August 2, 2026 is the date to circle. That is when the European Commission’s enforcement powers over general-purpose AI obligations kick in — obligations that technically applied back in August 2025 but had no enforcement teeth behind them. Penalties under the EU AI Act run up to €15 million or 3% of global turnover for most violations, and up to €35 million or 7% for prohibited practices. Meanwhile ISO 42001 has quietly become a procurement checkbox, and NIST AI RMF language is showing up in US federal contract clauses. Three frameworks, one budget cycle.
The mistake I keep seeing: enterprises standing up three separate compliance programs, each with its own spreadsheet, its own owner, and its own steering committee. Run one governance stack instead — anchored on a single AI system register — and let each framework consume the evidence it needs. This guide covers the sequencing, the realistic timeline, and how your model vendors’ compliance paperwork feeds your evidence file.
The 2026 deadline math
The AI Act’s dates have moved, and most summaries you read in 2025 are now wrong. Prohibited practices and the AI literacy obligation have applied since February 2025. GPAI model obligations applied in August 2025. What changes on August 2, 2026 is enforcement: the Commission can start levying fines, and the Act’s transparency rules take effect. The relief valve is on the high-risk side — under the timeline amendments adopted in 2026, obligations for Annex III high-risk systems (the use-case-based tier: hiring, credit, critical infrastructure) were postponed to December 2027.
Translation for a VP: if you deploy AI in the EU, your exposure through 2026 is mostly transparency, AI literacy, and — if you build or meaningfully fine-tune models — GPAI documentation. The high-risk conformity work got a reprieve, but it did not go away. Starting that work in early 2027 for a December 2027 date is how programs fail. The takeaway: treat August 2026 as the enforcement start line, not the finish line.
Why one stack beats three programs
The three frameworks overlap far more than their acronyms suggest. All three demand the same core artifacts: an inventory of AI systems, a risk classification per system, documented human oversight, incident handling, and lifecycle monitoring. Where they differ is posture — NIST AI RMF is voluntary guidance, ISO 42001 is a certifiable management system, and the EU AI Act is law with fines. Build the artifacts once, map them three ways.
| NIST AI RMF | ISO/IEC 42001 | EU AI Act | |
|---|---|---|---|
| What it is | Voluntary risk framework (Govern, Map, Measure, Manage) | Certifiable AI management system standard | Binding regulation with penalties |
| Who demands it | US federal contracts, boards, insurers | Enterprise procurement, RFPs | Any org placing AI on the EU market or using it there |
| Core artifact | Risk profile per system | AIMS documentation + audit evidence | Technical documentation, conformity assessment, registration |
| Proof | Self-attestation | Third-party certificate | CE marking / registration, regulator scrutiny |
| Timeline pressure | Contract-driven, now | Procurement-driven, rising through 2026 | Aug 2026 enforcement; Dec 2027 for Annex III high-risk |
Run three separate programs and you will pay three times for the same inventory work, and the documents will drift out of sync — which is exactly what an auditor or regulator will find. One stack, one register, three reporting views. That sentence is the whole strategy.
The AI system register is the anchor
Every framework conversation eventually collapses into one question: do you actually know what AI is running in your enterprise? The register is the answer, and it must be a living system — not a quarterly spreadsheet. Minimum fields per entry:
- System name, business owner, and technical owner — a name, not a team alias
- Underlying model and provider (including version), plus deployment path — API, cloud marketplace, or self-hosted
- Risk classification under each framework: EU AI Act tier, ISO 42001 impact assessment, NIST risk profile
- Data touched, human oversight mechanism, and links to the vendor’s compliance documentation
- Review date and incident log pointer
Two failure modes to design against. First, shadow AI — the register only covers what you can see, so pair it with discovery controls; we covered the policy side in our shadow AI risk analysis. Second, agents — once systems act autonomously with their own credentials, the register needs identity fields too, which is the subject of our agent identity governance guide. A register that misses either is a compliance prop, not a control.
Sequencing: NIST first, ISO second, EU AI Act layer
For a moderately complex organization — a few dozen AI systems, one or two jurisdictions — plan on 8–12 months end to end. The order matters:
| Phase | Typical duration | Exit criteria | |
|---|---|---|---|
| 1 | NIST AI RMF adoption: register built, risk profiles, governance roles named | 2–4 months | Every production AI system has an owner and a risk profile |
| 2 | ISO 42001: formalize the RMF work into an auditable AIMS, then certify | 4–6 months | Stage 2 audit passed; certificate in hand |
| 3 | EU AI Act layer: map register entries to Act tiers, close gaps for in-scope systems | 2–3 months (only if EU-exposed) | Transparency and documentation obligations evidenced per system |
Why this order: NIST RMF is the cheapest place to make mistakes — it is voluntary, so you can iterate on the register and roles without an auditor watching. ISO 42001 then certifies discipline you already practice rather than discipline you invented for the audit. The EU AI Act layer goes last because it is a mapping exercise once the first two exist. Organizations that start with the Act tend to lawyer the problem instead of engineering it. If you run above roughly 50 AI systems or heavily regulated workloads, add 3–4 months and budget for external help on the conformity side.
What your model vendors hand you
You inherit a large chunk of your evidence file from your model providers — if you know where to look. As of mid-2026, all four major providers hold ISO/IEC 42001 certification, which materially shortens your own vendor-risk workload. What differs is the depth and shape of what each hands you.
Microsoft has the broadest certified surface: ISO 42001 coverage spans GitHub Copilot, Microsoft 365 Copilot, Security Copilot, and the Foundry platform, and Purview Compliance Manager ships assessment templates that map controls to the EU AI Act and ISO 42001. If you are an M365/Azure shop, this is the shortest path to a populated evidence file. The honest caveat: Microsoft’s governance tooling maps best to Microsoft’s own estate — bring third-party or self-hosted models and you are back to manual mapping.
Google certified its AI management system across Google Cloud, Workspace, and the Gemini app, and its model cards for Gemini remain among the more rigorous public documentation in the industry. Strong fit for GCP-first shops and for teams that want per-model technical detail. The weakness is coherence — evidence lives across several consoles and documentation sites, so assembling a per-system package takes more assembly work than it should.
Anthropic was among the first frontier labs to achieve accredited ISO 42001 certification (announced January 2025), and its system cards for Claude models are detailed enough to lift directly into EU AI Act technical documentation. Fit: enterprises that want a defensible paper trail on model behavior and safety testing. Limitation: as a model provider rather than a hyperscaler, Anthropic hands you model-level evidence — platform-level controls come from wherever you deploy, such as Bedrock or Vertex.
OpenAI maintains ISO 42001 coverage across its consumer and business products and publishes system cards per frontier model. The documentation is solid; the operational challenge is churn. Product names, model versions, and data-handling terms have shifted quickly, which means evidence you filed six months ago may reference a product that no longer exists under that name. Assign someone to re-verify OpenAI-derived evidence quarterly.
Rule of thumb: vendor certificates cover the model and platform layer, never your use of it. A certified model in an uncontrolled workflow is still your liability. And if data-sovereignty pressure pushes you toward self-hosting, the governance calculus changes again — see our comparison of private AI on VMware versus OpenShift AI.
The people layer: AI literacy evidence
The most-ignored EU AI Act obligation is Article 4: AI literacy, in force since February 2025. Regulators will ask how you ensured staff using AI systems understand them — and “we sent an email” is not evidence. This is where training platforms earn a place in the governance stack. KnowBe4, best known for security awareness training, fits here: its compliance training library and human risk management platform give you assignable AI-use modules with completion tracking, which is precisely the auditable artifact Article 4 and ISO 42001’s competence clauses want. Strengths: enterprise-scale rollout and LMS-grade evidence trails your auditor already understands. Limits: KnowBe4 is a human-layer control, not a governance platform — it will not build your register, classify your systems, or manage conformity. Use it for the literacy evidence line, and do not let a completed training campaign masquerade as a governance program.
Frequently asked questions
Do I need ISO 42001 if I already follow NIST AI RMF?
Legally, no — but procurement increasingly says yes. NIST RMF is self-attested; ISO 42001 is a third-party certificate a customer can verify. If you sell to enterprises or governments, expect the certificate to become table stakes in RFPs through 2026–27. The good news: an honest RMF implementation gets you most of the way there.
Does the EU AI Act apply to US companies?
Yes, if you place AI systems on the EU market or their outputs are used in the EU. Like GDPR, it is extraterritorial. A US SaaS product with EU customers is in scope even with zero EU infrastructure.
How long does ISO 42001 certification take?
Plan 4–6 months from a working governance baseline to a passed Stage 2 audit, plus lead time to book an accredited certification body — audit capacity has been tight as demand rose through 2026. Starting from nothing, treat the full journey as 8–12 months.
What happens on August 2, 2026?
The Commission’s enforcement powers over GPAI obligations begin and the Act’s transparency rules take effect. Most Annex III high-risk system obligations were pushed to December 2027 by the 2026 timeline amendments — a reprieve for deployers, not a cancellation.
Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.