Deep-dive lessons.

Four risk tiers, who is covered, what triggers each tier, and when each provision takes effect.

ICT risk management requirements, incident reporting, third-party register, and resilience testing.

Sector classification, registration thresholds, security measures, and breach notification timelines.

Model risk management under AT 4.3, IT risk under AT 7.2, and how AI-specific guidance is evolving.

IT strategy, operations, outsourcing, and how BAIT interacts with the new AI-related MaRisk addendum.

How BaFin examines AI systems in scope, what evidence they ask for, and how to prepare.

Building an AI management system, the certification path, and how it complements EU AI Act compliance.

Investment firms, the RM/MTF/OTF venue types, algorithmic trading and RTS 6, best execution, and reporting.

Token categories (ARTs, EMTs, other), CASP authorisation, white papers, custody, and the 2024-2026 timeline.

Products with digital elements, product classes, secure-by-design, SBOM, the 24h/72h reporting, and the timeline.

Who is in scope, the six lawful bases, data subject rights, records and DPIAs, the 72-hour breach clock, when a DPO is mandatory, and the fines.