Where does AI risk sit on the risk map, and what does the CRO inventory first?
In "other emerging risks" under Article 18 of the principles. The first step is an AI system inventory: list every AI system in the organisation (built and bought), set each one's role under the EU AI Act (provider, deployer, importer or distributor) and its risk tier, and record the reasoning in the inventory.
Even without an EU establishment, a Taiwanese company is in scope if it places an AI system on the EU market or the system's output is used in the EU (Article 2(1)). The principles cover listed companies; companies that are not public companies are not covered and can use them voluntarily.
Our risk matrix only looks at losses to the company. Why is that not enough for AI risk?
ISO 42001 needs two assessments: an AI risk assessment (for the organisation) and an AI system impact assessment (for individuals, groups and society), each with its own method and date. If only revenue and reputation are considered, with no assessment of the effect on individuals and groups, the line auditors follow is broken.
A pricing or eligibility screening system, for example, may cost the company little financially yet disadvantage a particular group of customers over time; that is exactly what a matrix that only counts company losses cannot see. The CRO should add fields for affected groups, possible harm and long-term cumulative effects to the impact assessment.
Who accepts residual AI risk, and what record should the committee see?
Residual risk is accepted in writing by the organisation's accountable manager, stating the conditions, the time limit, and the triggers for stopping use and reassessing; the consultant makes the decision well founded and recorded, but cannot sign for the manager and should not make the acceptance decision.
A line that can be checked: pick any risk and, within 10 minutes, trace it from the assessment to the control, owner, evidence and acceptance record; pick any excluded control and give the reason.
How should EU AI Act penalties and application dates go into impact assessment and KRIs?
Maximum fines (Article 99, whichever is higher; for SMEs, whichever is lower):
| Breach | Maximum |
|---|---|
| Article 5 prohibitions | EUR 35 million or 7% of total worldwide annual turnover |
| Obligations of providers, deployers and others, and Article 50 transparency | EUR 15 million or 3% |
Application dates: the Article 5 prohibitions from 2 February 2025; Article 50 transparency from 2 August 2026; under Regulation (EU) 2026/1744, high-risk obligations now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I products.
With ISO 42001 certification, can we tell the board we comply with the EU AI Act?
No. ISO/IEC 42001:2023 is a certifiable AI management system standard, certified by bodies accredited under ISO/IEC 42006, on a three-year cycle with annual surveillance; but it is not a harmonised standard under the EU AI Act and gives no presumption of conformity. Conformity assessment, EU database registration, an authorised representative and Article 50 transparency are legal procedures a certificate cannot replace.
As of October 2026, the only AI Act harmonised standard published in the Official Journal is EN 18286:2026 (AI quality management system, supporting Article 17).
How long do ISO 42001 and EU AI Act work each take?
As listed on the service pages:
- ISO 42001: usually 4–6 months to certification with ISO 27001 in place, about 6–9 months from scratch. Four phases: scope and inventory (2–4 weeks), risk and impact assessment (3–5 weeks), system build (6–10 weeks), audit and certification (4–8 weeks)
- EU AI Act compliance for high-risk AI: usually 6–9 months; 9–12 months together with ISO 42001 certification
How does Winners Consulting help CROs with AI risk?
- Three core documents: the AI system inventory; the AI risk and impact assessment (covering Article 9, Article 27 and ISO/IEC 42001 at once); the EU AI Act obligation matrix (owner, evidence and due date for each obligation)
- One skeleton: 42001 as the management system base, sharing its skeleton with ISO 27001/27701
- Separate roles: certification by bodies accredited under ISO/IEC 42006; Winners accompanies the audit but does not audit
- Who leads: vice-president and director-level consultants lead personally end to end, never outsourced
ISO 42001 AI management system, EU AI Act compliance, Risk, impact and acceptance. Request a free mechanism diagnosis
How other roles see this service
- CEOEU AI Act and ISO 42001 for the CEO: staff AI use, fines and governance ownership
- CISOCISO guide to ISO 42001: what AI governance shares with ISO 27001
- CTOISO 42001 and the EU AI Act for CTOs: what does AI product development need?
- Product managerISO 42001 for product managers: how do we answer customer demands on AI product governance?
Other services for this role
- ERM for CROs: how do you build the risk map, KRIs and board reporting?
- ISO 22301 for CROs: how do scenarios, RTOs and exercises enter the risk report?
- ISO 37001 for CROs: how do you manage bribery scenarios and overseas exposure?
- Trade secrets for CROs: how do you set leak scenarios, reasonable measures and KRIs?
- ISO 27001 for CROs: how do information and enterprise risk share one scale?
- GDPR for CROs: how to assess fines, intra-group transfers and breach scenarios?
- NIS2 for CROs: how to assess scope, fines and management body duties?
- EU CRA for CROs: how to handle market access risk, reporting and oversight?
- CRO and DORA: where do ICT third-party and operational resilience risks go on the risk map?
- CRO and AI transformation: putting AI risk into the risk map, KRIs and board reports