From inventory to evidence.

Summary

In July 2026 the EU adopted the Digital Omnibus on AI, Regulation (EU) 2026/1744, which pushed the AI Act's high-risk obligations back to December 2027 and August 2028. It is tempting to read that as time to wait. It isn't: the prohibitions and the AI literacy duty have applied since February 2025, the general-purpose AI rules since August 2025, and ISO/IEC 42001 and SOC 2 do not follow the AI Act calendar at all.

Each of these asks the same two questions: which AI systems do you use, and can you show what you did about them? The paper maps obligations by role, crosswalks the four frameworks, and describes what good evidence looks like. It summarises public texts and is not legal advice.

The numbers

• 16 moAnnex III high-risk deferral: 2 Aug 2026 to 2 Dec 2027Reg. (EU) 2026/1744
• 628days prohibitions and AI literacy had applied, at 23 Oct 2026 (derived)AI Act · Art. 113
• 63%of breached organisations: no AI policy, or one still in developmentIBM / Ponemon · 2025 · N=600
• 80%of surveyed employees use unauthorised AI tools (vendor survey)UpGuard · 2025 · N=1,020

Key findings

1. The Omnibus deferred the high-risk rules, not the rest. The deferral is limited to Chapter III. Generative systems already on the market have until 2 Dec 2026 to mark output (Art. 50(2)), when new bans on non-consensual intimate imagery and CSAM also apply.
2. Deployers have their own duties. From 2 Dec 2027 (Annex III), Article 26 asks deployers of high-risk systems to assign human oversight, monitor operation and keep logs for at least six months. Fines go up to €15M or 3% of worldwide turnover, whichever is higher.
3. Many organisations cannot yet answer "what AI do we use?" In IBM's 2025 breach study, only 34% of organisations with an AI governance policy said they audit regularly for unsanctioned AI.
4. The frameworks overlap heavily. ISO/IEC 42001's 38 Annex A controls, SOC 2's access and change criteria and NIST's GOVERN 1.6 all depend on the same inventory.
5. Evidence is not certification. Good evidence makes an audit or assessment faster and more credible. ISO/IEC 42001 certificates come from certification bodies, and a SOC 2 report is a third-party attestation.

What is inside

1. 01What the Digital Omnibus changed
2. 02What already applies
3. 03Obligations by role
4. 04The governance gap
5. 05ISO/IEC 42001 and SOC 2
6. 06One crosswalk, four frameworks
7. 07The evidence lifecycle
8. 08What good evidence looks like
9. 09Audit-readiness self-assessment
10. 10For partners and consultants