Digital, AI and Cyber Security
Artificial Intelligence
Artificial Intelligence (AI) and Law
The legal and regulatory exposure an organisation takes on when it deploys an AI system, and who carries it.
- Duration
- 5 days
- Contact hours
- 30
- Level
- Intermediate
- Fee from
- US$1,500
Overview
An organisation deploying an AI system acquires obligations it may not have read: for the data it trained on, for decisions the system makes about people, for what it tells customers, and for what a vendor contract actually transfers. Most of the exposure is not new law but existing law applied to a system nobody can fully explain, which is the difficulty. This week covers data protection, automated decision making, rights in training data and output, procurement terms, and the governance a board has to be able to answer for. It is a legal and risk course rather than a technical one.
Who should attend
In house counsel, compliance and data protection officers, risk managers, and the IT and procurement staff who select and contract for AI systems.
What you will be able to do
- Identify the lawful basis for processing personal data in a specific use case, or establish that there is none.
- Apply automated decision making rules to a system that scores or ranks people.
- Assess the intellectual property position of training data and of generated output.
- Read a vendor contract for what it does and does not transfer on liability, data and indemnity.
- Build an approval and record keeping process a regulator or a board could inspect.
How it is taught
Short input, then work, across 5 days of roughly 6 teaching hours each. Exercises run on situations delegates bring rather than on a case study written for a different organisation. Cohorts are capped so that everybody is asked something.
Available as classroom, live online, in house.
Programme outline
Day 1
What the organisation has taken on
- Existing law applied to a system nobody can fully explain
- Where regulators have actually acted, and on what
- Mapping the exposure before writing a policy
- The gap between a published policy and what staff are doing
Day 2
Personal data
- Lawful basis for training and for inference
- Purpose limitation when a model is reused
- Transparency about a system whose reasoning is opaque
- Cross border transfer, and where the processing happens
Day 3
Decisions about people
- Automated decision making and the right to human review
- Bias in a system never told the protected characteristic
- Explaining a decision to the person affected
- Credit, employment and insurance, where scrutiny is highest
Day 4
Rights and contracts
- Rights in training data, and the ones never cleared
- Ownership and protectability of generated output
- Confidentiality when staff paste work into a public tool
- Vendor liability, indemnity, data use and exit
Day 5
Governance that holds
- Approval before deployment, and who signs
- Records a regulator or a board can inspect
- Monitoring a system after it is live
- Responding when a system gets something badly wrong
What you leave with
- A risk assessment for one AI system the delegate's organisation uses or is considering.
- A contract review checklist for an AI vendor, including the clauses to refuse.
- A governance and approval process, written, with decision rights named.
Dates and fees
| Dates | Location | Format | Fee |
|---|---|---|---|
| 23 to 27 November 2026 | Dar es Salaam, Tanzania | Classroom | US$1,500 |
| 30 November 2026 to 4 December 2026 | Nairobi, Kenya | Classroom | US$1,500 |
| 7 to 11 December 2026 | Dubai, United Arab Emirates | Classroom | US$1,500 |
| 14 to 18 December 2026 | Lagos, Nigeria | Classroom | US$1,500 |
Fees are per delegate and cover tuition, all programme materials and the certificate. Travel, accommodation and visas are arranged by the delegate. Registration closes two weeks before a programme starts.
Certificate
A GATI certificate recording what was attended, issued after the programme has run and attendance has been taken. Attending at least 80 per cent of the days earns a certificate of completion; attending less earns a certificate of attendance stating exactly what was attended. Every certificate carries a code that anybody can check against GATI's own record.
It records participation. and GATI does not claim one it does not hold.