AI Governance
The EU AI Act is law, and its obligations arrive in stages until 2030. Complyanz keeps an inventory of your AI systems, screens each one against the prohibited practices, proposes which obligations apply from its risk tier and your role, and runs NIST AI RMF and ISO 42001 from the same evidence.
Your AI systems, what applies to each one, and when
What the AI Act requires, and when
These are the dates as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which moved the high-risk obligations back. Complyanz tracks each one against the AI systems it affects.
| Applies from | What applies | Who it affects |
|---|---|---|
| 2 Feb 2025 | Prohibited AI practices (Article 5) and AI literacy (Article 4) | Every provider and deployer |
| 2 Aug 2026 | Transparency obligations (Article 50): telling people they are dealing with an AI system, marking synthetic content and labelling deepfakes | Providers and deployers of systems that interact with people or generate content |
| 2 Dec 2026 | Marking of synthetic content for generative systems placed on the market before 2 August 2026, and two new prohibitions: non-consensual intimate imagery and child sexual abuse material | Providers of generative AI systems, and everyone for the new prohibitions |
| 2 Dec 2027 | High-risk obligations for the Annex III use cases, such as recruitment, credit scoring, education and access to essential services | Providers, deployers, importers and distributors of those systems |
| 2 Aug 2028 | High-risk obligations for AI in products covered by EU product legislation (Annex I), such as toys and medical devices | Product manufacturers and providers of those systems |
| 2 Aug 2030 | High-risk systems already on the market and intended for use by public authorities (legacy deadline) | Providers and public-authority deployers |
A high-risk system already on the market before its date comes into scope when it is significantly changed. Legacy systems intended for public authorities have until 2 August 2030.
Everything the AI Act asks you to show
A risk framework that travels
The NIST AI Risk Management Framework is voluntary, widely used in the United States and increasingly asked for by customers elsewhere. Its 72 subcategories under Govern, Map, Measure and Manage are in Complyanz word for word. The Generative AI Profile, NIST AI 600-1, adds suggested actions for the risks specific to generative AI, such as confabulation, data privacy and information integrity, and you switch it on when you work with generative models.
Start with any framework, add the others later
AI Act obligations, NIST AI RMF subcategories and ISO 42001 controls overlap a great deal. Complyanz keeps a crosswalk between them, so when you add a framework you see which of its requirements are already covered elsewhere and can reuse the evidence you already hold. Reuse is always your decision: nothing changes status on its own.
Included in Complete, or as an add-on
The AI Governance module covers the EU AI Act, NIST AI RMF and the Generative AI Profile. It is included in the Complete plan and can be added to any other plan, priced by the number of people in scope like the plans themselves.
AI governance FAQ
Do we need ISO 42001?
No. ISO 42001 is a voluntary, certifiable standard and the AI Act does not require it. You can run the AI Act or NIST AI RMF in Complyanz without it. Many companies add it later because a certificate is evidence their customers ask for, and the crosswalk carries much of the work across.
When do the high-risk obligations apply?
Following the Digital Omnibus on AI: from 2 December 2027 for the Annex III use cases, such as recruitment, credit scoring and education; from 2 August 2028 for AI in products covered by EU product legislation (Annex I); and, for high-risk systems already on the market that are intended for public authorities, by 2 August 2030 at the latest. The original prohibitions and AI literacy have applied since 2 February 2025, and the transparency obligations since 2 August 2026.
Is NIST AI RMF mandatory?
No. It is a voluntary framework published by the US National Institute of Standards and Technology. Organizations use it to structure AI risk management, and US customers and public-sector buyers increasingly ask for it. Complyanz includes its 72 subcategories verbatim, with the Generative AI Profile as an option.
Does the AI Act apply if we only use AI tools?
Often, yes. A deployer, meaning any organization that uses an AI system under its own authority, has obligations of its own: AI literacy, the prohibited practices, transparency towards the people affected and, for high-risk systems, human oversight, monitoring and keeping logs. Which ones apply depends on each system's risk tier and your role, which is exactly what the inventory proposes.
How does serious-incident reporting work?
When a high-risk AI system is involved in a serious incident, the provider reports it to the market surveillance authority no later than 15 days after becoming aware of it, 10 days if a person has died, and two days for a widespread infringement or a serious disruption of critical infrastructure. Complyanz starts the clock when you declare the incident and tracks the report until it is submitted.
Do you cover the obligations for general-purpose AI models?
No. Articles 53 to 55 apply to the companies that train and release general-purpose AI models. Complyanz is built for the organizations that build products on those models or use them, and it records when a system is built on one.
Build your AI governance program
Create an organization, add your first AI system and see which obligations apply to it, and from when.