One programme, two outcomes.
The AI Act classifies AI systems by risk. Unacceptable-risk practices are banned; high-risk systems (for example in employment, credit, education and critical infrastructure) carry strict requirements for risk management, data governance, documentation, human oversight, accuracy and post-market monitoring; limited-risk systems carry transparency duties; and providers of general-purpose AI models have their own obligations.
ISO/IEC 42001 gives you the management system to run all of this — policy, roles, AI risk and impact assessment, lifecycle controls, supplier oversight and continual improvement. We design your AIMS so that it produces the evidence the AI Act requires, and so it can be certified in its own right. Obligations are phasing in through 2025–2027, and we track the latest EU guidance and timeline changes for you.
Obligations scale with risk.
Unacceptable risk — prohibited
Practices such as social scoring and certain manipulative or exploitative uses are banned.
High risk — strict requirements
Risk management, data governance, technical documentation, logging, human oversight and conformity assessment.
Limited risk — transparency
People must be told when they interact with AI, and certain generated content must be disclosed.
Minimal risk — voluntary codes
Most AI applications; good practice and voluntary codes of conduct apply.
General-purpose AI models
Documentation, copyright and transparency obligations, with more for models posing systemic risk.
Four steps, one accountable team.
Engage any single stage or the whole journey. Every engagement reuses the controls and evidence you already have, and runs on Verigo Assure so compliance stays current after we finish.
AI inventory & classification
Find every AI system you build or use, determine your role and classify it under the AI Act.
Combined gap assessment
Assess against ISO/IEC 42001 and the AI Act together, so shared requirements are reviewed once.
AIMS implementation
Policies, AI risk and impact assessments, lifecycle controls and technical documentation.
Certification & ongoing assurance
Prepare for ISO 42001 certification and keep AI Act evidence current on Verigo Assure.
From scoping to ongoing assurance.
Indicative phases and durations. Your plan is scoped to your services, existing controls and deadlines.
Keep EU AI Act evidence current, not just audit-ready once.
Our compliance platform keeps controls, evidence and owners in one place and flags gaps before they become findings. Included with Verigo consulting engagements.
Good to know before we start.
Questions about scope, timelines or how EU AI Act fits with your existing frameworks? A senior practitioner will walk you through it.
Yes, if you place AI systems or general-purpose AI models on the EU market, or if the output of your AI system is used in the EU — regardless of where your company is established.
Using or building AI that reaches the EU?
Start with an AI inventory and classification. We will show you which AI Act obligations apply and how one ISO 42001 programme can meet them.