Direct answer: the EU AI Act's high-risk obligations have been postponed, but not cancelled. Under the AI Digital Omnibus (adopted by the Council of the EU on 29 June 2026, published in the Official Journal on 24 July as Regulation (EU) 2026/1744, in force from 27 July), stand-alone high-risk AI systems apply from 2 December 2027, and AI systems embedded in regulated products from 2 August 2028. What moved is the deadline; the work did not shrink, and ISO 42001 is the management system you can build now.
Application timeline
| Date | What takes effect |
|---|---|
| February 2025 | Prohibited AI practices |
| August 2025 | Obligations of general-purpose AI model providers |
| August 2026 | Article 50 transparency obligations (some labelling obligations deferred to December 2026) |
| 2 December 2027 | Stand-alone high-risk AI systems (Annex III, such as recruitment, credit scoring, education) |
| 2 August 2028 | High-risk AI embedded in regulated products (Annex I, such as medical devices, machinery) |
What to budget
AI system inventory and risk classification, building the ISO 42001 management system, technical documentation and human-oversight design for high-risk systems, consulting, and certification.
AI governance runs through the other compliance work
- Products with AI (CRA): Article 12 of the CRA gives high-risk AI products that comply with the CRA a presumption of conformity with Article 15 of the AI Act for the cybersecurity part; accuracy and robustness still follow the AI Act. Estimating a CRA budget
- Automotive supply chain (TISAX): using AI tools on customers' confidential or prototype data falls within the information-security scope assessed under TISAX; ISO 42001 adds governance of AI use. TISAX timeline
- Personal data (ISO 27701, GDPR): training or operating AI on personal data is still subject to the GDPR; high-risk AI must also meet the data-governance requirements of Article 10 of the AI Act. ISO 27701 and ISO 42001 can be integrated into one system. ISO 27701 budget
How the three disciplines divide the work: legal compliance determines the risk class and the role (provider or deployer) under the AI Act; process builds the AI management system, impact assessment and human-oversight procedures under ISO 42001; technology handles data governance, model testing, and bias and robustness validation. Engaging only an AI technical team usually leaves two gaps: the basis for risk classification and auditable management records.
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.