Skip to content
Skip to content

L4-M5 / lesson 1 of 2

Distinguish law, standards and certification

A company offers an AI product to a financial institution.

10–15 min · 0/4 steps complete

Start here / A workplace decision

A certificate is one piece of a wider roadmap

A company offers an AI product to a financial institution.

The roadmap contains one task: obtain an ISO certificate.

Before you read / Think it through

In “A certificate is one piece of a wider roadmap”, what would you check or do first?

Pause and form your answer, then compare the reasoning. This reflection is not scored.

Compare the reasoning

Identify the actual applicable laws, product route and contractual requirements.

The ideas below give you a method for this decision. Then work through the rest of this case and try the decisions yourself.

Part 1 of 4 Learn the ideas
0 of 5 read

Law standards and frameworks

Regulations impose requirements within their scope.

Standards can specify ways of meeting requirements.

In the workplace

Separate a mandatory legal duty from a useful engineering method. The same control may support several duties without proving all of them.

Remember this

Voluntary frameworks support practice but do not replace legal analysis.

The workplace case
YOUR CASE / STANDARDS AND OTHER EU LAWS

A company offers an AI product to a financial institution and plans to reuse it in a connected industrial device. Its roadmap contains a single task called obtain ISO certification. The team assumes this will satisfy the AI Act, DORA and cybersecurity rules. It has not identified the product routes, contractual evidence or phased application dates.

Quick reference / five key ideas
Law standards and frameworks
Voluntary frameworks support practice but do not replace legal analysis.
Harmonised standards and presumption
Presumption covers only the requirements actually covered.
Common specifications and alternatives
Justify an alternative technical solution where the law permits it.
Management-system certification
Maintain system-specific conformity evidence separately.
GDPR and the AI Act
Coordinate impact assessments, rights and safeguards where applicable.