The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases. Bans on prohibited AI have applied since 2 February 2025; governance and general-purpose AI (GPAI) obligations since 2 August 2025; the transparency rules since 2 August 2026; and, since the Digital Omnibus on AI (Regulation (EU) 2026/1744), the Annex III high-risk rules apply from 2 December 2027. High-risk systems embedded in already-regulated products have until 2 August 2028.
The EU AI Act does not switch on all at once. It entered into force on 1 August 2024, but its obligations phase in over roughly four years so organisations can prepare against a known calendar. The single date that matters most for compliance leaders is now 2 December 2027, when the Annex III high-risk obligations become applicable after the Digital Omnibus on AI (Regulation (EU) 2026/1744) moved them from 2 August 2026.
2 February 2025: prohibitions on unacceptable-risk practices (Art. 5) and AI-literacy duties (Art. 4) apply. 2 August 2025: obligations for general-purpose AI models, the governance architecture (the AI Office and national authorities) and the penalty regime take effect. 2 August 2026: general application of the Regulation, including the Art. 50 transparency duties for systems such as chatbots and synthetic media. 2 December 2027: the Annex III high-risk system requirements apply. 2 August 2028: the deadline for high-risk AI embedded in products already covered by EU harmonised legislation (Annex I).
Treat 2 December 2027 as the working deadline for any Annex III high-risk use case: recruitment, credit scoring, critical infrastructure, biometric identification and similar. Reaching it on time means an AI inventory, a risk classification per system, a conformity-assessment route, technical documentation and post-market monitoring all need to be in place beforehand, work that typically takes several quarters.
Expert view: the Act rewards organisations that build a management system rather than a one-off project. Mapping AI Act controls onto an ISO/IEC 42001 AI management system lets you demonstrate governance once and reuse the evidence across regulators, the same discipline CISOs already apply to ISO/IEC 27001.
The deadlines are fixed, but the workload is driven by how many high-risk systems you operate. Start the AI inventory now: most organisations discover more in-scope systems than they expected once they include vendor and embedded AI.
This ISO/IEC 42001 Lead Implementer course trains professionals to design and deploy an Artificial Intelligence Management System that stands up to regulatory, ethical, and operational scrutiny.
View courseThis training is designed for professionals who must structure, operate, and defend an information security risk management process aligned with ISO/IEC 27005:2022. Participants work through the full risk lifecycle, from context definition to treatment decisions and executive reporting.
View courseThis course prepares participants to manage, govern, and scale AI initiatives aligned with business objectives. It addresses growing pressure to control AI risks, ensure transparency, and deliver measurable value from AI investments. Participants evaluate AI opportunities, structure governance, design dashboards, and automate workflows using no-code tools. Abilene Academy teaches through real case execution, Power BI and n8n labs, and exam-focused coaching led by active consultants. It is designed for AI project managers, business leaders, compliance professionals, and transformation leads.
View courseOften, yes. Switzerland is not in the EU, but the EU AI Act has extraterritorial reach: it applies to Swiss providers and deployers whose AI systems are placed on the EU market or whose outputs are used within the EU (Art. 2). Swiss firms serving EU customers must comply, and Switzerland is separately preparing domestic AI rules aligned with the Council of Europe AI Convention.
The EU AI Act applies to AI systems placed on the EU market, put into service there, or whose outputs are used in the EU, wherever the company is based. Applicability is decided per system and per use case.
A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority. One organization can hold both roles for different systems.
Identify AI risks through lifecycle analysis: data risks (bias, quality), model risks (drift, overfitting), deployment risks (adversarial attacks, misuse), and operational risks (feedback loops, unintended impacts).
AI risks are dynamic, probabilistic, and context-dependent. Unlike static IT systems, AI models degrade over time, produce unexpected outputs, and fail in ways difficult to predict or test comprehensively.
The exam is domain-based, covering AI risk concepts and regulations, governance, identification and analysis, evaluation/treatment/monitoring, and organizational learning and performance improvement.
It's designed for risk owners, IT/security teams, data and AI engineers, consultants, legal/ethical advisors, leaders overseeing AI deployments, and executives needing strategic oversight of AI risk.
ISO/IEC 42006 changed who can certify you, ISO 19011:2026 changed how the audit runs, and the Omnibus moved the AI Act deadlines. What an AIMS audit demands, evidence by evidence.
ISO 27001 gives you a head start on ISO 42001, not a free pass. Here is what carries over, what is new, and how to extend your ISMS to an AIMS, step by step.
Browse all FAQs →
Full knowledge base
Necessary cookies are always active. You can accept, reject non-essential cookies, or customize your preferences.