EUniversityProject· about 60 min· server sandbox

Final project: assess an AI system before it goes live

Decide whether twelve AI uses are prohibited, high-risk, limited or minimal, choose the legal basis and find the GDPR principle being broken, split the requirements between provider and deployer, and decide where the human sits in the decision. You write no programs — you fill in answers in a file.

Teaches: The EU AI Act

Requires: Personal data and anonymisationThe GDPR and AIResponsibility and the human in the loop

Theory

The use decides the risk level, not the technology. First check that nothing is prohibited (article 5), then whether the use is listed in annex III (high risk), then whether article 50 requires transparency. GDPR applies in parallel: every processing needs a legal basis and must not break the principles in article 5. For a high-risk system the provider carries the requirements on the system itself; the one using it — the deployer — carries the requirements on how it is used. The bigger and harder to reverse a decision is, the closer to it the human should sit.

Sub-tasks

Classify the risk level — Fill in RISKNIVA for r01–r12 in bedomning.py with prohibited, high, limited or minimal (Swedish answers work too). The cases are described in fall.py.
Legal basis and principles — Fill in RATTSLIG_GRUND (g1–g3) and PRINCIP (p1–p3): which article 6 basis carries the processing, and which article 5 principle is broken?
Who carries the requirement? — The municipality buys the recruitment system in r02. Fill in KRAV (k1–k8) with provider or deployer.
The human in the decision — Fill in GRAD (m1–m4) with in-the-loop, on-the-loop or in-command, and GRANSKNING: is the review meaningful (yes/no), and which measure tests whether it catches errors?

Passes when: ifyllt >= 1

The starter code

runs in an isolated sandbox on the server

"""Din bedömning. Ersätt varje "?" med ett av de tillåtna svaren i fall.py. Ingen programmering behövs.

Your assessment. Replace every "?" with one of the allowed answers in fall.py. No programming needed.
Ett exempel per delprov är redan ifyllt / one example per part is already filled in.
"""

# Delprov 1 — risknivå: otillåten, hög, begränsad eller minimal
RISKNIVA = {
    "r01": "minimal",  # exempel: ett skräppostfilter påverkar ingen enskilds rättigheter
    "r02": "?",
    "r03": "?",
    "r04": "?",
    "r05": "?",
    "r06": "?",
    "r07": "?",
    "r08": "?",
    "r09": "?",
    "r10": "?",
    "r11": "?",
    "r12": "?",
}

# Delprov 2a — rättslig grund: samtycke, avtal, berättigat intresse, rättslig förpliktelse eller allmänt intresse
RATTSLIG_GRUND = {
    "g1": "?",
    "g2": "?",
    "g3": "?",
}

# Delprov 2b — vilken princip bryts?
PRINCIP = {
    "p1": "ändamålsbegränsning",  # exempel: data samlades in för ett syfte och används för ett annat
    "p2": "?",
    "p3": "?",
}

# Delprov 3 — vem bär kravet: leverantör eller tillhandahållare?
KRAV = {
    "k1": "?",
    "k2": "?",
    "k3": "?",
    "k4": "?",
    "k5": "?",
    "k6": "?",
    "k7": "?",
    "k8": "?",
}

# Delprov 4 — var ska människan sitta: in-the-loop, on-the-loop eller in-command?
GRAD = {
    "m1": "in-the-loop",  # exempel: avslaget är stort och svårt att ångra, så en människa fattar beslutet
    "m2": "?",
    "m3": "?",
    "m4": "?",
}

# Är granskningen i GRANSKNINGSFALL meningsfull (ja/nej), och vilken åtgärd mäter om den fångar fel?
GRANSKNING = {
    "meningsfull": "?",
    "atgard": "?",
}

You write the code; tests you cannot see decide whether it holds up. Create a free account to run the lab.

Try the diagnostic Create a free account

Expected results

All visible tests pass and all 32 answers are filled in. The server then marks the assessment with hidden tests. Every prohibited use must be caught, and each part requires at least 80% correct. The course is complete only after a verified full run of this project and all knowledge steps.

Common mistakes

Classifying by technology instead of use; believing emotion recognition at work is merely high-risk — it is prohibited; choosing consent when the data subject cannot say no, such as a pupil or an employee; putting oversight entirely on the provider even though the one using the system must appoint the reviewers; believing a human who approves everything is a review; running only one subtask instead of All.