Regulation
The EU AI Act sets the duties. Your AIMS keeps the proof.
Brussels wrote the obligations; ISO/IEC 42001 gives you a way to run them week after week. The EU AI Act (Regulation (EU) 2024/1689) decides what you owe from two facts: your role and the risk tier of each system. An AI management system (AIMS) is a practical place to produce, store and refresh the evidence. This page follows the Act in the order a company meets it, and marks where the standard helps and where it stops.
Back to ISO 42001 services01 · Does it reach you
Start with reach: the Act follows the market, not your address
Where your office sits is rarely the deciding fact.
Article 2 sets the territorial reach. A company that sells or switches on an AI system in the Union is covered wherever it is incorporated. So is a company in India or the US whose system produces output that is used in the EU. Deployers established inside the Union are covered too. Defence uses, pure research and personal, non-professional use sit outside.
- EU sign-ups. People in a member state can create an account and use your AI feature.
- Output exported. An EU client takes your model's scores or summaries into its own decisions.
- Resale. A partner relabels or resells your AI tool to European buyers.
- EU staff. An EU subsidiary or team uses AI tools in its daily work.
Any one of these starts the analysis. Whether you are provider or deployer is a separate question, covered by our role emulator.
02 · Sorting systems
Sort every system before you plan a single control
One company can own systems in three different tiers.
| Tier | Illustrative example | What the Act expects |
|---|---|---|
| Prohibited (Article 5) | A tool that reads employees' emotions at work | Switch it off. Outside narrow exceptions written into the article, no control set makes it lawful. |
| High risk (Article 6 with Annex I or III) | A model that ranks job applicants, or a safety part inside regulated machinery | The provider duties of Articles 8 to 17, the deployer duties of Article 26, and for some deployers a fundamental rights impact assessment (Article 27). |
| Transparency (Article 50) | A support chatbot, or a feature that generates images | Tell people they are talking to a machine, and mark synthetic output so it can be detected. |
| Everything else | Spam filtering, stock forecasting | No tier-specific duties. The AI literacy duty of Article 4 still applies, and voluntary codes are encouraged. |
Annex III names the sensitive areas: biometric identification, safety parts of critical infrastructure, admissions and exam grading, recruitment and the management of workers, access to essentials such as credit scoring and life or health insurance pricing, policing, migration and border control, and the administration of justice and elections. Under Article 6(3) a listed system can fall out of the high-risk tier when it only performs a narrow procedural or preparatory task. The provider must write that reasoning down, and any system that profiles people stays high risk.
03 · Dates
A staged calendar, already amended once
Plan to the dates in force. The high-risk dates moved in 2026.
- 20241 August 2024: in forceThe Regulation became law twenty days after it appeared in the Official Journal. Nothing applied yet.
- 20252 February 2025: bans and literacyThe Article 5 prohibitions and the Article 4 duty to build staff AI literacy started to apply.
- 20252 August 2025: model providers and finesDuties for providers of general-purpose AI models, the governance bodies and the penalty regime took effect.
- 20262 August 2026: general applicationThe Act applies generally, and the AI Office and national authorities take up enforcement. The Commission lists the transparency rules for August 2026.
- Dec 2026December 2026: a ninth prohibitionThe amendment adds a ban on AI that generates non-consensual sexual content or child abuse material, including so-called nudification apps.
- Dec 20272 December 2027: Annex III high-risk usesThe high-risk rules for the listed sensitive uses, moved back from the original 2026 date.
- 20282 August 2028: regulated productsThe high-risk rules for AI built into products already covered by EU product-safety laws (Annex I), moved back from the original 2027 date.
The digital omnibus on AI entered into force on 27 July 2026 and moved the high-risk dates. The Commission's AI Act page, updated on 19 October 2026, gives 2 December 2027 for Annex III uses and 2 August 2028 for Annex I products. These dates have shifted before, so recheck that page before you plan around any of them.
04 · Evidence map
Ten pieces of evidence, and where each one comes from
A planning view, not legal advice: what you keep, how the AIMS makes it, which article wants it.
| Evidence you keep | How an AIMS produces it | Article |
|---|---|---|
| A risk file per high-risk system, reviewed on a schedule | The clause 6.1 risk process, fed by impact assessments under A.5 | 9 |
| Records of where training and test data came from and how it was checked | Sourcing records, quality checks and lineage under the A.7 data controls | 10 |
| A technical file on design, purpose and known limits | Life-cycle documentation under A.6, held under clause 7.5 document control | 11 |
| Automatic logs kept long enough to trace what happened | Logging decided during system design, an A.6 life-cycle control | 12 |
| Instructions for use handed to deployers | Information for interested parties under A.8 | 13 |
| Named people who can pause or override the system | Oversight rules under A.9, with roles assigned under A.3 | 14 |
| Test results on accuracy, robustness and security | Verification and validation records in A.6, backed by your security controls | 15 |
| A quality management system | Clauses 4 to 10 cover much of it; items such as post-market monitoring need adding | 17 |
| A monitoring plan and serious-incident reports | Operational monitoring plus the clause 10 nonconformity process, tuned to the Act's reporting clocks | 72 and 73 |
| Chatbot disclosures and labels on generated content | A.8 user information, applied to each customer-facing system | 50 |
05 · Limits
What a certificate cannot do for you under the Act
Good evidence. The legal steps stay separate.
The presumption comes from harmonised standards
Under Article 40, meeting a harmonised standard whose reference is published in the Official Journal lets you presume conformity with the matching duties. ISO/IEC 42001 has not been published that way. The European standards bodies CEN and CENELEC are drafting the standards the Act will lean on.
- It is not the conformity assessment of Article 43, which is done per high-risk system before release.
- It does not register a system in the EU database (Article 49) or let you affix CE marking (Article 48).
- It says nothing about systems left outside your AIMS scope. A narrow scope leaves Act duties untouched.
Fines under Article 99 are tiered. Prohibited practices carry the higher of EUR 35 million or seven percent of worldwide annual turnover. Most other breaches carry the higher of EUR 15 million or three percent, and smaller firms face the lower of the two figures. In sales material, name the certificate and its scope, and leave statements about the Act to counsel.
06 · First moves
A sequence that suits most product teams
Classify first. Build controls second.
- List every AI system you run or sell, including features built on a vendor's model.
- Write down your role for each one, system by system.
- Place each system in a tier and record why, including any Article 6(3) carve-out.
- For anything high risk, use the evidence map above as a gap list.
- Move each gap into the AIMS risk treatment plan so it gets an owner and a due date.
Sources: Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 2 to 6, 8 to 17, 26, 27, 40, 43, 48 to 50, 53, 72, 73, 99 and 113, with Annexes I and III; the European Commission's AI Act policy page on the digital omnibus on AI (updated 19 October 2026); public clause and Annex A titles of ISO/IEC 42001:2023.
Questions teams ask about the AI Act
We have no office in Europe. Why would the Act apply to us?
Because reach follows where the AI or its output is used.
Article 2 covers providers that put AI on the EU market from anywhere, and providers and deployers abroad whose output is used in the Union. An Indian SaaS company with European customers is a typical case.
Will our ISO 42001 certificate replace the Act's conformity assessment?
No. They are different procedures.
Conformity assessment under Article 43 looks at one high-risk system against the Act. Certification looks at your management system against the standard. The second makes the first much easier to prepare, but it does not stand in for it.
Could ISO 42001 become a harmonised standard later?
Not on current plans that we can confirm.
The Commission asked CEN and CENELEC to write European standards for the Act, and those drafts draw on international work. Watch the Official Journal: only a cited harmonised standard gives a presumption of conformity.
We build on a general-purpose model. Whose duties are whose?
The model vendor carries model duties; you carry system duties.
Providers of general-purpose AI models have their own obligations, starting with Article 53. Once you build a product on that model, you are the provider of your system, and its tier decides what you owe.
Where should a team with no AI governance begin?
An inventory with a tier next to each line.
Most teams cannot answer the Act's questions because nobody has listed the AI in use. One inventory, with role and tier per system, also becomes the backbone of your AIMS scope.
Know your tier before the auditors ask.
Our ISO 42001 readiness assessment sorts your systems by tier and turns the Act's duties into AIMS work items. Counsel should confirm how the Act applies to your products and contracts.