EXIN AI Compliance Professional study plan

Define the scope of AI compliance and distinguish it from adjacent disciplines such as privacy, data governance and model risk management, writing a one-line boundary statement for each

Map the core building blocks of the EU AI Act (risk tiers, prohibited practices, general-purpose AI obligations, timelines) into a dated one-page timeline

Classify ten hypothetical AI use cases into prohibited, high-risk, limited-risk and minimal-risk tiers and justify each classification in one sentence

Identify which obligations fall on providers versus deployers for three of those use cases

Compare the EU AI Act, the OECD AI Principles, the NIST AI Risk Management Framework and ISO/IEC 42001 on scope, legal force and intended audience

Explain how the Council of Europe Framework Convention and national laws (for example China's interim measures for generative AI) differ in regulatory approach

Draft a short comparison memo that states which framework is binding, which is voluntary, and which is certifiable

List the governance roles a framework typically requires (AI governance board, accountable executive, model owner) and match them to frameworks

Build a governance structure for a fictional company: assign decision rights for AI use-case approval, model sign-off and incident escalation

Write a charter for an AI review board including membership, quorum, meeting cadence and escalation path

Translate high-risk obligations into internal policy clauses covering risk management, data governance, technical documentation, logging and human oversight

Identify three gaps between the fictional company's current policy and the drafted clauses

Apply the NIST AI RMF functions (govern, map, measure, manage) to a single high-risk use case end to end

Identify risks across the AI lifecycle: data quality, bias, drift, security, third-party model dependency and human-automation interaction

Select controls for each identified risk and state the control type (preventive, detective, corrective) and owner

Define measurable risk tolerance thresholds for at least two risks

Design a model documentation package covering intended purpose, training data provenance, evaluation results, limitations and known failure modes

Specify logging and monitoring requirements that would detect performance drift and harmful outputs within a defined time window

Draft a bias and fairness testing approach including metric selection, test data strategy and acceptance criteria

Plan a human-oversight design that specifies who reviews what, with what information, and with what authority to override

Design an AI incident management process with severity tiers, reporting timelines, evidence preservation and post-incident review

Map regulatory notification duties for serious incidents and specify who decides to notify and within what deadline

Build a third-party AI vendor assessment checklist covering model provenance, audit rights, subcontracting and change notification

Define key compliance metrics and the dashboard that reports them to the AI review board

Draft an accountability map linking each regulatory obligation to an owner, evidence artifact and review frequency

Design a compliance monitoring and testing calendar covering internal audits, control testing and policy reviews

Explain how to evidence compliance to a regulator or auditor using documentation, logs and test results

Identify three ways an AI compliance programme fails in practice (orphaned ownership, stale documentation, untested controls) and write a mitigation for each

Consolidate all prior deliverables into a single coherent programme narrative and close documented gaps

Complete two timed practice sets weighted by domain and review every incorrect answer against source material

Rehearse explaining tiering, governance structure and risk controls aloud in under three minutes each

List any remaining weak areas and schedule targeted review before the exam