ISO & Compliance · Tracker
Regulatory Change Tracker — every effective date that matters.
ISO 42001, the EU AI Act and the EU Cyber Resilience Act are moving on different clocks. This tracker consolidates the dates so you don't have to cross-reference three separate articles to find them.
No form required. This tracker is free to read and reference directly from this page — dates are tracked here as regulations evolve, so bookmark rather than download a static copy.
ISO/IEC 42001 — AI Management System
| Status | What it means | Applies to |
|---|---|---|
| Published | ISO/IEC 42001 is the first certifiable international standard for an AI Management System (AIMS), covering governance, risk management and lifecycle controls for AI. | Organizations that develop, provide or significantly use AI systems. |
| Ongoing | Certification is voluntary but increasingly requested in enterprise procurement and vendor due diligence for AI-enabled products. | Vendors selling AI-enabled products into regulated or risk-sensitive buyers. |
EU AI Act — phased obligations
| Phase | What it requires | Applies to |
|---|---|---|
| Feb 2025 | Prohibited AI practices banned; AI-literacy obligations begin for providers and deployers. | Any organization placing AI systems on the EU market or using them in the EU. |
| Aug 2025 | Obligations for general-purpose AI (GPAI) model providers take effect — transparency and technical documentation duties. | Providers of general-purpose AI models used in or affecting the EU. |
| Aug 2026 | The fullest obligations apply to high-risk AI systems — conformity assessment, risk management, human oversight. | Providers and deployers of AI systems classified high-risk under the Act. |
EU Cyber Resilience Act (CRA)
| Phase | What it requires | Applies to |
|---|---|---|
| Sept 2026 | Reporting obligations for actively exploited vulnerabilities and severe incidents begin to apply. | Manufacturers of products with digital elements sold in the EU. |
| Dec 2027 | Full application of the CRA's cybersecurity requirements, including conformity assessment for in-scope products. | Manufacturers, importers and distributors of products with digital elements in the EU. |
Frequently asked questions
Do these regulations apply if we're not based in the EU?
The EU AI Act and Cyber Resilience Act apply based on where products and AI systems are placed on the market or used — not where the provider is headquartered — so a non-EU organization selling into the EU can still be in scope.
Does ISO 42001 certification satisfy EU AI Act obligations?
It can support compliance by demonstrating a structured AI governance process, but it isn't a substitute for the Act's specific legal requirements — treat the two as complementary, not interchangeable.