Short answer
The EU AI Act sorts AI uses by risk. A few practices are banned, high-risk systems carry detailed obligations, some systems have transparency duties, and most uses have no specific rules. Since the Digital Omnibus on AI, Regulation (EU) 2026/1744, high-risk rules apply from 2 December 2027 for Annex III uses and from 2 August 2028 for AI in products covered by Annex I. ISO/IEC 42001 is a voluntary management system standard that helps you organize policies, risk assessments and records for AI. It does not replace legal obligations.
Companies in aviation, energy, manufacturing, healthcare and construction already work under safety and quality rules. AI adds a new layer. This guide summarizes the EU AI Act and ISO/IEC 42001 in plain terms, with dates as they stand in October 2026. It is general information, not legal advice. Check the current text on EUR-Lex and with your advisers before relying on it.
What the EU AI Act is
The AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024. It applies to providers who place AI systems on the EU market or put them into service, to deployers who use them in the EU, and to providers and deployers outside the EU when the output of the system is used in the EU. Obligations depend on the role you play and the risk category of the system.
The risk categories
| Category | Examples | What applies |
|---|---|---|
| Prohibited | Social scoring, certain manipulative techniques, emotion recognition in workplaces with narrow exceptions | Not allowed |
| High-risk | Safety components in products covered by Annex I, and uses listed in Annex III such as safety components in critical infrastructure, and some employment decisions | Risk management, data governance, documentation, logging, human oversight, accuracy and robustness, conformity assessment |
| Transparency | Chatbots, AI-generated or manipulated content | Tell people they are dealing with AI, and mark generated content |
| Minimal | Most internal productivity, search and analytics uses | No specific obligations, though AI literacy measures and existing laws still apply |
Separate rules apply to providers of general-purpose AI models, which mainly concern the developers of large models rather than the companies that use them.
Key dates
| Date | What applies |
|---|---|
| 1 August 2024 | The AI Act enters into force |
| 2 February 2025 | Prohibited practices and AI literacy provisions apply |
| 2 August 2025 | Obligations for general-purpose AI models and the governance framework apply |
| 2 August 2026 | Most remaining provisions apply, including the transparency obligations in Article 50 |
| 2 December 2027 | High-risk obligations for Annex III systems apply, as moved by the Digital Omnibus |
| 2 August 2028 | High-risk obligations for AI in products covered by Annex I apply, as moved by the Digital Omnibus |
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force in late July 2026. Besides moving the high-risk dates, it reworded the AI literacy duty in Article 4: providers and deployers must take measures to support the development of AI literacy among their staff, rather than ensure a sufficient level. It also narrowed the definition of a safety component and extended some relief for smaller companies. Read the consolidated text for the exact wording.
What it means by sector
Aviation
Civil aviation safety rules are listed in Section B of Annex I. For those products, the AI Act's requirements are brought in through the aviation rules themselves, so EASA and the aviation framework remain the main reference for AI on board aircraft and in air traffic systems. Internal tools such as report classification or document search usually fall outside the high-risk categories, but your SMS still requires you to manage them as a change.
Oil, gas and utilities
AI used as a safety component in the management and operation of critical infrastructure, such as the supply of gas, heating or electricity, is listed in Annex III. Predictive maintenance dashboards that inform planners are usually different from systems that directly control safety functions, but the boundary should be assessed case by case.
Manufacturing
AI that is a safety component of machinery or other products covered by Annex I is high-risk. Quality inspection that sorts parts is usually not a safety component, unless the part's safety function depends on it. Product teams should check this early in design.
Healthcare
AI that is, or is part of, a medical device requiring third-party conformity assessment is high-risk, alongside the medical device rules. Administrative tools such as rostering or letter drafting are usually not high-risk, though employment-related uses need a closer look.
Construction
Most construction uses, such as take-off and document search, are minimal risk. Worker monitoring needs care: camera analytics on site touch data protection law and, where they are used to evaluate or manage workers, employment provisions of the Act.
What ISO/IEC 42001 is
ISO/IEC 42001:2023 is an international standard for an AI management system. It was published in December 2023 and follows the same high-level structure as ISO 9001 and ISO/IEC 27001, so it fits beside quality and information security systems that many regulated companies already run. It covers:
- An AI policy and defined roles and responsibilities.
- Risk assessment and treatment for AI, and impact assessment for people affected by AI systems.
- Controls across the AI system life cycle, listed in Annex A, applied as relevant to your use.
- Monitoring, internal audit, management review and continual improvement.
Certification by an accredited body is possible but voluntary. Its value is practical: it gives you an organized way to keep track of where AI is used, what could go wrong and who is responsible, which is also what customers, auditors and regulators ask about.
What to do now
- Make an inventory. List the AI systems you build, buy or use, including AI features inside existing products.
- Classify each one. Record your role, provider or deployer, and the likely risk category, with the reasoning.
- Support AI literacy. Give staff who use or oversee AI the training they need for their role. This duty already applies.
- Check transparency. Make sure chatbots identify themselves and that generated content is marked where required.
- Plan for high-risk systems. If any system may be high-risk, plan the documentation, logging, human oversight and testing now. December 2027 is close for a build that has not started.
- Fit it into what you have. Extend your existing quality, safety and information security management to AI. ISO/IEC 42001 is one structured way to do that.
For most industrial companies, the immediate work is an inventory, AI literacy and good records. The heavier obligations apply only to the systems that are truly high-risk.