Knowledge base · ISO 42001
ISO 42001 and the AI Act: what applies to your company today?
Position as of 9 November 2026. The AI Act was amended in 2026 by Regulation (EU) 2026/1744, the Digital Omnibus. As a result, dates have shifted and one provision has been rewritten. Here you can read what applies today to an SME that uses AI, what comes later and what ISO 42001 does and does not prove.
Timeline
The AI Act in six dates that matter today
Regulation (EU) 2026/1744 entered into force on 27 July 2026 and amends Regulation (EU) 2024/1689.
| Date | What becomes applicable | For whom |
|---|---|---|
| 2 February 2025 | Prohibited practices and AI literacy | All providers and deployers |
| 2 August 2025 | Rules for general-purpose AI models | Providers of those models |
| 2 August 2026 | The regulation applies generally, including the transparency rules of Article 50 | Providers and deployers, depending on the article |
| 2 December 2026 | Two new prohibitions: AI that generates non-consensual sexually explicit images or child sexual abuse material. Also the final deadline for machine-readable marking (Article 50(2)) for generative systems that were on the market before 2 August 2026 | All parties for the prohibitions, providers of generative systems for the marking |
| 2 December 2027 | Requirements for high-risk systems under Annex III, including obligations of deployers | Providers and deployers of those systems |
| 2 August 2028 | Requirements for high-risk AI built into regulated products (Annex I) | Providers and deployers of those systems |
Today
An SME that only uses AI tools already has three obligations
Prohibited practices
Apply since 2 February 2025. Check that no tool or application in your company falls under a prohibition. Two prohibitions are added on 2 December 2026.
AI literacy
Applies since 2 February 2025, but the text was rewritten in 2026. Providers and deployers must take measures that support the development of AI literacy among their people. A short training and a written instruction, with proof that they were given, is a reasonable start.
Transparency
Applies since 2 August 2026. As a deployer you label deepfakes as artificial, you inform people when you apply emotion recognition or biometric categorisation, and you disclose AI-generated text on matters of public interest, unless a human has editorially reviewed it. Anyone who only uses AI internally to prepare texts is generally not covered. In case of doubt, a lawyer decides, not this page.
What does not apply to you
The rules for general-purpose AI models rest on the providers of those models. The obligations for deployers of high-risk systems only apply from the dates in the table.
Later and postponed
The postponement applies to high-risk, not to transparency
The high-risk rules have been postponed: to 2 December 2027 for the systems under Annex III and to 2 August 2028 for AI in regulated products under Annex I. For high-risk systems that public authorities were already using, 2 August 2030 applies. The transparency rules of Article 50 have not been postponed. Only the machine-readable marking of synthetic output received a grace period until 2 December 2026, and only for generative systems that were already on the market before 2 August 2026. The maximum fines under Article 99 remain: up to 35 million euro or 7 percent of worldwide annual turnover for prohibited practices, up to 15 million euro or 3 percent for most other obligations, and up to 7.5 million euro or 1 percent for incorrect information to the authorities. In each case the higher of the two applies. For SMEs, start-ups included, the lower applies. For small mid-caps too, except for prohibited practices.
Roles
An SME unknowingly becomes a provider as soon as it releases AI under its own name
The AI Act has four main roles. Which one you have determines what you must do.
Provider
Develops an AI system or has it developed and places it on the market or puts it into service under its own name or brand.
Deployer
Uses an AI system under its own authority, except for personal non-professional use.
Importer
Established in the EU, places on the market a system bearing the name or brand of a party outside the EU.
Distributor
Makes a system available in the supply chain without being a provider or importer.
The pitfall
If you build an AI function into your own product or service and offer it under your name, you may be a provider, even if someone else built the technology. For high-risk systems, you also become a provider if you substantially modify an existing system, put your own name or brand on it or change its purpose so that it becomes high-risk (Article 25).
Belgium
Position as of November 2026The Belgian supervisory structure is still not settled in November 2026
Position as of November 2026: as far as we could establish, Belgium has not yet formally designated its market surveillance authorities for the AI Act and no national implementing law with penalty rules has been passed. The BIPT is named as the main supervisor, and a draft bill sits with the FPS Economy. The Data Protection Authority remains competent as soon as personal data are involved. In the meantime, the obligations under the regulation apply directly, even without a Belgian law. So do not wait for the supervisor to map your use, and check the current position before you base a decision on it.
ISO 42001
ISO 42001 supports your AI Act work but does not prove conformity
ISO/IEC 42001:2023 sets requirements for a management system for AI and was published on 18 December 2023. The standard follows the same clauses 4 to 10 as ISO 27001 and adds, among other things, an assessment of the impact of AI systems, with 38 controls in Annex A. It is not a harmonised standard under the AI Act and therefore gives no presumption of conformity. The first harmonised standard, EN 18286:2026, was published in the Official Journal on 14 October 2026 and concerns the quality management system of providers of high-risk systems. An ISO 42001 certificate shows that your management system exists and works. It does not show that you comply with the AI Act. Certification bodies work according to ISO/IEC 42006:2025. Which bodies in Belgium are accredited for this is best checked with BELAC.
Decision aid
For most SMEs, a lighter approach is enough at first
Lighter is enough
You mainly use standard tools. Then an AI register, a short policy and demonstrable training are enough.
ISO 42001 pays off
You build or supply AI functions, customers or tenders ask for a certificate, or you already have an ISO 27001 system to build on.
Overlap with ISO 27001
Both standards share the same structure. The risk register, audit programme and management review can serve for both. New in ISO 42001 are the impact assessment and the controls that specifically concern AI.
This month
Start this month with an AI register
- 1List all AI tools used in your company, including tools that staff chose themselves and the AI functions in software you already have.
- 2Note for each tool the owner, the purpose, the data that goes into it and the supplier.
- 3Check whether any use comes close to a prohibition and whether you publish AI text or AI images without human review.
- 4Determine your role for each tool: only deployer, or also provider because you offer something under your own name.
- 5Give staff a short instruction and record what you did, so that you can demonstrate the measures for AI literacy.
- 6Then decide whether this register is enough or whether a management system is needed.
Frequently asked questions
Short answers
Want to get your use of AI in order?
In a first, free conversation we look at whether a register is enough or whether a management system pays off. Prefer to get started yourself? There is the template kit at 42001.app.