AI governance: 11 laws, frameworks, and assurance schemes—and 3 jobs they serve.

On August 2, 2026, many EU AI Act provisions began to apply. High-risk systems were the exception.

The Digital Omnibus on AI (Regulation (EU) 2026/1744 ) deferred the core Chapter III duties for high-risk AI systems. Standalone high-risk use cases (Annex III) now apply from December 2, 2027. High-risk AI embedded in already-regulated products (Annex I) now applies from August 2, 2028. The delay is real. It is not a general pause on the Act ^{2 33}.

The Omnibus got its final Council green light on June 29, 2026 ¹, was dated July 8, published in the Official Journal on July 24, and entered into force July 27, 2026 ².

The Commission wanted the delay to start only once the supporting harmonised standards, or other support tools, were ready; however, co-legislators dropped that and locked the dates. December 2, 2027 arrives whether or not anything has been cited in the Official Journal ^{2 5 6}.

• High-risk standalone systems (Annex III): December 2, 2027
• High-risk systems inside regulated products (Annex I): August 2, 2028
• National AI sandboxes (Article 57): August 2, 2027

• Original Article 5 bans and AI literacy: since February 2, 2025
• GPAI provider duties: since August 2, 2025
• Most Article 50 transparency duties (chatbots, synthetic-content marking, emotion-recognition notices): August 2, 2026
• Ninth banned-practice category (intimate imagery / CSAM): December 2, 2026
• GPAI models already placed on the market before August 2, 2025: comply by August 2, 2027

If you stop at the delay, you will feel like you can relax. Don't.

The Act is not only for companies headquartered in the EU. It can apply to providers placing AI systems or GPAI models on the EU market, deployers using systems in the EU, and certain providers or deployers outside the EU where an AI system's output is used in the Union. Headquarters is not the test; scope stays subject to Article 2 's exclusions, and it depends on the facts of the system and how it is used ³. Those exclusions cover systems used exclusively for national security, military, or defence purposes; purely personal, non-professional use; and some open-source releases.

Most of the Article 50 transparency duties applied from August 2, 2026: disclose the chatbot, mark the synthetic content, and notify people about emotion recognition ^{2 33}.

AI literacy was not delayed. It was softened. Providers and deployers still have to take measures, but those measures now support the development of AI literacy rather than ensure a sufficient level of it. The new text says outright that nobody has to guarantee any individual's competence ². National AI regulatory sandboxes (Article 57) moved from August 2, 2026 to August 2, 2027 ².

From December 2, 2026, a ninth banned-practice category arrives (Article 5(1) points (ba) and (bb)): systems that generate or manipulate non-consensual intimate material of an identifiable person, or child sexual abuse material. That is not a blanket ban on generative models. For providers, placing the system on the market or putting it into service is prohibited only where that generation or manipulation is the system's intended purpose, or a reasonably foreseeable and reproducible outcome without adequate safeguards. For deployers, use is prohibited only where they use the system for that purpose ².

One other grace period: if you are a provider of an AI system — including a general-purpose AI system — that generates synthetic audio, image, video, or text, and you placed it on the market before August 2, 2026, new Article 111(4) gives you until December 2, 2026 to comply with Article 50(2)'s machine-readable marking obligation. It does not delay the rest of Article 50 ².

No published analysis of the Omnibus reports a change to the Act's maximum penalty tiers (Article 99). A penalty can follow only once the underlying duty applies. The original Article 5 bans have been enforceable since February 2, 2025; the new Article 5(1) points (ba) and (bb) apply from December 2, 2026; and the deferred Chapter III duties apply on their new 2027 and 2028 dates ^{2 3}.

The caps themselves still sit where they did:

• Article 5 prohibitions: up to €35M or 7% of global turnover
• Most other violations: up to €15M or 3%
• Incorrect, incomplete, or misleading information: up to €7.5M or 1%

Whichever is higher in each case, unless you are an SME or a small mid-cap ³. The deferral buys time to build high-risk systems but won't pardon what's already been banned.

The Omnibus also expands and centralizes some of the EU AI Office's market-surveillance and enforcement powers. Amended Article 75(1) makes the Office the only competent enforcer (exclusively competent) in two cases:

1. The same provider built both the general-purpose model and the system sitting on top of it, or two providers in the same undertaking (the same economic group) did.
2. The AI system constitutes, or is integrated into, a very large online platform or search engine designated under the Digital Services Act.

That exclusive competence covers the providers of those systems. It covers deployers only when they are also the provider, or form part of the same undertaking ².

The Office's powers sit in Articles 75a to 75d: it can supervise and investigate, accept binding commitments, run a non-compliance procedure, and, under Article 75c(5), impose periodic penalty payments of up to 5% of average daily income or worldwide annual turnover in the preceding financial year, per day, to compel specified actions such as answering an information request or allowing an inspection ².

National authorities still handle everything outside that slice, including Annex I product systems, certain Annex III cases, and specified law-enforcement, border, financial, and justice systems. This is a new lever, not a delayed one.

Anthropic announced that Claude models launched on or after August 2, 2026 will carry machine-readable markings from launch : an imperceptible text watermark, plus C2PA-signed provenance metadata for PNG, JPG, and SVG. Anthropic says the text watermark travels with copied-and-pasted text and can survive some edits. They are also working to retrofit older models during the transition period, across supported Claude surfaces worldwide ^{7 8}.

Anthropic released a Claude content checker . It reads C2PA credentials in files ³²; text-watermark detection is a separate API, in private preview to eligible organizations ⁷.

A detected mark is evidence that Claude may have processed content, not proof that Claude authored it. The absence of a detectable mark does not establish human authorship. Anthropic lists five reasons a mark may not show up: the model predates marking support; the text was heavily edited, paraphrased, translated, or mixed into other writing; the passage is too short to carry a reliable signal; the file's metadata was stripped by format conversion, re-saving, a screenshot, or some other means; or the content came from a platform, feature, or file type where that marking type isn't supported ^{7 8}.

Two nearer dates survived the Omnibus untouched. General-purpose AI models placed on the market before August 2, 2025 still have to comply by August 2, 2027, which lands before either deferred high-risk date ³.

New Article 6(1a) to (1c) also narrows what counts as a safety component, so some Annex I systems drop out of high-risk altogether rather than getting more time:

• 6(1a): systems used solely for non-safety-related user assistance, performance optimisation, service efficiency, automation, convenience, or quality control are out.
• 6(1b): if the system's failure or malfunctioning would endanger health and safety, it still qualifies, even with that carve-out.
• 6(1c): if a product only has to go through third-party assessment for other risks — in particular radio-spectrum or electromagnetic-interference risks that do not affect health and safety — that does not, by itself, meet the Article 6(1)(b) condition for treating it as high-risk ².

If a provider treats an Annex III system as not high-risk under the Article 6(3) exception (the derogation), Article 6(4) still requires documenting that assessment before placing the system on the market or putting it into service, and registering it in the EU database (Article 49(2)) ^{2 3}. That is not a universal registration duty. It applies to that classification route. The Commission proposed narrowing it; Council and Parliament kept the documentation and registration. The Omnibus only trims the filing by deleting Annex VIII, section B, points 7 and 9 ^{2 6}.

Article 111(2) kept its shape, with one change. It applies to operators of high-risk systems already placed on the market or put into service before Chapter III starts to apply — but only if, from that date, those systems undergo significant changes in their designs. The cutoff is no longer a fixed August 2, 2026. It now tracks when Chapter III applies: December 2, 2027 for Annex III, August 2, 2028 for Annex I. Providers and deployers of high-risk systems intended for public authorities must still take the necessary steps to comply by August 2, 2030 ^{2 3}. If your estate is legacy or public-sector, those are your dates.

None of these dates matter without a record of who changed what and when. That record has to live somewhere, and it's usually not where teams think to look.

The deadline is only one document. Around it sit eleven overlapping laws, frameworks, and assurance schemes from different bodies. Most of them landed or were revised in the last two years.

Stop focusing on the framework and start with the job. There are three:

The expensive mistake is assuming a certificate in one satisfies another. All three jobs eventually need evidence from somewhere: who touched what, when, and who approved it.

Three artifacts sit on more than one line:

• CSA AICM is a security-and-governance control framework. Its associated AI-CAIQ supports self-assessment and third-party evaluation, and CSA provides materials for STAR for AI Level 1 submissions ¹⁵.
• NIST AI 600-1 reads as security content but sits inside a governance framework.
• AIUC-1 is a procurement instrument wearing security clothing. A consortium contributed the controls, but the publisher is an AI underwriting company, which is the tell.

The first certification body ANAB-accredited to audit ISO 42001 was Schellman, in September 2024 ³⁰. ISO/IEC 42006:2025 followed in July 2025 and set requirements specific to AI-management-system auditors ¹¹. The accredited-auditor pool is barely two years old, and ANAB is one accreditation body among several. Check your certification body's accreditation, and its queue, before you commit to a date.

CSA's April 2026 analysis says it directly: "ISO/IEC 42001 alone does not satisfy the EU AI Act, despite frequent industry shorthand to the contrary." That is CSA's reading, not an EU regulator's formal ruling ⁹.

ISO 42001 certification is meaningful evidence that an organization operates an AI management system. It is not, on its own, a finding that every AI system the organization provides or deploys meets the EU AI Act. The Act still wants several things at once, at more than one level: classify the system, document it, manage its risks, govern its data, log it, be transparent, keep human oversight in place, watch it after it ships (post-market monitoring), and, where it applies, run a conformity assessment. On top of that sit organization-level quality-management-system duties under Article 17 ^{3 9}.

CSA lists the gaps: no per-system regulatory compliance strategy mapping, no pre-determined change management for continuous-learning systems under Article 17(1)(a), no Article 73 serious-incident reporting timetable, generic rather than AI-specific supply-chain provisions, and no structured fundamental-rights consideration, particularly the Article 27 impact assessment certain deployers owe ^{3 9}.

Those missing clocks matter. Under Article 73, providers of high-risk systems report immediately after establishing a causal link, or a reasonable likelihood of one, and in any event within 15 days of the provider or, where applicable, the deployer becoming aware. That clock is two days for a widespread infringement or a serious incident involving critical infrastructure as defined in Article 3(49)(b). Where a death is involved, the report is due immediately after establishing or suspecting a causal relationship, and not later than 10 days after becoming aware ³.

ISO 42001 does not create a presumption of conformity with the Act. Under Article 40, only a harmonised standard cited in the EU Official Journal does that ^{3 9}. The candidate is EN 18286 from CEN-CENELEC JTC 21, published as EN 18286:2026, the first European standard supporting AI Act implementation, covering the Article 17 quality management system for high-risk systems ¹³. Until a harmonised standard is cited in the Official Journal, a provider audited under ISO 42001 alone will, in CSA's words, "face open questions about whether each of the thirteen Article 17 elements is sufficiently covered, and the answers depend on the auditor's interpretation." ⁹

• A taxonomy is not a control set. OWASP Top 10 is not, by itself, a certification or regulatory compliance regime. Name the risks and mitigations you have addressed; the lists name failure modes, not an auditable program ^{16 17}.
• NIST AI RMF is not certifiable. Vendors claim "NIST AI RMF compliance" routinely. No such scheme exists. The July 2025 White House AI Action Plan directed a revision of 1.0, but there is no public draft yet ²⁰.
• ATLAS is the attacker's view, not a checklist. It catalogs adversary techniques. Useful for red teams, wrong as a compliance to-do list ¹⁸.
• COSAiS is not a finished control overlay. It is useful for tracking NIST's direction and for federal-aligned planning. There is an August 2025 concept paper and a January 8, 2026 annotated outline covering one of five planned use cases. No finished overlay has been published ^{22 23}.

Official and real: CSA ships AICM-to-everything mappings with the v1.1 download: ISO 42001, NIST AI RMF, NIST AI 600-1, EU AI Act, BSI AIC4, and AIUC-1, each with a gap analysis, in five mappings (the two NIST crosswalks ship as one) ^{14 15}. OWASP says its LLM Top 10 2026 maps to NIST, MITRE ATLAS, CWE, and its own Agentic Top 10 ¹⁶. On September 1, 2026, it went further and published a standalone GenAI Security Industry Framework Crosswalk: 51 GenAI vulnerabilities mapped across 25 frameworks, among them ISO 42001, NIST AI RMF, the EU AI Act, MITRE ATLAS, and SOC 2's Trust Services Criteria, free under CC BY-SA 4.0 ³¹.

Hosted by NIST, authored by a vendor: the NIST AI RMF to ISO 42001 crosswalk on NIST's site is credited to Microsoft, not NIST. It's still useful; know what it is ²⁴.

Stale: NIST's own EU mapping sits inside its OECD/EU/EO13960 crosswalk, dated January 26, 2023, and it maps the 2021 proposal, superseded by Regulation (EU) 2024/1689 ²⁴.

Not published by AICPA: ISO 42001 to SOC 2. AICPA's Trust Services Criteria mapping page lists no AI, ISO 42001, or NIST AI RMF mapping at all, and does not name the other mappings it offers on the public page ^{25 26}. There is also no AI-specific SOC 2; teams typically map AI controls into the common criteria and the Processing Integrity category.

We found no standards body that publishes a "start here" recommendation. Every prescriptive starting-point claim we did find came from a vendor with a product to sell. So treat this as our editorial judgment:

These frameworks define the controls and evidence an organization needs. They don't tell engineering how to produce that evidence. That gap is where the API layer matters. A federated graph records which services expose which data, how schemas change, and who approves those changes. Where identity, access controls, and audit logging are configured, it records who changed the graph; client identification labels requests with the client name and version the caller sends ²⁷.

Hub governs the workflow around the graph. Where proposal checks and ownership are enabled, checks run before a proposal ships, and type and subgraph ownership decides who signs off, with graph admins able to approve anything ²⁸. Where configured, Cosmo's graph pruning flags fields deleted without being deprecated first, on a configurable grace period, and a separate operations check fails a deletion while real client traffic still uses the field ²⁹. The result is an approval and change history teams can inspect later.

Cosmo is not an AI-governance product and should not be positioned as one. It can contribute evidence by governing the APIs, schemas, access paths, change approvals, and client traffic an AI-enabled application uses. Whether that evidence is sufficient depends on the applicable system, role, risk classification, and control requirement.

• How Cosmo meets compliance requirements
• Subgraph compliance in federated graphs
• What non-compliance actually costs

Sources verified September 4, 2026; corrections re-verified September 8, 2026.

[1] Council of the EU. "Artificial intelligence: Council gives final green light to simplify and streamline rules." Press release, 29 June 2026.

[2] EUR-Lex. "Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689." In force 27 July 2026. Cited for the amended wording of Articles 5, 6, 57, 75 to 75d, 99, 111 and 113, and Annex VIII.

[3] EUR-Lex. "Regulation (EU) 2024/1689 (AI Act)." Articles 2, 4, 5, 6, 17, 27, 40, 43, 49, 50, 73, 99, 111.

[4] Cloud Security Alliance. "EU AI Act's High-Risk Deadline: Deferred, Not Cancelled." 1 August 2026. Interpretation and practical context, not a substitute for the amending regulation.

[5] Gibson Dunn. "EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes." 27 May 2026, pre-adoption analysis, used for legislative-history context only.

[6] Cooley. "Digital AI Omnibus Delays Key Deadlines, Introduces New Rules." 3 August 2026, used for legislative-history context only.

[7] Anthropic. "How Claude's text watermark works."

[8] Anthropic. "How Claude marks AI-generated content."

[9] Cloud Security Alliance. "EU AI Act Compliance: prEN 18286 and ISO 42001." 28 April 2026. CSA's analysis of the ISO 42001 / AI Act relationship, not an EU regulator's ruling.

[10] ISO/IEC 42001:2023, "Information technology. Artificial intelligence. Management system." Published December 2023, edition 1, CHF 225.

[11] ISO/IEC 42006:2025, "Requirements for bodies providing audit and certification of artificial intelligence management systems." Published July 2025.

[12] Vanta. "ISO 42001 certification costs: A structural breakdown." Vendor estimate, cited as illustrative only.

[13] CEN-CENELEC. "EN 18286 in the spotlight: supporting compliance with the AI Act." 31 July 2026.

[14] Cloud Security Alliance. "AI Controls Matrix v1.1: Strengthening the Foundation for Trustworthy AI." 14 July 2026.

[15] Cloud Security Alliance. "AI Controls Matrix v1.1" artifact and mapping bundle.

[16] OWASP GenAI Security Project. "OWASP GenAI LLM Top 10 2026." Released 3 August 2026, CC BY-SA 4.0.

[17] OWASP GenAI Security Project. "OWASP Top 10 for Agentic Applications." 9 December 2025.

[18] MITRE ATLAS. atlas-data releases, v2026.05, 27 May 2026

[19] Cloud Security Alliance. "Cloud Security Alliance Extends AI Assurance Leadership Into Agentic AI With Addition of AIUC-1 Certification to STAR Registry." 30 June 2026.

[20] NIST. "AI Risk Management Framework (AI RMF 1.0)." January 2023. Revision directed by the White House "America's AI Action Plan" , July 2025.

[21] NIST AI 600-1. "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile." July 2024.

[22] NIST CSRC. "SP 800-53 Control Overlays for Securing AI Systems (COSAiS): publications." Annotated outline, 8 January 2026.

[23] NIST CSRC. "COSAiS use cases."

[24] NIST AIRC. "Crosswalks to the NIST AI Risk Management Framework (AI RMF 1.0)."

[25] AICPA & CIMA. "2017 Trust Services Criteria (with revised points of focus, 2022)."

[26] AICPA & CIMA. "Get mappings relevant to the trust services criteria."

[27] WunderGraph Cosmo docs. "Security and compliance" , "RBAC" , "Groups" , "SSO" , "Audit log" , "Changelog" , and "Client identification"

[28] WunderGraph Hub docs. "Propose and review" and "Assign ownership"

[29] WunderGraph Cosmo docs. "Graph pruning" — deprecation-before-deletion and grace periods — and "Schema checks" — the operations check against client traffic, 7-day default window, configurable per namespace.

[30] Schellman. "Schellman Becomes First ISO 42001 ANAB Accredited Certification Body." 24 September 2024.

[31] OWASP GenAI Security Project. "GenAI Security Industry Framework Crosswalk." Released 1 September 2026, CC BY-SA 4.0.

[32] Anthropic. "Check if a file was made with Claude."

[33] European Commission. "AI Act." Shaping Europe's digital future. Last update 3 August 2026.

Frequently Asked Questions (FAQ)