligations, one article · Nine items, each tied to a Chapter III, Section 2 requirement
Record-Keeping, Logging, and Traceability (Article 12)
Article 12 is a design requirement, not an administrative one · The three-purpose framework of Article 12(2) drives all logging content decisions · Article 12(3)'s specific minimum applies only to Annex III point 1(a) biometric systems
Transparency and Information to Deployers (Article 13)
Article 13 is a design obligation first, a documentation obligation second · The instructions for use are a legally mandated information bridge · Six mandatory categories must be present at a minimum
Human Oversight by Design (Article 14)
Article 14 requires designed, not nominal, oversight · Five capabilities, five design problems · Automation bias is named in the Act, which means it is not optional to address
Accuracy, Robustness, and Cybersecurity (Article 15)
Article 15 is a lifecycle obligation, not a launch checklist · Accuracy is a declared, conditioned commitment, not a single number · "Appropriate level" is contextual, not absolute
Quality Management System (Article 17)
Article 17 requires a system, not a document set · The thirteen elements are an exhaustive minimum · Governance comes first
Fundamental Rights Impact Assessment (Article 27, FRIA)
Article 27 belongs to the deployer, not the provider · Three categories trigger the obligation · The Annex III point 2 carve-out is real but narrow
Assembling the Technical File
Article 11(1) sets three independent duties · A folder is not a file · Date sequencing is the first audit check
Standards and Conformity Assessment
Harmonized Standards and Presumption of Conformity
Article 40 is the primary conformity mechanism, but it requires a published OJ reference · The standards gap is real and is the reason for the Omnibus delay · prEN 18286 is the furthest along the pipeline
Common Specifications When Standards Lag
Article 41 is an exceptional fallback, not an equal alternative · No common specification for AI Act Section 2 requirements exists as of 26 June 2026 · The Article 43 route depends directly on specification availability
Claiming Conformity: What You Can and Cannot Assert
A conformity claim is a legal act, not a label · Three pathways, three different evidential burdens · Coverage mapping is the practitioner discipline
Conformity Assessment Routes (Articles 43 to 47)
The route is determined, not chosen, for most systems · Partial standards application forfeits the Annex VI option · Annex VI is a real assessment, not a rubber stamp
Notified Bodies: Selection and Engagement
The notified body's authority flows from its notification scope · Article 43 creates a narrower notified body requirement than most practitioners assume · In the current no-standard environment, Annex III point 1 providers must use the Annex VII route
CE Marking and the EU Declaration of Conformity
The EU declaration of conformity is the provider's legal assumption of responsibility · Annex V has eight mandatory elements, all required, no exceptions · Machine-readable format is a hard requirement
General-Purpose AI (GPAI) Models
GPAI Definition and Scope (the Chapter V Trigger)
Chapter V is triggered by the model, not the system · Capability governs, not the contract · Four elements, all required
GPAI Transparency and Documentation (Article 53)
Article 53 contains four distinct obligations, not one · GPAI obligations are already in force · The Annex XI and Annex XII audiences are different by design
Systemic-Risk GPAI (Article 55, the 10^25 FLOP Line)
Article 55 is additive, not alternative · The 10^25 FLOP threshold is a presumption, not an absolute rule · Cumulative compute is broader than many providers assume
The GPAI Code of Practice
The Code is a voluntary compliance-demonstration tool, not a regulation · Three chapters, two tiers of applicability · Sign or alternative: the burden always lands on the provider
Downstream Provider Obligations on Top of GPAI
Licensing a GPAI model does not transfer the compliance obligation · Article 25(1) has three separate triggers · The Annex XII documentation is input, not the compliance file
Open-Source GPAI: Exemptions and Boundaries
The exemption is conditional, not categorical · Two duties are never exempt · The label "open source" is not legally operative
Governance, Sandboxes, and SME Support
The AI Office, AI Board, and Enforcement Architecture
The AI Office sits within the Commission and is not a separate agency · The AI Board coordinates but does not enforce · Four bodies form the EU-level architecture
National Competent Authorities and Multi-State Deployment
Article 70 creates the minimum structure, not the actual structure · The single point of contact is your first engagement channel · NCA immaturity is a planning variable, not a safe harbor
Regulatory Sandboxes
The sandbox is not a compliance shortcut; it is a compliance accelerator · Exit documentation is legally recognized evidence · The fine suspension under Article 57(12) is conditional and partial
SME and Small Mid-Cap Provisions and Relief
The Act has a built-in size architecture · The size test is a prerequisite, not an assumption · Article 63(2) is the non-negotiable floor
Real-World Testing Outside Sandboxes (Article 60)
Article 60 is an Annex III-only mechanism · Eleven cumulative conditions, all required before Day 1 · Tacit approval varies by Member State
Codes of Conduct for Non-High-Risk AI (Article 95)
Article 95 creates two distinct functions · The AI Office and Member States are the facilitators, not the drafters · "Voluntary" is not the same as "commercially optional."
Regulatory Interplay and Liability
AI Act and GDPR: FRIA vs DPIA
The FRIA and the DPIA are legally distinct instruments, not alternatives · Article 27 does not apply to all deployers of high-risk AI · The DPIA is data-centric; the FRIA is Charter-wide
Sector Overlap: MDR, IVDR, Financial Services, NIS2 and CRA
Cumulation, not substitution · Article 6 has two pathways · The Section B Annex I carve-out is narrow, not a general exclusion
Product Liability for AI (the Revised PLD)
The Revised PLD explicitly includes software as a product · The evidence gap is closed by design · Three rebuttable presumptions shift the burden
The AI Liability Landscape: Proving Fault When AI Causes Harm
The AILD did not pass · Three layers govern AI liability · The revised PLD explicitly covers software and AI
Contractual Risk Allocation with AI Vendors
Article 25(4) is the regulatory floor, not a negotiating target · The role-shift trigger is contractual by design · Audit rights are not a courtesy, they are the mechanism of proof
Post-Market Monitoring and Enforcement
Post-Market Monitoring (Article 72)
Conformity is a snapshot; compliance is continuous · Three mandatory layers, one plan · The surveillance loop closes at Article 9
Serious Incident Reporting (Article 73)
The clock starts at awareness, not at root cause · Three tiers, not one · Report to the incident-location MSA, not the provider's home MSA
Market Surveillance Authorities and Their Powers
The enforcement architecture is imminent · There is no single EU market surveillance authority for AI · Documentation access is a first-tier right; source code access is a second-tier right with two conditions
The First 72 Hours: AI Incident Response
The clock starts at awareness, not at certainty · The Article 73(5) incomplete-report rule is mandatory, not optional · Three windows, not one: know which clock governs before briefing management
Fines, Penalties, and Enforcement Mechanisms
The three tiers are Tier 1 (Art. 5 violations, up to EUR 35M or 7%), Tier 2 (general operator obligations, up to EUR 15M or 3%), and Tier 3 (incorrect information to authorities, up to EUR 7.5M or 1%) · The "whichever is higher" construction means large companies face percentage ceilings, not fixed ones · SMEs get the lower of percentage or fixed cap
Communicating AI Risk to the Board and Leadership
Board governance is a legal requirement, not a best practice · The SIGNAL-CONTEXT-DECISION framework is the translation engine · Three to five KPIs beat thirty-seven slides
Building Authority: Cross-Functional Influence
Knowledge authority is necessary but not sufficient · Three authority types work together · The ARIA framework is a diagnostic, not a sequence
Operationalizing Article 4: Rolling Out AI Literacy Across Your Organization
Article 4 is one sentence with six moving parts · The obligation has been live since 2 February 2025; supervision starts 2 August 2026 · The July 2026 amendment lowered the ceiling, not the floor
Capstone: The Compliance Portfolio
Assembling the Complete Compliance Dossier
The dossier is not the documentation; it is the architecture · Annex IV gives you nine elements and one narrative · The EU declaration of conformity is the last document signed, not the first
Presenting and Defending Compliance to Executives
The briefing and the dossier serve different audiences · Three questions, one session · The compliance dashboard is the central artifact
Gap Analysis and Remediation Prioritization
A gap analysis is also a compliance artifact · Sort by legal exposure, not by cost · Gap types determine remediation time, not severity
Audit Preparation: Facing the Notified Body
The notified body is evaluating your management system, not just your technical system · Two conformity assessment routes exist under Article 43; which applies depends on the Annex III category and whether harmonized standards are applied · The substantial modification test under Article 43(4) is narrow
Continuous Compliance as the Act Evolves
Regulation (EU) 2024/1689 is designed to evolve · Three monitoring tiers cover three change sources · The Change-Impact Assessment is the expert's core maintenance tool
Final Certification: Integrated Mastery Assessment
Scope before requirements, always · Role determines the obligation set · Evidence over policy language
Ask about this credential
Try it right now. Answers come only from the real program topics a completed credential carries; this is the exact tool an employer gets.
On a real credential the answers narrow to the topics that specific learner passed, with their scores.
Certificate Hash (SHA-256)
sample-credential-no-real-record; a real hash is unique, signed, and verifiable
Free account, no card. The first 7 topics are open.
Demonstration record, shown so anyone can see and test what a finished GAGE credential looks like before earning one. The program, its modules and its topic titles are the real shipped course. The learner and the scores are illustrative and describe no actual person. A credential earned on GAGE carries a signed, permanent verification link that resolves to that learner’s own record. Verify a real credential.