An evolving timeline
The application dates for several obligations have been adjusted by Regulation (EU) 2026/1744, known as the Digital Omnibus. According to published information, the obligations for high-risk systems under Annex III have been postponed to December 2, 2027, and those under Annex I to August 2, 2028. Check these dates on EUR-Lex, as the schedule has recently changed. Our article on AI Act obligations details the main points.
What you can demand from a provider
Regardless of the risk level of the use case, some guarantees are a matter of contractual common sense and preparation for the AI Act :
- Transparency : you know when you are interacting with an AI and what it is based on.
- Human oversight Human oversight : the AI assists, the user validates. No decision concerning an employee is made without human intervention.
- Documentation : a description of how it works, the data used, known limitations, and intended use cases.
- Risk management Monitoring : a system for tracking errors and drift.
- Governance : a clear internal organization for managing AI, ideally structured according to a recognized framework.
Where does ISO 42001 fit in ?
ISO/IEC 42001 is an AI management system standard. It is voluntary. To date, it is not a harmonized standard under the AI Act : holding it does not constitute a presumption of conformity. However, it does demonstrate structured AI governance, which is a useful signal for a buyer. See our article ISO 42001 and the AI Act.
Symalean's position
Symalean designs its AI in compliance with the AI Act and GDPR frameworks, and has initiated the ISO/IEC 42001 certification process. The AI is developed by Symalean and hosted on HDS-certified servers.
