AI compliance: GDPR and AI Act

One day to review your use of AI against the GDPR and EU Regulation 2024/1689 (the AI Act), article by article. You leave with 7 working documents, including the inventory of your systems, an entry for your record of processing activities, your AI use policy and your 30-day action plan.

1 day, 7 hours In person, remote or hybrid Executives and decision-makers
Quote or registration See the program
A pair of colleagues review a printed document together, with a closed folder at hand

This training course is designed for:

The executive with no inventory

Their teams have installed AI tools that were never inventoried, and the executive is the one who answers for the company.

The compliance officer

They have kept the record of processing activities for years and are looking for a way to bring the AI features of their business software into it.

The HR director who is hiring

They have turned on automatic screening of job applications and want to know what the regulation requires of a tool like that.

AI compliance: GDPR and AI Act

Learning objectives

The learning objectives of this training course can be assessed. By the end of the session, each participant is able to:

  • Determine their organization's role under EU Regulation 2024/1689, provider (Article 3, point 3) or deployer (Article 3, point 4), for each AI system in use
  • Build an inventory of the AI systems used in the organization and classify them under the regimes of Articles 5, 6 and 50 and Annex III of EU Regulation 2024/1689
  • Build the AI literacy plan required by Article 4 of EU Regulation 2024/1689 and define the evidence that shows it has been carried out
  • Fill in an entry in the record of processing activities that meets the requirements of Article 30 of the GDPR for a processing operation that uses AI
  • Determine the legal basis for a processing operation under Article 6 of the GDPR and assess whether a data protection impact assessment is required under Article 35
  • Write an AI use policy and identify the procedure that makes it enforceable against employees (Articles L. 1321-1, L. 1321-4 and L. 2312-8 of the French Labor Code)
  • Define the internal procedure for human oversight and for reporting and handling incidents involving AI systems
  • Draw up a 30-day compliance action plan with dated deadlines and a named owner for each action

Audience and prerequisites

Target audience. Leaders of small businesses and SMBs, managing directors and CEOs who are accountable for the organization's use of AI. Heads of legal, data protection officers and compliance leads in charge of documenting that use. CIOs, chief information security officers and IT managers. HR directors and department heads who manage the rollout of AI tools to their teams.

Prerequisites. No legal or technical prerequisites. The texts used are opened and discussed in the session, article by article, in their consolidated version. Trainees with no legal background complete all the exercises using the outlines, templates and decision trees provided by the trainer. Knowledge of the organization's activities and access to the people who decide which tools are deployed. A general understanding of personal data protection and of the data protection officer's role. Comfort with everyday digital tools: web browser, spreadsheet, word processor.

Each participant's actual level is checked before the session with a placement questionnaire, which is used to adjust the course outline.

Program

The full outline, sequence by sequence, is in the detailed program you receive before registering.

Define the respective scope of the GDPR and EU Regulation 2024/1689 for the same use of AI. Determine your organization's role for each system in use, provider or deployer within the meaning of Article 3 of EU Regulation 2024/1689.
Classify each inventoried system under the regimes of Articles 5, 6 and 50 and Annex III of EU Regulation 2024/1689. Identify the obligations on the deployer (Article 26) and the cases that call for a fundamental rights impact assessment (Article 27).
Fill in an entry in the record of processing activities that meets the requirements of Article 30 of the GDPR for a processing operation that uses AI. Determine the legal basis for the processing under Article 6 and document the reasoning behind it.
Write an AI use policy covering approved tools, permitted uses and data that must never be entered. Identify the procedure that makes these rules enforceable against employees (Articles L. 1321-1, L. 1321-4 and L. 2312-8 of the French Labor Code).
Draw up a 30-day compliance action plan, with a named owner and a dated deadline for each action. Assess what was learned during the day against the learning objectives.

Want this training for your team?

Answer 3 questions and your estimate appears. We call you back within 48 hours with the quote, the detailed program and possible dates.

Quote or registration

Teaching methods and resources

The course alternates between live demonstrations with commentary, guided workshops and hands-on practice on the participants' real cases. Theory is limited to what you need to put things into practice.

  • A practitioner trainer who works on the topics taught
  • Course materials provided to each participant
  • Each participant works on their own computer with their own files
  • Environment set up in advance and tested before the session

In person

The training takes place at the client's premises. The client provides a room equipped with a projector or screen, an internet connection and one computer per participant.

Remote

The training takes place in a virtual classroom, as a group and live with the trainer, at set times. Participants interact by voice, screen sharing and chat, in both directions and throughout the session. Each participant's login is recorded and serves as proof of attendance. Technical support is available by email and phone for the whole session, and a connection test is offered before the day.

Hybrid

A single session can bring together on-site and remote participants. The trainer leads from the in-person venue, and remote participants follow in a virtual classroom with the same individual support and the same deliverables.

Assessment and certification

  • Placement questionnaire before the training starts
  • Continuous assessment through the exercises produced during the session
  • Final assessment of what was learned against the objectives listed above
  • Satisfaction survey at the end of the session, then a follow-up survey a few weeks later

Each participant receives an end-of-training certificate stating the objectives and the assessment results. A certificate of completion is also sent to the funding body where applicable.

Jessy knows his subject inside out and, above all, shares it passionately with his students. His advice and follow-up will certainly help the CAMPUS 2023 apprentices and the clubs where they work. I very strongly recommend him.
Christophe Peyrat
Christophe Peyrat

Trainer, ADPS

Official title in the training program: “Conformité de l'IA en entreprise : RGPD et règlement UE 2024/1689, construire son cadre d'usage opposable” (AI compliance in business: GDPR and EU Regulation 2024/1689, building an enforceable framework for AI use). Page updated on August 31, 2026.

Jessy Martin in the free mini course on getting started with Claude

Free course to get started with Claude

Judge our teaching before you commit a budget.

  • 1 hour 20 minutes of video in 5 short modules
  • Installing Claude and setting up your workspace
  • 6 ready-to-copy skills and starter files
  • The privacy settings to apply from your first day
  • A selection of 20 AI tools for marketing
Discover the free course

The course videos and emails are in French.

Any questions?

Jessy Martin Academy is a registered training provider [a status declared to the French State], which lets your company charge the cost to its skills development plan [the training plan a French employer funds from its own budget]. Funding from an OPCO [French skills operator that funds employee training] also requires Qualiopi certification [France's quality certification for training providers], which is in preparation.
The time between your request and the start date is set during the scoping call and appears in the training agreement [the contract French law requires between a company and its training provider]. Allow 15 days minimum, more if an external funder is involved.
Yes. That's exactly what the scoping call is for: the outline is adjusted to your industry, your tools and the participants' actual level, checked with a placement questionnaire before the session.
Let us know in our very first conversation. Together we look at adjustments to materials, pace, duration or assessment. The details are on our quality page.
No. The trainer quotes the texts, gives their source and puts their consolidated version on screen. The legal assessment of your situation and the approval of the documents produced in the session are the responsibility of your organization, your data protection officer and your legal counsel.
Your relevant internal documents: your record of processing activities if you have one, your application catalog, the contracts and terms of service of your AI tools, your workplace rules and your IT policy. An active Claude Pro or Max subscription is also required for the exercises.

Accessibility · results · complaints

Our quality commitments, our results indicators and the adjustments available to people with disabilities are published on a dedicated page.

See the quality page