AI Governance Made Practical: Watch the EU AI Act Masterclass

On Tuesday 20 October, Technology Ireland Digital Skillnet members joined Alan Thornton of AI Certified for AI Governance Made Practical, an online masterclass on what the EU AI Act means for organisations, and how to turn its requirements into governance that works day to day.

Why it matters

The EU AI Act is the world’s first comprehensive law on artificial intelligence, and the penalties are significant. Using prohibited AI practices can lead to fines of up to €35 million or 7% of global turnover, and breaches of the high-risk rules up to €15 million or 3%. Both are above the GDPR maximum of €20 million or 4%.

Alan was clear that the Act regulates how AI is used, not the technology itself. The same tool can be low risk in one setting and high risk in another. His rule of thumb: if AI touches hiring, the workplace or credit decisions, treat it as high risk, and there are no exceptions for pilots.

He also cautioned organisations that buy AI rather than build it. Using an off-the-shelf system doesn’t hand your obligations to the vendor. As the “deployer”, you remain responsible for following the provider’s instructions, governing the data you feed in, ensuring real human oversight and keeping system logs.

A five-step framework

Rather than focusing on legal theory, Alan walked attendees through a practical framework:

• Understand: find out where AI is already in use, including “shadow” use, and build an inventory that records each system’s purpose, data, supplier and a named accountable owner.
• Assess: classify each system by risk, from prohibited practices through high-risk uses to tools that only need transparency.
• Act: before a high-risk system goes live, complete a fundamental rights impact assessment, set up trained human oversight, and inform employee representatives.
• Evidence: keep the records. Deployers must keep high-risk system logs for at least six months, because in an audit, governance that wasn’t recorded didn’t happen.
• Monitor: deployment is the start of compliance, not the end. Track accuracy and bias over time, re-check vendor updates, and be ready to report serious incidents and suspend a system quickly.

From theory to practice

A recruitment case study brought the framework to life. Alan compared a common but risky approach, pasting candidate CVs into a consumer AI tool and asking it to rank applicants, with a governed process. In the governed process, personal details are removed, a recruiter reviews every decision before anyone is rejected, and a full audit trail is kept. The difference, Alan noted, is that the compliant approach creates evidence that will stand up to scrutiny, without slowing the process down.

He closed with a 30–60–90 day plan for leadership teams:

• Days 1–30: map where AI is in use, build a central inventory and stop any prohibited uses.
• Days 31–60: update vendor contracts and roll out impact assessments for HR and operations.
• Days 61–90: put log retention in place, train named reviewers and set up quarterly governance reviews.

The session ended with a focused Q&A, with Alan answering questions submitted by attendees in advance.

The slides from the deck can be viewed here.

Share your feedback
If you attended, we’d love to hear what you thought. Your feedback helps us plan future events for our members.
 

Continue your AI journey with Technology Ireland Digital Skillnet

Leading AI Strategy, delivered with Trinity College Dublin, is a two-day programme for functional, operational and technology leaders who want to turn AI uncertainty into AI advantage. The next programme runs on 16 and 27 November 2026.
Find out more about Leading AI Strategy

AI Personal Accelerator, delivered by Barry O’Reilly, is a short, focused programme for senior leaders: 90 minutes a week over three weeks, building your own practical AI capability. Cohorts start on November 3rd and November 24th 2026.
Find out more about the AI Personal Accelerator