EU AI Act enforcement begins, and what ISO 42001 does about it

Obligations on providers of general-purpose AI models took effect in August 2025, and European Commission enforcement of them began on 2 August 2026. Models already on the market before August 2025 have until August 2027. Transparency rules apply from August 2026, with a further window to December 2026 for machine-readable marking of generative output under the AI Omnibus agreement.

Source: Cloud Security Alliance — EU AI Act, prEN 18286 and ISO 42001

What the Act asks for

Technical documentation maintained rather than written once. A published summary of training data. Policies that address the risks the model actually presents. Notification to the AI Office where a model carries systemic risk. For high-risk systems, a quality management system is required outright.

Where ISO 42001 fits, and where it does not

ISO/IEC 42001 maps directly onto seven articles: risk management, data governance, technical documentation, record-keeping, transparency, human oversight and the quality management system requirement. Building the management system and then mapping it to the legal duties is a far more tractable project than reading the Act and starting from nothing.

What it is not is compliance. A certificate to ISO 42001 is evidence of a governed approach; it is not a defence, and no honest consultancy will tell you otherwise. The Act's obligations are legal, they attach to roles — provider, deployer, importer — and the first question is which of those you are, not which standard you hold.