EU AI Act · Regulation (EU) 2024/1689
EU AI Act compliance with ISO 42001 as your base.
The AI Act sets obligations based on risk and on your role as provider or deployer of AI. ISO 42001 gives you the management system to organise and evidence them. Basenorm brings both together on one control library.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Type
- EU regulationIn force since 1 August 2024
- Approach
- Risk-basedProhibited, high-risk, transparency and minimal risk
- Roles
- Provider and deployerObligations differ per role
- Management system
- ISO 42001Helps, but gives no presumption of conformity
01 / What the AI Act asks
What the AI Act
asks of you.
What applies to you depends on your role and on the risk category of each AI system you develop or use.
- 1Prohibited practices
Certain AI practices are banned, such as social scoring. Applies since 2 February 2025.
- 2AI literacy
Providers and deployers take measures to support AI literacy among their staff. Applies since 2 February 2025; the Digital Omnibus of 2026 softened the wording.
- 3High-risk AI systems
Risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness.
- 4Deployer obligations
Use high-risk systems according to the instructions, assign human oversight and monitor operation.
- 5Transparency
Inform people when they interact with an AI system or see AI-generated content, in the cases the regulation defines.
- 6General-purpose AI models
Documentation and transparency obligations for providers. Applies since 2 August 2025.
Classify each AI system and record your role before you decide which obligations apply.
02 / With ISO 42001
The AI Act on your AI management system.
| Topic | Your ISO 42001 AI management system | What the AI Act adds |
|---|---|---|
| Risk management | AI risk assessment and treatment | A risk management system across the life cycle of each high-risk system |
| Impact | AI system impact assessment | A fundamental rights impact assessment for certain deployers |
| Data | Controls for data for AI systems | Data governance requirements for training, validation and test data |
| Human oversight | Controls for responsible use | Human oversight measures built into high-risk systems and their use |
| Quality management | Clauses 4 to 10 of the management system | A quality management system for providers, to be detailed in prEN 18286 |
ISO 42001 is not a harmonised standard under the AI Act, so certification alone does not give a presumption of conformity.
03 / Key dates
REGULATION (EU) 2024/1689The AI Act
step by step.
The obligations apply in phases. The Digital Omnibus moved the dates for high-risk AI systems.
Read about ISO 42001In force. The regulation entered into force.
Prohibitions and AI literacy. Prohibited practices and the AI literacy obligation apply.
General-purpose AI. Obligations for providers of general-purpose AI models apply.
prEN 18286 expected. Target date for the harmonised standard for the quality management system.
High-risk AI, Annex III. Obligations start to apply for most high-risk systems.
High-risk AI, Annex I. Obligations for AI in products covered by sectoral legislation.
Dates according to Regulation (EU) 2024/1689 as amended by the Digital Omnibus. The prEN 18286 date is a CEN-CENELEC target date.
04 / In Basenorm
How Basenorm supports you.
Unified Control Library
See which ISO 42001 and ISO 27001 controls support your AI Act obligations.
02Governance Graph
Connect AI systems, roles, risks, impact assessments, controls and owners.
03AskNorman
Ask what is still open for the AI Act, in Basenorm or via MCP from ChatGPT, Claude or Perplexity. You review the evidence yourself.
05 / Questions
Questions about
the AI Act.
Does the AI Act apply to us?
If you develop, place on the market or use AI systems in the EU, it probably does. Your obligations depend on your role, such as provider or deployer, and on the risk category of each system.
Does ISO 42001 make us AI Act compliant?
No. ISO 42001 is not a harmonised standard under the AI Act, so certification alone does not give a presumption of conformity. It does give you the management system to organise and evidence your obligations.
Which AI systems are high-risk?
AI systems used as safety components in products covered by EU product legislation (Annex I), and systems in areas listed in Annex III, such as employment, education, credit scoring and access to essential services.
When do the high-risk obligations apply?
For most high-risk systems in Annex III from 2 December 2027, and for AI in products under Annex I from 2 August 2028, following the Digital Omnibus.
Does Basenorm classify our AI systems?
No. Basenorm helps you record AI systems, roles and assessments, and links them to controls and evidence. The classification is your decision.
Book a demo
Prepare for the AI Act with ISO 42001.
In a demo we look at your AI systems, your role and your next step.
- Which AI systems and roles are in scope.
- What ISO 42001 covers and what the AI Act adds.
- How you manage controls and evidence for both.
Hosted in the Netherlands. Your data stays in the EU.