Regulations & Compliance

The three frameworks everyone conflates do three different jobs: the EU AI Act is binding law, NIST AI RMF is a voluntary method, and ISO/IEC 42001 is a certifiable management-system standard. A decision-useful comparison with a side-by-side table, how they stack, and which to adopt by situation.

A milestone-by-milestone tracker of every EU AI Act compliance deadline from entry into force in 2024 through 2028, updated for the Digital Omnibus that deferred high-risk obligations to December 2027 and August 2028. Includes what becomes enforceable on each date, who it affects, a deadline table, what to do before each date, and Article 99 penalties.

The NIST AI RMF is voluntary, US-origin, and now the common backbone for enterprise AI governance worldwide. A practical guide to its two parts, the four core functions (Govern, Map, Measure, Manage), the Generative AI Profile with its 12 GenAI risk categories, how to adopt it, and how it maps to the EU AI Act and ISO 42001.

ISO/IEC 42001 is the first certifiable AI management system standard, and it is fast becoming a procurement expectation. This guide covers what it is, its Annex SL clause structure and PDCA cycle, the 38 Annex A controls and the Statement of Applicability, the companion standards (23894, 42005, 42006), how certification works and what it costs, and how 42001 stacks up against the EU AI Act and NIST.

The complete 2026 guide to the EU AI Act: what it is and why it exists, who counts as a provider versus a deployer, its reach beyond the EU, the four risk tiers with examples, the full compliance timeline after the Digital Omnibus deferral, high-risk obligations, the rules for general-purpose AI, penalties under Article 99, and a practical sequence for getting ready.