Two developments have been running in parallel. The standards bodies produced a certifiable management standard for AI, and legislators produced a patchwork that looks nothing like it from one country to the next. If you run systems that now have models in them, both land on your desk, usually at the point where somebody asks whether you can evidence any of it.
This is a map rather than legal advice. Dates in this area move, as the last few months demonstrated rather well, so check anything load bearing against the current text and a lawyer.
Table of contents
Open Table of contents
What ISO 42001 is
ISO/IEC 42001 was published in December 2023 and is the first international standard describing an AI management system. The abbreviation you will see is AIMS, sitting alongside ISMS for information security and QMS for quality.
It is a management system standard, which matters more than it sounds. It does not tell you whether a particular model is acceptable. It tells you what processes you need in place so that somebody is accountable for deciding: how AI systems get inventoried, how risk and impact are assessed, how data provenance is handled, what human oversight exists, how you monitor systems after release, and how all of that is reviewed. The controls live in its Annex A.
It is certifiable by an accredited body, on the usual three year cycle with annual surveillance. Adoption moved quickly. Several large cloud and model providers hold it, and Saudi Arabia’s data and AI authority certified itself in July 2024, which was an early signal that regulators saw it as the reference point.
Two related documents are worth knowing. ISO/IEC 23894 covers AI risk management as guidance rather than requirements. ISO/IEC 27090, which addresses security threats specific to AI systems, was still at final draft stage in August 2026. When it lands it will be guidance, so it will not by itself create any presumption of conformity with the EU AI Act or the Cyber Resilience Act.
How it fits with ISO 27001
Better than you might expect, because they share a skeleton.
Both follow the harmonised structure known as Annex SL. Clauses 4 through 10, covering context, leadership, planning, support, operation, performance evaluation and improvement, are structurally the same document with different subject matter. If you already run an ISMS with a defined scope, management commitment, a document control process, an internal audit programme and a management review cadence, you do not build those again. You extend them.
The control sets are separate. Annex A of 27001 covers information security, Annex A of 42001 covers AI, and they are not interchangeable. They do overlap heavily in concern though: data handling, access control, change management, incident response, supplier relationships, documentation. In practice a team certified to 27001 has most of the scaffolding and needs the AI specific controls layered on, which is why the certification timelines quoted for organisations that already hold 27001 are noticeably shorter.
Where AI actually stresses an ISMS
This is the part that gets glossed over. Extending a management system sounds administrative. The interesting problems are the places where AI breaks an assumption the standard was written around, and most of them are not solved by adding a control.
The asset register has no row for this. Models, training datasets, fine tuned weights, prompt templates, vector stores and embeddings are all assets that carry risk, and almost no asset inventory has a category for them. If it is not on the register it is not in scope, and nobody is assessing it.
Classification stops being clean. Take a model trained on confidential data. What is the classification of the resulting weights? Of an embedding derived from a restricted document? A model can infer a protected fact from inputs that are individually harmless, which is a disclosure path that no data classification scheme was designed to describe.
Access control assumes a subject and an object. Role based access control works because a known principal requests a known resource. An agent running under a service account, acting on instructions that arrive inside the data it reads, collapses that model. It is the confused deputy problem with better prose, and the standard’s access controls do not reach it.
Change management does not recognise retraining. A retrained model is a material change to system behaviour, and it does not look like a deployment. No pull request, no release note, sometimes no human in the loop at all. Plenty of change control processes would never see it.
Incident classification has no bucket for the new failures. Prompt injection, a model disclosing training data in its output, a summariser acting on attacker supplied text in a log line. If your incident taxonomy has no category for these, they get filed as something else or not filed at all, and your metrics will look reassuring.
Logging creates the risk it was meant to reduce. Capturing prompts and outputs is the obvious way to get observability over model behaviour. It also means you are now storing whatever users typed, which may be personal or confidential, in a system that was scoped for application logs.
Erasure runs into physics. Deleting a record from a database is understood. Removing a fact from trained weights is not, and retraining to achieve it is expensive enough that most organisations quietly hope nobody asks. Any regime with a deletion right eventually meets this.
None of these are reasons to avoid a management system. They are the reasons to have one, and they are the questions I would ask first if I were auditing anybody’s AI governance rather than reading their policy.
The EU
The AI Act entered into force on 1 August 2024, with prohibited practices applying from February 2025 and obligations for general purpose models from August 2025.
Then the timeline changed. A package generally called the Digital Omnibus on AI was proposed in November 2025, agreed in the first half of 2026, published in the Official Journal on 24 July 2026 and in force from 27 July, six days before the deadline it was altering. It defers the obligations for standalone high risk systems, the Annex III category, from 2 August 2026 to 2 December 2027. AI embedded in products already covered by EU product safety law moves to 2 August 2028.
Three points matter here. Deferred is not cancelled, and the extra time is a planning window rather than a reprieve. The transparency duties under Article 50 were not part of the deferral, so 2 August 2026 remained a live date for disclosure obligations. And the same package added a prohibition on systems generating intimate imagery without consent and child sexual abuse material, so the direction was not uniformly toward relaxation.
The United States
There is still no comprehensive federal AI statute. What exists is a set of state laws and a federal attempt to override them.
Texas brought its Responsible Artificial Intelligence Governance Act into effect on 1 January 2026, and California’s Transparency in Frontier Artificial Intelligence Act started the same day. Colorado took a stranger path: it passed a broad high risk AI law in 2024, watched its start date slip repeatedly, and then in May 2026 repealed and replaced it with a narrower statute aimed at automated decision technology that materially influences consequential decisions, effective from January 2027.
Over the top of all of it, an executive order signed on 11 December 2025 proposes a single federal framework that would preempt state AI laws judged inconsistent with it, with carve outs for child safety, compute and data centre infrastructure, and state procurement. Whether that survives contact with the courts is an open question.
So the American problem is not really a compliance problem. It is uncertainty about which rules will still exist when you finish building for them, which argues for governance that is not tied to any one statute’s vocabulary.
The United Kingdom
No AI Act, and no AI bill before Parliament. The approach is to apply existing law through existing regulators, which is deliberately the opposite of the EU model. In practice that means UK GDPR and the Data (Use and Access) Act 2025 plus whichever sector regulator already governs you, so the FCA, Ofcom, the MHRA, the CMA.
The recent movement has been toward encouraging adoption rather than constraining it. A blueprint published in October 2025 introduced an AI Growth Lab, a programme of sandboxes in which specific rules can be relaxed for licensed pilots in areas like healthcare, transport and professional services, and a Regulating for Growth Bill was announced to push regulators toward promoting innovation within their remits.
For an operator this is comfortable and slightly deceptive. Nothing new to certify against, and no reduction in your existing obligations. If a model makes decisions about people, data protection law already applies in full.
Asia
The region has produced the sharpest contrast in philosophy anywhere.
South Korea moved first with real teeth. Its Framework Act on AI took effect on 22 January 2026, the first comprehensive AI legislation in the Asia Pacific region. It imposes obligations on high impact systems in sectors such as healthcare, energy and public services, including impact assessment, risk management, explainability, human oversight and documentation, plus labelling requirements for some generative applications.
Japan went the other way. Its AI promotion act, passed in May 2025, is oriented toward research and adoption and carries no penalties. It is a statement of national intent rather than a compliance regime.
China regulates through specific mechanisms rather than one horizontal law: filings for algorithms, labelling for synthetically generated content, and security review before public facing models launch.
Singapore continues to prefer frameworks and tooling over statute, with AI Verify as a testing toolkit and a governance framework for agentic AI published in January 2026. India remains mostly voluntary and sectoral.
The Gulf
No GCC country had a horizontal AI statute as of mid 2026, which is easy to misread as an absence of expectations. It is not.
Saudi Arabia designated 2026 its year of artificial intelligence, with its data and AI authority leading governance. The working material is the Personal Data Protection Law, in force since September 2023, together with AI ethics principles updated in 2025, generative AI guidelines from 2024 and an adoption framework with maturity levels. The authority holding ISO 42001 itself tells you which reference point it expects others to use.
The UAE combines its 2021 federal data protection law with a charter for AI that is not binding, the National AI Strategy 2031, ethics guidance from the telecoms regulator, and separate guidance for financial services from the ADGM and DIFC. The central bank issued a guidance note on AI and machine learning in February 2026 covering governance, bias testing, transparency and human oversight. A federal AI law with binding obligations, reportedly including mandatory impact assessments for higher risk uses, has been in development.
The practical reading for the region: obligations arrive through data protection law, sector regulators and procurement requirements rather than through an AI act, and the bar in financial services is already meaningful.
The pattern underneath
| Jurisdiction | Instrument | Posture |
|---|---|---|
| EU | AI Act, as amended in July 2026 | Prescriptive, risk tiered, timeline slipping |
| US | State laws plus attempted federal preemption | Contested and unsettled |
| UK | Existing regulators and data protection law | Growth oriented, no new statute |
| South Korea | Framework Act on AI | Comprehensive, obligations on high impact uses |
| Japan | AI promotion act | Encouragement, no penalties |
| China | Filings, labelling, security review | Mechanism by mechanism, enforced |
| Singapore | Voluntary frameworks and testing tools | Assurance without statute |
| Gulf states | Data protection plus sector guidance | No horizontal law, real expectations |
The forms could hardly differ more. The substance converges to a remarkable degree. Almost every regime, and ISO 42001 alongside them, wants to see the same handful of artefacts: an inventory of the AI systems you run, an assessment of what each could do to people, a named human who is accountable, disclosure when someone is interacting with a machine or its output, oversight that can intervene, and records that let somebody reconstruct a decision afterwards.
That convergence is the useful insight, because it means the work is largely portable. Build the evidence once, structured well, and most regimes are asking you to present a different view of it rather than to produce something new.
Two cautions. Certification is not compliance: a management system demonstrates that you have a process, not that a given system is lawful in a given market, and no auditor will tell you otherwise. And treat published figures claiming a standard covers some percentage of a regulation’s requirements as marketing rather than measurement.
What I would do
Inventory before anything else. Most organisations cannot say how many AI systems they run, largely because the majority arrived as features inside products they already bought. You cannot govern a list you do not have, and the exercise usually finds things nobody had considered.
Classify by what a system decides, not by what technology it uses. Every serious regime hinges on consequence to people. A simple model making decisions about someone’s mortgage matters more than an elaborate one suggesting text.
Extend the ISMS rather than starting a parallel programme. The governance machinery you need mostly exists. Running AI governance separately produces two sets of minutes and one set of outcomes.
Track dates rather than headlines. The EU deferral was widely reported as a delay to the AI Act, while the transparency obligations arrived on schedule. Those are the details that determine whether you were exposed.
Assume the ground moves. In nine months a major deadline shifted by sixteen months, a state law was repealed and replaced, and a federal order appeared claiming to override state statutes. Governance that depends on one regime’s vocabulary will need rebuilding. Governance built around the artefacts above will not.