AI Act and GDPR training: application register and working with data

When does a team need such a workshop

A list of purchased tools often does not answer the question of how employees use their results. The process owner knows the task, IT knows the accounts and connections, and the person preparing the review also needs information about the data and the recipients of the responses. The workshop serves to combine these perspectives into a material that can be checked.

We invite people conducting AI inventory, process owners, and IT representatives. Participation of IOD or legal support is arranged for parts requiring their evaluation. We do not expect the employee of the department to independently determine the legal qualification of the system. They should be able to describe the use and point out the information that is still missing.

The same product, different applications

In a fictional exercise, a company records only the name of the AI assistant in the register. One team edits public service descriptions using it, while another summarizes customer documents. A common row hides the difference in data, access, and the way the result is used.

Participants separate the product description from the application description. The worksheet indicates the purpose, users, process owner, and data sources. It also includes information about who receives the response and whether a person checks it before further use. The empty field remains a question to be clarified; the model does not fill it with a description of a typical action of such a tool.

The facilitator checks whether another person understands what really happens in the process from the card. They pay attention to general statements, such as "company data" or "human oversight." The participant specifies the type of material and the activity of the person checking. The company decides what scope of the register is needed for its reviews; the exercise worksheet is not a universal form required by law.

Where the file goes and who sees the result

The next module concerns data flow. On a fictional document, we track the transfer to the tool, the recording of the result, and the sharing with a colleague. Participants indicate the storage locations and the people responsible for access settings. They separate what follows from the provider's documentation from what they confirmed in their own environment.

The European Commission explains that data allowing the re-identification of a person remains personal data, even after pseudonymization. In the task, replacing a surname with a case number does not close the review: it is necessary to check whether the remaining content or available links still allow identifying a person. For exercises, we can use completely fictional data.

The discussion of service conditions includes distinguishing between model training, material storage, and sharing. Details depend on the product and its features. An example of this distinction is contained in a guide on disabling training and RODO. During the sessions, we do not transfer the settings of one account to all company tools.

Evidence, absence, and the decision-maker

The team prepares a summary of findings with a reference to the source, the date of the check, and the owner of the next step. The provider's declaration, the result of the access test, and the company's decision have different characteristics. The entry "checked" should indicate exactly what was checked and what question remains open.

We also work with changes: a new connection to a disk, an additional group of users, or an expanded purpose of use. The participant indicates which previous findings require a re-evaluation. For questions regarding the supervision of system use and informing recipients, the participant prepares a description of the action and materials for review. The application of Article 26 or 50 of the AI Act to a specific system is evaluated by the appropriate specialist; the model name or the workshop result does not determine this.

Competences matched to roles

The current Commission page on AI competences links actions to the experience of individuals and the context of system use. In the program, the person using the tool practices checking the result and input data. The process owner works on the description of responsibilities and changes, while IT works on documenting access and connections.

We determine the scope of practice before the session. Beginners receive a shorter card and one data flow; more experienced participants work on several applications and conflicting information. We discuss the organization of actions related to Article 4 as part of team preparation. The purchase of a training day is not an assessment of fulfilling the organization's obligations.

Demonstration material and independent task

Demo of the AI usage register shows a historical way of organizing documentation. Its limited set of sources does not cover the entire AI Act and requires updating before use. This is material for critical review: the participant should be able to indicate what the example does not prove. We do not present it as a ready legal assessment or the result of implementation at the client's site.

In the independent task, a changed process appears, for example, a new recipient of the response or a file saved outside the current tool. The participant updates the card, keeps the unanswered questions, and prepares the transfer to the appropriate person. We assess the quality of the description, the link between findings and sources, and the recognition of a change requiring review.

After discussing the comments, the author revises the material. The scope of the summary passed to the team and the potential subsequent session is determined in the offer. We do not have a measure of a lasting increase in competence or the result of a compliance audit of the participant; we describe the proposed way of work and assessment of the exercises.

What to determine before ordering

To prepare, a list of roles and a description of a few applications without confidential documents is sufficient. We agree on the tools allowed for exercises, the format online or at the client's site, the number of groups, and materials. Licenses remain a separate cost. Legal review, register implementation, and access configuration require a separate scope.

Describe who collects information about AI today and what is missing for their evaluation. We will select the team training program and the way of preparing materials. Current prices for service categories are in the price list.

How much does the training cost and when is it returned

Training starts at €1,150 net per day. We calculate the return on one process, without assumptions about the entire company.

According to a study published in Science (2023), the time for writing tasks with ChatGPT decreased by 40%. Therefore, the scenario adopts a cautious weekly hour and checks it with measurement.