The first comprehensive AI law anywhere. It reaches any AI system placed on the EU market, and the high-risk timetable has just moved, which most guidance has not caught up with.
What is the EU AI Act?
The EU AI Act, Regulation (EU) 2024/1689, classifies AI systems by risk. A small set of practices is banned outright. High-risk systems, which include AI used in employment, credit, education, essential services and safety components, carry the bulk of the obligations: a risk management system, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness, and a quality management system.
The high-risk obligations were due to apply on 2 August 2026. They no longer do. The EU Digital Omnibus on AI moved them, with some requirements now applying from 2 December 2027 and others from 2 August 2028. A great deal of published guidance, and a number of vendor readiness offers, still quote the August 2026 date. Planning against a date that has moved wastes budget in both directions.
ISO 42001 is the practical route in. It maps onto seven of the Act\u2019s articles, covering risk management, data governance, technical documentation, record keeping, transparency, human oversight and the quality management system. It is not equivalence: certification to ISO 42001 does not make you AI Act compliant, and the Act reaches obligations the standard does not address. It does mean most of the management system you need is a standard you can already certify against.
Compliance requirements
The obligations below sit with the provider of a high-risk system. Deployers carry a lighter but real set of their own.
A continuous, documented process running across the whole lifecycle of the system, not a one-off assessment at launch.
Training, validation and testing data sets must be relevant, representative and, as far as possible, free of errors, with bias examined and addressed.
Drawn up before the system goes on the market and kept current, in enough detail for an authority to assess conformity.
Automatic logging of events across the lifetime of the system, sufficient to trace how a given output was reached.
Deployers must be given what they need to interpret the output and use the system properly, including its known limitations.
Designed so a person can understand the output, override it, and stop the system. Oversight has to be possible in practice, not only on paper.
Appropriate levels declared and maintained, including resilience to attempts to manipulate the system or its training data.
A documented QMS covering the whole compliance programme. This is the obligation ISO 42001 most directly answers.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We catalogue every AI system you build, buy or embed, and classify each against the Act’s risk tiers. Most of the work is deciding what is actually in scope.
Provider and deployer carry very different obligations, and buying a model then fine-tuning it can move you from one to the other.
We assess each high-risk system against the articles that apply to it, and separate what is required now from what is required in 2027 and 2028.
Your compliance manager implements the risk management and quality management systems, built on ISO 42001 so the work produces a certifiable asset rather than a file of evidence.
We produce the documentation, logging design and instructions for use in the form a conformity assessment expects.
We prepare the conformity assessment and, where the system is high-risk, the EU database registration and CE marking.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone