Insights
Practical playbooks on the EU AI Act, ISO 42001, NIST AI RMF, SOC 2 and GDPR, and the operational realities of running ML systems in regulated environments.
Most teams that already hold 27001 treat 42001 as a second programme with its own audit, its own evidence and its own calendar. Most of that duplication is avoidable, and the part that is not is worth knowing precisely.
The Digital Omnibus moved high-risk obligations to December 2027, and a lot of teams read that as an extra year. Three obligations did not move, and two of them are already enforceable.
Transparency obligations became enforceable on 2 August. The requirement is short to read and awkward to evidence. Here is what we see teams actually needing.
CEN/CENELEC published the first European standard written specifically for the AI Act. If you already run an ISO 42001 management system, most of the work is mapping rather than building.
SB 26-189 repealed SB 24-205 before it ever took effect. The impact assessments and the NIST/ISO affirmative defence are gone, replaced by a notice-and-explanation regime from January 2027.
NIST’s AI Agent Standards Initiative is targeting identity, authorisation, and logging. The interoperability profile is not expected until Q4. Here is how to govern agents in the meantime.
The Commission published its first draft guidance on high-risk classification in May. Classification decides which obligations attach and by when, so the decision needs a paper trail either way.
NIST published a concept note in April setting the direction for a Trustworthy AI in Critical Infrastructure profile, part of a broader move from foundational guidance to sector-specific material.
Auditors increasingly expect timestamped evidence collected at the moment of change. Here is the architecture we recommend for evidence-as-code.
Most teams certify against one framework, then rebuild the evidence for the next. The overlap is large enough that this is avoidable if you bind evidence to systems rather than to frameworks.