Review EU AI Act concepts relevant to the intended use case

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R32 — EU AI Act official portal

   R31 — NIST AI RMF crosswalks

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Review EU AI Act risk tiers (Unacceptable, High-Risk, Limited/Transparency, Minimal) and GPAI obligations relevant to your three flagship projects.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Write a clear architectural boundary note separating legal/regulatory applicability questions (which require legal counsel) from verifiable engineering controls (provenance, human oversight, accuracy/robustness metrics, logging).

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   EU AI Act engineering-control alignment note (without making false legal compliance claims).

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R31NIST AI RMF 1.0↗ nist.gov

  Govern, Map, Measure, and Manage functions; risk ownership, measurement, and lifecycle documentation.

• R32EU AI Act Official Portal↗ artificial-intelligence-act.ec.europa.eu

  Risk-based regulatory tiers, high-risk system obligations, and GPAI transparency/cybersecurity rules.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsNIST · 48-page framework (NIST AI 100-1)
  AI Risk Management Framework

  The primary text for the four functions — Govern, Map, Measure, Manage — and the subcategories that assign risk ownership and lifecycle documentation, which is exactly the vocabulary you need before tiering P1–P3 under the EU AI Act.

  R31checked 2026-11-11
• videoEU Made Simple · 5 min
  The EU's AI Act Explained

  Walks the four-tier pyramid (unacceptable, high-risk, limited/transparency, minimal) and what each tier changes in practice, giving the fast orientation pass before you classify your three flagship projects.

  R32checked 2026-11-11
• videoACM FAccT Conference · 92 min
  Tutorial 2: Using the NIST AI Risk Management Framework

  A chaptered academic tutorial that moves from framework overview into mapping, measuring, and managing AI risks with worked examples, useful for turning the RMF functions into concrete review artifacts rather than a checklist.

  R31checked 2026-11-11
• articleSnowflake · 12 min read
  What Is the EU AI Act? Risk Tiers, Deadlines & Compliance

  Lays out tier-by-tier obligations next to the GPAI baseline duties and the systemic-risk 10^25 FLOP presumption, so you can see which of your projects inherits provider versus deployer duties.

  R32checked 2026-11-11
• docsEU AI Act (euaiact.com) · 10 min read
  Key Issue 3: Risk-Based Approach

  Explains how the Act moved from a binary low/high-risk split to a four-tier scheme with a separate GPAI regime, which is the precise structural point Day 99 asks you to apply to your intended use cases.

  R32checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.