All services Every engagement has a fixed, published price. Book a strategy call
The EU AI Act sets the legal obligations. ISO 42001 builds the machinery that meets them. How to wire both into your architecture, with the June 2026 omnibus deadlines.
This guide explains how the EU AI Act and ISO 42001 fit together in a real organisation’s architecture: the law that tells you what and when, the standard that gives you how and proof, and the technology estate where both have to become true. It is current to July 2026, which matters more than usual, because the EU adopted its Digital Omnibus at the end of June 2026 and moved the Act’s high-risk deadlines. Most guidance published before then, including the deadline printed in most compliance decks, is now wrong.
The short version. The EU AI Act is law, with obligations arriving in waves: prohibitions and AI literacy since February 2025, general-purpose AI rules since August 2025, and transparency obligations from 2 August 2026. The June 2026 omnibus moved the big one: standalone high-risk AI systems now have until 2 December 2027, and AI embedded in regulated products until 2 August 2028. ISO 42001 is the management system standard that turns those obligations into something operational: an AI register, risk process, controls and evidence. Certifying to ISO 42001 does not automatically make you Act-compliant, but it builds precisely the machinery the Act keeps asking for, which is why the sensible architecture uses the Act as the requirements catalogue and ISO 42001 as the operating system.
The Act entered into force on 1 August 2024 and applies in stages. Here is the timeline as it stands after the omnibus, which the European Parliament endorsed on 16 June 2026 and the Council approved on 29 June 2026.
| Date | What applies | Status |
|---|---|---|
| 2 February 2025 | Prohibited AI practices banned (social scoring, certain biometric and manipulation systems). AI literacy obligations for providers and deployers | In force |
| 2 August 2025 | Obligations for general-purpose AI models: transparency, documentation, copyright policy, and extra duties for systemic-risk models | In force |
| 2 August 2026 | Article 50 transparency obligations: telling people they are interacting with AI, and marking AI-generated and manipulated content | Unchanged by the omnibus. Applies next month |
| 2 December 2026 | End of the grace period for the synthetic content marking duty for systems already on the market before 2 August 2026 | New, via the omnibus |
| 2 December 2027 | Standalone high-risk AI systems (Annex III: recruitment, credit scoring, education, essential services, law enforcement and similar) must comply in full | Moved from 2 August 2026 by the omnibus |
| 2 August 2028 | High-risk AI embedded in regulated products (Annex I: medical devices, machinery, vehicles and similar) | Moved by the omnibus |
Two readings of that table are common and one of them is a mistake. The mistake reads the December 2027 date as relief and schedules the work for late 2027. The correct reading notices that transparency obligations land next month, that buyers and insurers ask about AI governance regardless of enforcement dates, and that sixteen extra months is roughly the time it takes to build AI governance properly instead of theatrically.
ISO/IEC 42001, published in December 2023, is the management system standard for artificial intelligence: an AIMS, in the family of ISO 27001’s ISMS. It uses the same clause structure every management system uses, context, leadership, planning, support, operation, evaluation and improvement, applied to AI: an inventory of AI systems, risk and impact assessment for each, defined roles and accountability, controls drawn from its Annex A, and the audit-and-improve cycle that keeps it all alive. It is certifiable, by accredited certification bodies, on the usual three year cycle. The crucial property for our purposes: it is the only widely recognised framework that turns “govern your AI” from an aspiration into documented, auditable machinery.
| EU AI Act | ISO 42001 | |
|---|---|---|
| What it is | Law, applying to AI placed on or affecting the EU market | A voluntary, certifiable management system standard |
| What it demands | Specific obligations by risk tier, with dates and fines | A working system: inventory, risk process, controls, evidence, improvement |
| Who enforces it | Regulators, with penalties scaled to global turnover | Auditors, with certification granted or withdrawn |
| Its unit of analysis | The AI system and its use case | The organisation and its management of all AI |
| What it cannot do | Tell you how to organise compliance internally | Make you legally compliant by itself |
One honesty note the market tends to blur: ISO 42001 certification is not a presumption of conformity with the EU AI Act. The Act’s formal route to presumed conformity runs through harmonised European standards still being finalised. What ISO 42001 gives you today is the operational substance, the register, the risk assessments, the human oversight roles, the monitoring, that those obligations require in practice, plus independent evidence that the machinery runs. Regulators, customers and insurers all read that evidence the same way: this organisation governs its AI on purpose.
The way to hold both in your head, and in your architecture, is three layers. The obligations layer is the Act: what must be true, for which systems, by when. The management layer is ISO 42001: the processes and records that make obligations routine rather than heroic. The technical layer is your estate: the platforms, pipelines, controls and logs where compliance is physically real. Alignment problems are almost always a missing middle: organisations with a policy (obligations layer) and some technical controls (technical layer) but nothing systematic connecting them, so every new AI use case is a fresh improvisation.
This mapping is the working heart of eu ai act iso 42001 alignment, and it is what our advisory work builds. Each row runs from a legal obligation, through the management system mechanism, to the artefact in your architecture that makes it true.
| Act obligation | ISO 42001 mechanism | Architecture artefact |
|---|---|---|
| Know your AI and its risk tier | AI system inventory with impact assessment per system | An AI register: every system, model and significant AI feature, with owner, purpose, data and classification |
| Transparency (Article 50, from August 2026) | Operational controls and communication procedures | Disclosure patterns in user journeys. Content marking in generation pipelines |
| Human oversight | Roles, competence and defined responsibilities | Named accountable humans per system, with real override and stop authority in the workflow |
| Data and data governance duties | Processes for data quality and management across the AI lifecycle | Data lineage, quality checks and documented training data provenance |
| Record keeping and technical documentation | Documented information, controlled and current | Logging architecture, model documentation, decision records |
| Accuracy, robustness, cyber security | Operational planning, monitoring and measurement | Testing pipelines, performance thresholds, security controls on AI platforms |
| Post-market monitoring and incidents | Performance evaluation, nonconformity and corrective action | Telemetry, drift alerts, an AI incident route that reaches the register and the regulator when required |
Across organisations of very different shapes, the working pattern is consistent, and it is anchored on one artefact: the AI register. Everything else attaches to it. A gateway sits in front of new AI use: any team wanting to adopt, build or significantly change an AI system passes through a lightweight intake that classifies it against the Act’s tiers, records it in the register, and assigns the owner and controls its tier demands. The ISO 42001 cycle then runs on the register: risk assessments refreshed on change, controls verified, monitoring reviewed, and the whole loop producing the documented evidence both an auditor and a regulator would ask to see. The management system’s plan-do-check-act rhythm is not paperwork here. It is the mechanism that keeps the register true as the estate changes underneath it.
Architecture without an operating model is a diagram, so assign the swimlanes. The board owns risk appetite for AI and hears a quarterly report from the register. An AI governance function, one named owner in a mid-size organisation rather than a committee, runs the register, the gateway and the ISO 42001 cycle. Enterprise architecture decides the platforms AI may run on and the patterns it must follow, which is the same placement decision described in our guide to enterprise architecture in the AI era. Delivery teams build inside the guardrails and feed the register. Legal and compliance interpret the Act’s grey areas and own the regulator relationship. The cadence that keeps it alive is modest: a weekly gateway slot, a monthly register review, a quarterly management review as the standard requires.
The omnibus moved the high-risk deadlines. It did not move the market. Article 50 transparency lands on 2 August 2026 for everyone whose systems interact with people or generate content, and the marking duty catches pre-existing systems from 2 December 2026. Enterprise customers were writing AI governance into supplier questionnaires before any enforcement date and have not stopped. UK organisations are in scope whenever their AI reaches the EU market, omnibus or not. So the sixteen months to December 2027 is not a deferral window. It is, almost exactly, the honest duration of doing this properly: a quarter to see and classify the estate, a quarter to stand up the gateway and the management system, and a year of running the cycle so that the December 2027 deadline arrives as a non-event. Organisations that spent the last delay waiting will recognise the alternative.
Days 1 to 30: see. Build the AI register, first pass: every system, model, embedded AI feature and significant AI-using process, with owner and purpose. Classify each against the Act’s tiers, roughly is fine. Most organisations discover they have two to three times more AI than anyone believed, which is the point.
Days 31 to 60: decide how you decide. Stand up the gateway for new AI use. Write the one-page AI policy the management system needs, name the accountable owner, and take the two or three riskiest register entries through a proper impact assessment to learn the method on real cases.
Days 61 to 90: make it evidence. Implement the Article 50 transparency patterns where they apply, wire the register to the incident process, and baseline the ISO 42001 clauses so you know your distance from certifiable. From day 91 the work is a cycle rather than a project.
Scheduling for the deadline. Compliance programmes timed to arrive at enforcement dates arrive late everywhere else: at the customer questionnaire, the insurance renewal, the incident. Policy without a register. An AI policy with no inventory beneath it governs nothing. The register comes first. Assuming ISO 42001 certification equals Act compliance. It does not, and saying so to a regulator would go badly. It is the machinery rather than the verdict. Treating it as an IT project. The Act regulates uses and outcomes, so HR’s recruitment screening tool matters more than most of what IT runs. Fifty improvisations. Without a gateway, every team answers the governance question separately, which is how organisations end up doing this work fifty times badly instead of once well.
Our EU AI Act readiness assessment is £18,000 + VAT, fixed: the register built, every system classified, the gap against both the Act and ISO 42001 documented, and the sequenced plan, in four to six weeks. ISO/IEC 42001 implementation builds the management system itself, and the AI governance services, including the AI Governance QuickScan and the AI Governance Office, run the cycle with you. On the architecture side, EA for Data and AI Platforms makes the placement decisions everything above depends on. Prices are published, which tells you which kind of firm wrote this.
No. Certification is not a presumption of conformity with the Act, whose formal route runs through harmonised European standards still in development. What ISO 42001 builds is the operational machinery the Act’s obligations require, plus independent evidence that it runs, which is why the two are best used together.
Adopted at the end of June 2026, it moved the compliance deadline for standalone high-risk AI systems (Annex III) from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products (Annex I) to 2 August 2028. Article 50 transparency obligations still apply from 2 August 2026, with a marking grace period to 2 December 2026 for systems already on the market.
2 December 2027 for standalone Annex III systems such as recruitment, credit scoring and education tools, and 2 August 2028 for high-risk AI embedded in regulated products such as medical devices and machinery.
Yes, whenever their AI systems are placed on the EU market or their outputs are used in the EU. A UK firm selling AI-enabled services to EU customers is in scope regardless of where the company or the servers sit.
The international management system standard for AI: a certifiable framework of inventory, risk assessment, roles, controls and continuous improvement that makes an organisation’s AI governance systematic and auditable.
Build the management system regardless. Certify when a customer, regulator or market demand makes the certificate worth its audit cost. The machinery delivers the risk reduction. The certificate delivers the proof to third parties.
Article 50 transparency: people must be told when they are interacting with an AI system, and AI-generated or manipulated content must be marked, with pre-existing systems getting until 2 December 2026 for the marking duty. The omnibus did not move this.
With the AI register: every system, model and AI feature, with an owner and a rough risk classification. Every obligation in the Act and every clause of ISO 42001 becomes tractable once that single artefact exists, and impossible while it does not.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance. Based on the EU AI Act as amended by the Digital Omnibus adopted in June 2026, and ISO/IEC 42001:2023. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with the adviser who wrote this guide. A clear view of your exposure, the sensible first step and its published fee.
Talk to a senior adviser
AI Governance
AI Governance