AI Control Objectives for Auditing GPAI Systems

Overview

This advanced course provides essential training on auditing general-purpose AI (GPAI) models - versatile systems like large language models that can perform a wide range of tasks. These models present unique challenges, including systemic risks, biases and transparency issues. Effective auditing ensures compliance, mitigates harms and supports trustworthy deployment.

South African organisations already meet GPAI as operators and responsible parties under POPIA: prompts, tickets, CVs and logs sent to a cloud model are processing. King V expects the governing body to oversee that use. Auditing the model is how that file stays current.

Aligned with POPIA, King V, the EU AI Act, ISO/IEC 42001:2023, ISO/IEC 42006:2025 and the GPAI Code of Practice, the course equips participants with practical frameworks to audit GPAI systems across data, model and deployment phases. EU AI Act GPAI duties apply when the organisation is a provider placing a model on the Union market, or when output is used in the Union. They do not replace the local POPIA file.

What You Will Learn

By the end of this course, participants will be able to:

• Audit GPAI use against POPIA conditions, operator contracts, transfers and, where relevant, EU AI Act transparency and systemic-risk measures
• Apply ISO/IEC 42001 and ISO/IEC 42006 standards for consistent auditing and certification of AI management systems
• Implement best practices such as the GPAI Code of Practice, automated evidence collection and continuous assurance
• Develop audit strategies that balance regulatory compliance, ethical considerations and innovation support
• Manage systemic risks, copyright compliance and data dependencies in GPAI deployments

Course Structure

The course covers key auditing phases including Foundational Planning, Deployment Strategy, Provider Engagement, Risk Analysis, Security, Traceability, User Interaction, Procurement and Infrastructure Acceptance - supported by real-world examples, including South African responsible-party and operator roles.