EU AI Act: prohibited practices and the AI literacy duty already apply. High-risk obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

Maturity assessment

Know what to do next for EU AI Act and ISO 42001 readiness.

A useful maturity view does not label your organization. It shows the next decision, evidence and owner that will move governance forward.

Choose the description that feels closest today.

Starting

No shared inventory or owner yet.

Next: Name the sponsor, list live systems and agree the first review.

Building

Policies exist, but evidence and ownership are uneven.

Next: Connect controls to owners, review dates and source evidence.

Operating

Governance is part of delivery and procurement.

Next: Test performance, manage change and improve from incidents.

This is a management starting point, not a certification, audit or legal opinion. Applicability depends on your role, systems, sector and evidence.

The same OS supports both frameworks.

Inventory, ownership, risk, controls, documentation and review connect legal obligations to a working management system.