AI Risk Assessment Template: The Fields Auditors Look For
An AI risk assessment template is only as useful as the fields it captures, and the fields that matter are the ones an auditor or regulator expects to see: not just the technical risk, but its impact on the people the AI system affects. A template that treats an AI risk like any other IT risk misses the element that AI governance frameworks specifically require, which is the assessment of impact on individuals and society. This guide sets out the fields an AI risk assessment template should contain, a scoring approach that prioritizes correctly, and a structure aligned to ISO 42001 and the NIST AI Risk Management Framework. The reason to build the assessment around the right fields, rather than reach for a generic risk register, is that AI risk has a dimension ordinary risk assessments do not capture. An AI system can create risks to fairness, safety, and the rights of the people it affects, and the frameworks that govern AI expect those to be assessed explicitly. A template that prompts for them turns an AI risk assessment from a repurposed security exercise into one that actually satisfies what AI governance requires. What an AI Risk Assessment Template Should Capture A strong template captures each risk in enough structured detail to assess, prioritize, and act on it, without becoming so heavy that no one completes it. At minimum it should identify the AI system or use case being assessed, describe the context and purpose, state the specific risk, and capture the AI-specific dimension of how that risk could affect individuals. It then records the likelihood and severity that produce a rating, the controls already in place, the resulting risk level, and the treatment plan with an owner. Each field does a distinct job, and the assessment is only as good as its weakest field. The field that distinguishes an AI risk assessment from a generic one is the impact on individuals and society. Ordinary risk assessments focus on impact to the organization, but AI governance frameworks require an organization to consider how an AI system affects the people subject to it, which is the substance of an AI impact assessment. Building that field into the template rather than bolting it on afterward is what makes the assessment defensible under AI governance scrutiny. The Fields That Matter The table sets out the fields a defensible template should contain, what each captures, and why it matters. It is a structure to adapt to the organization’s AI systems, not a fixed form. Field What it captures Why it matters AI system or use case The specific system or application being assessed Scopes the assessment to one clear subject Context and purpose What the system does, for whom, and in what setting Frames how the risk should be judged Risk description The specific risk, from security to fairness to safety The core of the entry Impact on individuals How the risk could affect the people the system touches The AI-specific element frameworks require Likelihood How likely the risk is to occur One half of the risk score Severity How damaging the risk would be if it occurred The other half of the risk score Existing controls What already mitigates the risk Determines the residual risk Risk rating The resulting priority level Drives the order of treatment Treatment and owner The plan to address the risk and who owns it Turns assessment into accountable action The pattern across the fields is that the first four define and contextualize the risk, the middle three score it, and the last two convert it into action. A template missing the impact-on-individuals field fails the AI-specific requirement, one missing existing controls overstates risk by ignoring mitigation already in place, and one missing an owner produces analysis no one acts on. The fields that organizations most often omit, impact on individuals and a named owner, are precisely the ones that make the difference between an assessment that satisfies a framework and one that sits unused. The Scoring Approach The scoring approach in the template combines likelihood and severity into a risk rating, which is the mechanism that turns a list of risks into a priority order. Most templates use a simple matrix in which likelihood and severity are each rated on a scale, and their combination places each risk into a level such as low, medium, high, or critical. What matters is less the exact scale than that it is applied consistently, so that risks can be compared and the highest-rated ones addressed first. The AI-specific refinement is that severity should account for impact on individuals, not only impact on the organization. A risk with modest operational cost but serious potential to harm or unfairly affect people should score as significant, because the frameworks weigh that impact heavily. Building this into the severity judgment, rather than scoring purely on business impact, is what aligns the template’s prioritization with how AI governance expects risks to be ranked. The output is a rated, ordered set of risks that tells the organization where to act first. How the Template Aligns to ISO 42001 For organizations working to ISO 42001, an AI risk assessment is not optional but required: the standard’s planning clause requires both an AI risk assessment and an AI impact assessment, and a template that captures both satisfies that requirement directly. The risk fields support the risk assessment, the impact-on-individuals field supports the impact assessment, and the treatment and control fields feed the risk treatment and the Statement of Applicability that ISO 42001 expects. A template built around these fields therefore produces exactly the documented information an ISO 42001 audit looks for. The connection to the wider standard is covered in the guide to ISO 42001 requirements, which shows how the risk and impact assessments sit within the management system, and the specific design of the impact assessment is covered in the guide to designing the AI impact assessment for ISO 42001. The AIMS Manual provides the broader documented-information
EU AI Act Penalties: What Violations Cost and Who Pays
EU AI Act penalties are among the steepest in technology regulation, reaching, for the most serious violations, up to 7% of a company’s total worldwide annual turnover, a ceiling that exceeds even the headline fines under Europe’s data protection regime. That scale is deliberate, meant to make non-compliance a board-level financial risk rather than a cost of doing business. This guide explains the penalty tiers, who is liable across the AI value chain, and the compliance moves that keep an organization out of the highest-risk categories, so the exposure becomes something to manage rather than fear. The reason to understand the penalties before the deadlines arrive is that the compliance work they reward takes time to build, and an organization that waits until enforcement is imminent has the least room to reduce its exposure. The fines are the visible edge of the risk, but the practical response is a governance program that classifies AI use correctly and evidences responsible management, which is entirely achievable with lead time. The specific figures below are set by Article 99 of the Regulation, and because precision matters with statutory fines, this guide states them as the Regulation defines them. The EU AI Act Penalties Explained The EU AI Act structures its fines into tiers by the seriousness of the violation, and each tier is expressed as the higher of a fixed amount or a percentage of worldwide annual turnover. The table sets out the tiers as defined in Article 99 of the Regulation. Violation category Maximum penalty (higher of amount or turnover share) Prohibited AI practices Up to EUR 35 million or 7% of total worldwide annual turnover Non-compliance with other obligations (such as high-risk system requirements and transparency duties) Up to EUR 15 million or 3% of total worldwide annual turnover Supplying incorrect, incomplete, or misleading information to authorities Up to EUR 7.5 million or 1% of total worldwide annual turnover The structure tells a clear story: the law reserves its harshest penalties for the practices it prohibits outright, applies a substantial middle tier to failures in meeting the obligations placed on permitted but regulated systems, and sets a lower tier for information and cooperation failures. Because each ceiling is the higher of a fixed sum or a turnover percentage, the percentage bites hardest on large companies while the fixed amount sets a floor for smaller ones, which is why the exposure is genuinely material regardless of size. These figures are the statutory maximums set by Article 99 of the Regulation, defining the outer bound of what a violation can cost. Who Is Liable Across the AI Value Chain The EU AI Act does not place all liability on one party; it assigns obligations along the AI value chain, so who pays depends on the role a company plays. A provider, the party that develops an AI system or has it developed and places it on the market under its own name, carries the most extensive obligations, particularly for high-risk systems. A deployer, the party that uses an AI system in the course of its activities, carries its own distinct set of obligations around how the system is operated. Importers and distributors that bring AI systems into or move them through the market carry further responsibilities. The practical implication is that an organization must first understand which role or roles it occupies, because a company can be a provider of one system and a deployer of another, and its obligations, and therefore its exposure, follow accordingly. Misjudging the role is a common way organizations underestimate their liability, assuming that using a third-party AI tool carries no obligations when the deployer role in fact carries several. Mapping the roles accurately is the first step in understanding where the penalties could actually land. How the Fines Are Calculated Beyond the tier ceilings, the actual fine in any case is set with reference to the circumstances, so the maximums are a cap rather than a default. Authorities are directed to consider factors such as the nature and gravity of the violation, whether it was intentional or negligent, the steps taken to mitigate harm, and the degree of cooperation, which means an organization’s conduct materially affects where within the range a fine falls. A good-faith program that detects and remediates an issue is treated very differently from willful or concealed non-compliance. The Act also builds in proportionality for smaller organizations. For small and medium enterprises and startups, the fine is generally capped at the lower of the applicable percentage or the fixed amount, rather than the higher, which prevents a single penalty from being existential for a small company in the way it could be for a large one. The principle is that the regime scales with the organization, so the exposure a company faces is a function of its size, its role, and above all its conduct. What Exposure Actually Looks Like Focusing only on the headline fine understates the exposure, because the financial penalty is one part of what non-compliance costs. Enforcement can also bring orders to withdraw or recall an AI system from the market, which for a company whose product is the AI system is a direct hit to revenue rather than a one-time fine. There is reputational damage that follows public enforcement, the operational cost of remediating under a deadline set by a regulator, and the commercial friction of customers and partners reassessing the relationship once a violation is known. Seen this way, the real exposure is to the business, not just the balance sheet, which is what makes the penalties a board-level concern rather than a compliance line item. It also reframes the value of compliance: the return is not only avoiding a fine but preserving market access, reputation, and customer trust. An organization that treats EU AI Act penalties as the whole risk misses the larger picture, while one that manages the underlying compliance protects against all of it at once. The Compliance Moves That Cap Exposure The moves
AI Policy Template: Every Section a Defensible Policy Needs
An AI policy template is worth using only if it contains the sections that make a policy defensible, because a policy that reads well but omits governance, risk, or oversight fails exactly when an organization needs it to hold. A corporate AI policy is increasingly expected by regulators, customers, and standards like ISO 42001, and the difference between one that protects the organization and one that sits unused is whether it covers the right ground and is actually followed. This guide walks the core sections a defensible AI policy needs, offers illustrative sample language, and maps the sections to ISO 42001 and the EU AI Act. The reason to think in terms of sections rather than a single downloadable document is that an AI policy has to fit the organization that adopts it. A template gives the structure, the sections every serious policy shares, while the substance of each section depends on how the organization uses AI, the risks it carries, and the rules it operates under. Used as a structure to adapt rather than a form to sign, a template produces a policy that is both defensible and genuinely used. What an AI Policy Template Should Cover A defensible AI policy covers more than acceptable use, which is the section most people think of first. It sets out why the policy exists and what it applies to, the principles that guide the organization’s use of AI, the rules for how people may and may not use AI tools, who is accountable for AI decisions and oversight, how AI risks and impacts are assessed and managed, how data used with AI is governed, where human oversight is required, how AI use is disclosed, and how compliance is monitored and enforced. Each section does a distinct job, and a policy missing any of them has a gap that surfaces under scrutiny. The organizing idea is that a policy has to govern AI, not just restrict it. Acceptable-use rules tell employees what not to do, but governance, risk, oversight, and monitoring are what make the policy a system an organization can stand behind to a regulator, an auditor, or a customer. Elevate’s EU AI Act ready AI governance policy suite provides a structured set of these documents as a starting point for organizations that want the full structure rather than a single acceptable-use page. The Core Sections of an AI Policy Template The table sets out the sections a defensible AI policy needs, what each covers, and why it matters. It is the structure to adapt, not a finished policy. Policy section What it covers Why it matters Purpose and scope Why the policy exists and which AI use it governs Sets boundaries and applicability Principles The organization’s commitments for responsible AI use Anchors decisions to stated values Acceptable use What people may and may not do with AI tools The section referenced most day to day Roles and governance Who owns AI decisions, approval, and oversight Establishes accountability Risk and impact How AI risks and impacts on people are assessed and managed Ties the policy to real risk Data and privacy How data used with AI is governed and protected Addresses a leading source of AI risk Human oversight Where a person must review or be able to intervene A core expectation of AI regulation Transparency How and when AI use is disclosed A trust and regulatory expectation Compliance and monitoring How adherence is checked, enforced, and reviewed Makes the policy defensible, not decorative The pattern across the sections is that the first few define intent and rules, the middle establish accountability and risk management, and the last make the policy enforceable and provable. A policy heavy on principles and acceptable use but light on governance, risk, and monitoring looks complete but is not defensible, because it states expectations without the machinery to uphold them. The sections that organizations most often underweight, roles and governance, risk and impact, and monitoring, are precisely the ones a regulator or auditor examines to see whether the policy is real. Sample Language for Key Sections Sample language helps illustrate what a section can look like, and the following are illustrative starting points to adapt, not legal text to adopt as written. A purpose section might read: “This policy governs how the organization develops, procures, and uses AI systems, and applies to all employees, contractors, and systems that process the organization’s data.” An acceptable-use section might read: “Employees may use approved AI tools for permitted business purposes and must not enter confidential, personal, or regulated data into AI tools that have not been approved.” A human-oversight section might read: “AI systems that materially affect individuals must provide for human review before a consequential decision takes effect, and a named owner is accountable for that review.” These samples show the register and specificity a policy needs, concrete enough to guide behavior, general enough to apply across cases, but they are not a substitute for legal review. Because AI regulation varies by jurisdiction and evolves quickly, any policy should be reviewed by qualified counsel for the organization’s specific circumstances before it is adopted. The value of the template is the structure and the prompts it provides, which make that review faster and more focused. How the Template Maps to ISO 42001 For organizations pursuing or aligning to ISO 42001, an AI policy is not optional but a requirement: the standard’s leadership clause requires top management to establish an AI policy. A template built around the sections above satisfies that requirement and connects to the wider management system, because the roles and governance section supports the standard’s leadership and accountability expectations, the risk and impact section aligns with its planning requirements, and the monitoring section supports its performance evaluation. The policy is, in effect, one of the foundational documents an ISO 42001 audit expects to see. Mapping the policy to the standard this way turns a standalone document into part of a coherent management system, which is what
AI Compliance: A 2026 Guide for Regulated Industries
AI compliance means meeting the legal, regulatory, and contractual obligations that govern how an organization develops and uses artificial intelligence. In 2026 that landscape moved quickly, with the EU AI Act now partly in force and standards such as ISO 42001 becoming common expectations. This guide explains what AI compliance involves, the rules and frameworks that apply, and how regulated industries can approach it without grinding their AI programs to a halt. What AI Compliance Is AI compliance is the practice of meeting external obligations for AI, which span laws such as the EU AI Act, sector regulations, data protection laws, and standards such as ISO 42001 and the NIST AI Risk Management Framework. It is distinct from AI governance. Governance is the internal system an organization builds to control AI, and compliance is one of the results that system is meant to produce. The Rules That Apply to AI The EU AI Act The EU AI Act is the world’s first comprehensive AI law. It takes a risk-based approach across four tiers, unacceptable, high, limited, and minimal, with fines reaching up to 35 million euros or 7 percent of global turnover. Its obligations apply in phases. Prohibited practices and AI literacy duties have applied since February 2025, obligations for general-purpose AI models since August 2025, and most remaining provisions, including transparency rules, from August 2026. The high-risk timeline shifted in 2026. Under amendments agreed in May 2026, obligations for use-based high-risk systems were deferred to December 2027, and for product-embedded high-risk systems to August 2028, subject to formal enactment. The Act applies beyond Europe, reaching any organization whose AI touches people in the EU. United States and Other Jurisdictions The United States has no single comprehensive federal AI law. Compliance there is shaped by sector regulators, state laws, and existing obligations rather than one statute. Other jurisdictions, including the United Kingdom, have so far relied on existing regulators rather than adopting a single cross-economy AI law. Data Protection Laws AI does not get a pass from existing privacy law. The GDPR and similar regimes apply concurrently whenever an AI system processes personal data, which means many AI use cases carry both AI-specific and data protection obligations at once. Standards That Carry Weight Beyond law, voluntary standards increasingly function as expectations. The ISO 42001 AI management system standard can be certified against, and the NIST AI Risk Management Framework provides widely referenced structure. Clients, partners, and regulators increasingly look for one or both. Mapping obligations to controls is the hard part. Elevate Consult helps regulated organizations get there. The ISO 42001 AI Governance Readiness Bundle gives you a structured foundation. Why AI Compliance Is Harder in Regulated Industries Financial services, healthcare, and the defense sector already carry heavy compliance loads, and AI rules now layer on top. A defense contractor managing CMMC requirements or a vendor navigating FedRAMP authorization levels must now fold AI obligations into programs that were already demanding. The frameworks overlap, but the evidence and accountability requirements multiply. How to Approach AI Compliance The path is the same regardless of industry, even if the obligations differ. How Elevate Consult Helps Organizations With AI Compliance Elevate Consult helps regulated organizations meet AI compliance obligations by mapping them to ISO 42001 and the NIST AI Risk Management Framework, alongside the cybersecurity frameworks many of these organizations already maintain. The aim is one coherent program rather than a separate scramble for each rule. Organizations facing AI compliance requirements can start a conversation with the Elevate team. Key Takeaways Frequently Asked Questions What is AI compliance? AI compliance is the practice of meeting the legal, regulatory, and contractual obligations that govern how an organization develops and uses AI. It spans laws such as the EU AI Act, sector regulations, data protection laws, and standards such as ISO 42001. Is the EU AI Act in force in 2026? Yes, in phases. Prohibited practices have applied since February 2025 and general-purpose AI obligations since August 2025, with most remaining provisions applying from August 2026. Under amendments agreed in 2026, certain high-risk obligations were deferred to 2027 and 2028, subject to formal enactment. Does the EU AI Act apply to companies outside the EU? Yes. The EU AI Act has extraterritorial reach. It applies to any organization whose AI systems are placed on the EU market or whose output is used in the EU, regardless of where the company is based. How does ISO 42001 help with AI compliance? ISO 42001 provides a certifiable AI management system that organizes governance, risk assessment, documentation, and lifecycle controls. It gives organizations a structured way to demonstrate responsible AI practices and supports readiness for regulations such as the EU AI Act. What are the penalties for violating the EU AI Act? Penalties are tiered. Prohibited practices can draw fines up to 35 million euros or 7 percent of global annual turnover, while other violations, including those by general-purpose AI providers, carry lower maximum fines. The exact figure depends on the nature of the breach.
AI Risk Management: A Framework for Enterprise AI Risk
AI risk management is the practice of identifying, assessing, and treating the risks that artificial intelligence creates for an organization, before those risks turn into incidents. As AI moves into decisions that affect customers, finances, and compliance, managing its risk has become a core discipline rather than an optional one. This guide explains what it is, the main types of AI risk, the steps in the process, and how it fits within broader governance. What AI Risk Management Is It is a repeatable discipline for keeping the risks of AI within an acceptable range. It borrows from traditional risk management, but AI introduces risk types that older programs were never built to handle, including bias, opacity, model drift, and the autonomy of systems that act on their own. It does not stand alone. It is a core function inside a broader program of AI governance, which sets the accountability and policy that risk work depends on. The Main Types of AI Risk Data and Privacy Risk AI systems consume large volumes of data, which creates exposure when that data is sensitive, regulated, or moved into tools the organization does not control. Bias and Fairness Risk Models can reproduce or amplify bias in their training data, leading to unfair outcomes in decisions such as hiring, lending, or access to services. Security Risk AI expands the attack surface through prompt injection, data poisoning, ungoverned shadow AI, and autonomous agents with broad permissions. These threats often fall outside the scope of traditional security reviews. Reliability and Accuracy Risk AI output can be confidently wrong. Hallucination and model drift mean a system that performed well at launch can degrade or mislead over time if it is not monitored. Compliance and Legal Risk Using AI in regulated ways without the right controls can breach laws and standards, from data protection rules to the obligations now arriving under AI-specific regulation. Elevate Consult helps organizations turn this list of risks into a managed program. The ISO 42001 AI Governance Readiness Bundle provides a structured starting point. The Risk Management Process Whatever framework an organization adopts, the underlying process is consistent. Managing AI Risk With Recognized Frameworks Two frameworks dominate this space. The NIST AI Risk Management Framework is, at its core, a structure for managing AI risk through its functions to govern, map, measure, and manage. The ISO 42001 standard embeds risk and impact assessment inside a certifiable management system. Aligning to one or both gives a risk program structure and credibility rather than a process invented from scratch. How Elevate Consult Helps Organizations Manage AI Risk Elevate Consult helps organizations build AI risk programs aligned to the NIST AI RMF and ISO 42001, from AI inventory and risk assessment through controls, monitoring, and documentation. The aim is a program that keeps AI risk visible and under control as the organization scales its use of AI. Organizations ready to manage AI risk deliberately can start a conversation with the Elevate team. Key Takeaways Frequently Asked Questions What is AI risk management? AI risk management is the practice of identifying, assessing, and treating the risks that artificial intelligence creates, so they stay within an acceptable range. It covers risks such as bias, data exposure, security, unreliable output, and compliance. What are the main types of AI risk? The main types are data and privacy risk, bias and fairness risk, security risk, reliability and accuracy risk, and compliance and legal risk. The same AI system can carry different risks depending on how and where it is used. How do you assess AI risk? Assess AI risk by inventorying your AI systems, identifying the risks for each use case, and rating those risks by likelihood and impact. Tiering risk this way lets you apply stronger controls and oversight to the systems that need them most. What is the difference between AI risk management and AI governance? AI governance is the overall system of accountability, policy, and oversight for AI. It is a core function within that system, focused specifically on identifying and treating AI risk. Governance sets the direction, and risk management does the work of keeping AI risk in check. How does the NIST AI RMF relate to AI risk management? The NIST AI RMF is essentially a structure for managing AI risk, organized around four functions: govern, map, measure, and manage. Many organizations use it as the backbone of their AI risk program.
Shadow AI Detection: How to Find and Govern It
Shadow AI detection is the practice of finding the unapproved AI tools and services employees are already using across an organization, so they can be brought under governance. You cannot govern what you cannot see, which makes detection the first practical step in any shadow AI program. This guide explains how shadow AI detection works, the methods that surface it, and how to govern it once it is found. Why Shadow AI Detection Comes First Most organizations underestimate how much unapproved AI is already in use. Free, browser-based tools require no installation and no purchase order, so they spread without ever appearing on IT’s radar. Shadow AI detection comes first because every later step, from risk assessment to policy, depends on knowing what is actually running. For a fuller picture of the underlying problem, see the guide on AI governance frameworks. How to Detect Shadow AI No single method catches everything. Effective programs combine several signals. Employee Surveys and Self-Disclosure Asking directly, without blame, often surfaces tools no monitoring would catch. A short anonymous survey is the fastest way to begin and frequently reveals the scale of the problem. Network and Traffic Monitoring Outbound traffic and DNS logs show connections to known AI services. Monitoring egress to AI domains is one of the most reliable ways to detect shadow AI at the network level. Endpoint and Browser Visibility Because much of this activity runs in the browser, endpoint and extension visibility catches what network logs miss. Browser extensions and installed apps both leave traces worth reviewing. Identity and SaaS App Discovery Single sign-on logs, OAuth grants, and cloud access security tools reveal which AI applications employees have connected to corporate accounts. This identity layer is often the richest source of discovery. Expense and Procurement Signals Individual AI subscriptions on expense reports and corporate cards point to paid tools in use outside any review. Finance data is an easy signal that is frequently overlooked. From Detection to Governance Finding the tools is only the start. Detection has to feed governance, or the same problem returns within months: Elevate Consult helps organizations detect shadow AI and turn what they find into a governed program. The ISO 42001 AI Governance Readiness Bundle provides the structure. Shadow AI Detection and AI Governance Detection produces the inventory that every governance framework relies on. The ISO 42001 standard and the NIST AI Risk Management Framework both assume an organization knows what AI it operates. Without detection, that inventory is incomplete, and governance rests on a false picture of reality. How Elevate Consult Helps Organizations Detect and Govern Shadow AI Elevate Consult helps organizations stand up shadow AI detection and connect it to a governance program aligned to ISO 42001 and the NIST AI Risk Management Framework. The work moves from discovery through inventory, risk assessment, and policy, so unapproved tools become managed ones rather than blind spots. Teams ready to find and govern the AI already in use can start a conversation with the Elevate team. Key Takeaways Frequently Asked Questions What is shadow AI detection? Shadow AI detection is the practice of finding the unapproved AI tools and services employees use across an organization, so they can be brought under governance. It is the first step in any shadow AI program because controls cannot be applied to tools no one knows about. What methods are used to detect shadow AI? Common methods include anonymous employee surveys, network and DNS traffic monitoring for connections to AI services, endpoint and browser visibility, single sign-on and OAuth app discovery, and expense or procurement signals. Effective programs combine several of these rather than relying on one. Can you detect shadow AI with existing security tools? Often, yes. Cloud access security brokers, DNS and network monitoring, and single sign-on logs already in place can surface much shadow AI usage. The gap is usually not tooling but the decision to look and to treat the findings as a governance priority. What do you do after detecting shadow AI? After detection, organizations should catalogue each tool in an AI inventory, assess the risk of each one, provide sanctioned alternatives, bring approved tools under an acceptable use policy, and monitor continuously. Detection feeds governance rather than ending the work. Why is detecting shadow AI difficult? Detecting shadow AI is difficult because many tools are free, browser-based, and require no installation or purchase, so they never appear in procurement or software inventories. Usage is also distributed across individuals, which is why several detection signals are needed to see the full picture.
EU AI Act Timeline: The New Deadlines After the 2026 Omnibus
The EU AI Act timeline just changed. On 16 June 2026, the European Parliament approved a package of amendments known as the digital omnibus that postpones the heaviest obligations of the AI Act by one to two years, delays one transparency requirement, and adds a new prohibition. The changes still need formal adoption by the Council before they become law, but the direction is set. This article lays out the new EU AI Act timeline, what moved, what did not, and what it means for organizations preparing to comply. What Changed in the EU AI Act Timeline The European Parliament approved the digital omnibus on 16 June 2026 by 423 votes to 57, with 174 abstentions. The package is designed to give organizations more time to comply while keeping the risk-based architecture of the AI Act intact. In short, it postpones the high-risk obligations, delays the provider watermarking requirement, bans a category of harmful AI, and reduces overlaps with other EU laws. It is not yet final: the Council must still formally adopt it, which is expected before 2 August 2026. For how the AI Act sits alongside other frameworks, see the guide on EU AI Act compliance compared with NIST and ISO 42001. The New High-Risk Deadlines The most significant change is the postponement of obligations for high-risk AI systems: The extra time is intended to let the necessary technical standards and guidance be finalized first, since much of what organizations need to comply was not going to be ready in time. What Did Not Move: Transparency Stays in August 2026 This is the part most easily misread. Most of the AI Act’s transparency obligations under Article 50 still apply from 2 August 2026, including the duty to tell people when they are interacting with an AI system such as a chatbot, and the duty for those deploying AI to clearly label deepfakes and AI-generated text published on matters of public interest. Only one transparency rule moved. The provider obligation to embed machine-readable marking in AI-generated content, the watermarking requirement, is delayed to 2 December 2026, and that extension applies to generative systems already placed on the market before 2 August 2026. Systems launched after that date are expected to comply right away. In other words, the labelling duties most organizations face are still arriving in August, and only the technical marking piece gets a short reprieve. A New Prohibition: The Nudifier Ban The omnibus also adds a new prohibited practice to Article 5 of the AI Act. It bans AI systems that generate child sexual abuse material or that create intimate or sexually explicit images, video, or audio of an identifiable person without consent. The prohibition applies to both providers placing such systems on the EU market and deployers using them for that purpose, with compliance required by 2 December 2026. There is a safe harbour for systems that include adequate technical safeguards to prevent this misuse. The practical implication is concrete: any organization offering general-purpose image or media generation needs documented preventive safeguards as part of its risk management, not as an afterthought. Other Changes Worth Knowing The Complete EU AI Act Timeline at a Glance This EU AI Act timeline reflects the package approved by Parliament on 16 June 2026 and remains subject to formal adoption by the Council. What Organizations Should Do Now Elevate Consult helps organizations turn the AI Act timeline into a working compliance plan. The ISO 42001 AI Governance Readiness Bundle is a structured place to start. How Elevate Consult Helps Elevate Consult helps organizations interpret the EU AI Act timeline and build governance programs aligned to it and to ISO 42001 and the NIST AI Risk Management Framework. The work spans scoping and classification, transparency and labelling controls, and the documentation that demonstrates a credible path to compliance as the deadlines approach. Organizations preparing for the AI Act can start a conversation with the Elevate team. Key Takeaways Frequently Asked Questions What is the new EU AI Act timeline? Under the digital omnibus approved by the European Parliament on 16 June 2026, high-risk obligations move to 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for Annex I embedded systems. Most Article 50 transparency obligations still apply from 2 August 2026, while the provider watermarking requirement moves to 2 December 2026, the same date by which a new ban on nudifier systems must be met. The package still requires formal adoption by the Council. Did the EU delay the AI Act? In part. The European Parliament approved a package on 16 June 2026 that postpones the high-risk AI obligations by roughly one to two years and delays the provider watermarking requirement to 2 December 2026. It does not repeal the AI Act or change its risk-based architecture, and most other deadlines, including most transparency obligations in August 2026, remain in place. The changes still need formal adoption by the Council. When do high-risk AI obligations apply under the EU AI Act? Under the approved changes, obligations for stand-alone high-risk AI systems listed in Annex III apply from 2 December 2027, and obligations for high-risk AI embedded as safety components in regulated products listed in Annex I apply from 2 August 2028. These replace the earlier dates of 2 August 2026 and 2 August 2027. Are the EU AI Act transparency rules delayed? Mostly no. The duties to disclose AI chatbots and to label deepfakes and AI-generated public-interest text still apply from 2 August 2026. Only the provider obligation to embed machine-readable marking in AI-generated content, the watermarking requirement, moves to 2 December 2026, and that extension applies to generative systems placed on the market before 2 August 2026. What is the EU nudifier ban? The digital omnibus adds a prohibition to Article 5 of the AI Act on AI systems that generate child sexual abuse material or that create intimate or sexually explicit imagery of an identifiable person without consent. It applies to providers and deployers, takes effect on 2 December 2026, and includes a safe
Enterprise AI Governance: A Guide for Boards and Leadership
Enterprise AI governance is the way an organization’s board and senior leadership direct, oversee, and remain accountable for the use of AI across the entire business. As AI moves into decisions that shape revenue, risk, and reputation, oversight of it has become a board-level duty rather than a technical detail. This guide explains what enterprise AI governance involves, the board’s specific role, and how leadership can govern AI at scale. What Enterprise AI Governance Is Enterprise AI governance is governance applied at the level of the whole organization, not a single team’s policy. It is the direction, accountability, and oversight that leadership sets so that every business unit uses AI within the same guardrails. The defining feature is ownership: at enterprise scale, responsibility for AI sits with the board and executive leadership, not only with technology teams. The mechanics of building it out are covered in the broader guide on AI governance frameworks. The Board’s Role in AI Governance A board does not run AI. Its job is to ensure AI is run responsibly. That means setting the organization’s risk appetite for AI, requiring clear accountability beneath them, ensuring the program is properly resourced, and asking management the questions that surface risk before it becomes a problem. The distinction matters. Boards that try to operate AI overstep, and boards that ignore it leave the organization exposed. Effective oversight sits between the two: informed, demanding, and accountable without being operational. What Leadership Must Put in Place For oversight to be real, leadership has to stand up a few essentials: a named executive owner for AI risk, an enterprise policy that applies across business units, an inventory of AI systems spanning the whole organization, regular risk reporting that reaches the board, and alignment to a recognized standard so the program is consistent and defensible. Without these, board oversight becomes a conversation with no evidence behind it. Questions Boards Should Ask About AI A board does not need to understand the technology in depth to govern it well. It needs to ask the right questions: Elevate Consult helps boards and leadership turn these questions into a working oversight program. The ISO 42001 AI Governance Readiness Bundle gives leadership a structured foundation. Enterprise AI Governance and Recognized Frameworks Recognized standards make leadership oversight concrete. The ISO 42001 standard places explicit responsibility on top management for the AI management system, and the NIST AI Risk Management Framework puts governance at the center of its structure. Aligning the enterprise to one or both gives the board a defensible answer when asked how AI is controlled. How Elevate Consult Helps Boards and Leadership Govern AI Elevate Consult helps boards and executive teams establish AI oversight aligned to ISO 42001 and the NIST AI Risk Management Framework, from executive accountability and enterprise policy through board-level risk reporting. The aim is governance leadership can stand behind and demonstrate to regulators, clients, and the board itself. Boards and leadership teams ready to strengthen AI oversight can start a conversation with the Elevate team. Key Takeaways Frequently Asked Questions What is enterprise AI governance? Enterprise AI governance is organization-wide direction, accountability, and oversight of how AI is used, owned by the board and senior leadership rather than a single team. It ensures every business unit uses AI within the same guardrails and that someone at the top is accountable for the risk. What is the board’s role in AI governance? The board oversees rather than operates AI. Its role is to set the organization’s risk appetite for AI, require clear accountability beneath it, ensure the program is resourced, and ask management the questions that surface risk. It does not run AI systems itself. What questions should a board ask about AI? A board should ask where AI is used and the risk of each use, who is accountable for AI risk, how the organization knows its AI is compliant, what its exposure to shadow AI is, and whether it is aligned to a recognized framework and can prove it in an audit. How does enterprise AI governance differ from a single AI policy? A single AI policy sets rules for one team or use case. Enterprise AI governance is the broader system of leadership accountability, inventory, risk reporting, and oversight that applies consistently across the whole organization. The policy is one component within it. Does ISO 42001 require board involvement? ISO 42001 places explicit responsibility on top management for the AI management system, including leadership commitment and accountability. While it does not name the board specifically, it requires senior leadership to own and direct AI governance.
AI Audit: What It Covers and How to Prepare
An AI audit is an independent review of how an organization builds, uses, and governs artificial intelligence, measured against a standard, regulation, or risk framework. As AI takes on more consequential decisions, this kind of review has become the way organizations prove their AI is controlled, fair, and compliant. This guide explains what it covers, the main types, and how to prepare for one. What an AI Audit Is It is a structured, independent evaluation of an organization’s AI systems, the controls around them, and the governance that directs them. It is not a penetration test, which probes for technical weaknesses, and it is broader than a general IT audit. Its purpose is to give an objective answer to a simple question: is this organization’s AI actually under control? Independence is what gives the result its weight. A review carries more credibility when the party performing it is separate from the team that built the systems being examined. Types of AI Audit Governance and Management System Audits These assess an organization’s AI management system against a standard such as ISO 42001, checking that governance, policies, and controls are in place and operating. Risk and Controls Audits These examine whether the organization has identified its AI risks and applied controls that match, often using the NIST AI Risk Management Framework as the benchmark. Bias and Fairness Audits Sometimes called algorithmic audits, these evaluate specific models for biased or unfair outcomes, which matters most for AI used in decisions about people. Regulatory and Compliance Audits These check AI use against legal obligations, such as the conformity requirements arriving under AI-specific regulation, and against the broader landscape of AI governance frameworks. What an Audit Covers Across these types, an audit generally examines a common set of areas: the inventory of AI systems, the policies governing their use, risk and impact assessments, the controls applied to each system, the evidence and documentation behind them, monitoring practices, and the oversight of third-party and vendor AI. The thread running through all of it is evidence. An audit tests not whether an organization says it governs AI, but whether it can show it. Elevate Consult helps organizations get audit-ready before the auditor arrives. The ISO 42001 AI Governance Readiness Bundle is built for exactly this. How to Prepare for an Audit Preparation is the difference between an audit that confirms control and one that exposes gaps. ISO 42001 Audits and Certification For many organizations, the most consequential audit is the certification audit for ISO 42001, conducted by an accredited certification body. That certification audit must be independent from the work that prepared the organization for it. A readiness partner helps an organization become audit-ready and can run internal audits, while the formal certification is performed by a separate accredited body. Keeping those roles distinct protects the integrity of the result. How Elevate Consult Helps Organizations Prepare for Audits Elevate Consult helps organizations prepare for audits aligned to ISO 42001 and the NIST AI Risk Management Framework, through readiness assessments, internal audits, evidence organization, and gap remediation. The goal is an organization that walks into its certification audit ready to pass, with a clear separation between readiness support and the independent certifying body. Organizations preparing for an audit can start a conversation with the Elevate team. Key Takeaways Frequently Asked Questions What is an AI audit? An AI audit is an independent, structured review of how an organization builds, uses, and governs AI, measured against a standard, regulation, or risk framework. It evaluates AI systems, the controls around them, and the governance directing them. What does an AI audit cover? An AI audit typically covers the inventory of AI systems, governing policies, risk and impact assessments, applied controls, supporting evidence and documentation, monitoring practices, and oversight of third-party AI. The common thread is whether the organization can demonstrate, with evidence, that its AI is controlled. How do you prepare for an AI audit? Prepare by building an AI inventory, documenting your governance, keeping audit-ready evidence such as risk and impact assessments, mapping controls to the relevant standard, and running an internal audit or readiness review to close gaps before the external audit. What is the difference between an AI audit and an ISO 42001 audit? An ISO 42001 audit is a specific type of audit that evaluates an organization’s AI management system against the ISO 42001 standard, and the certification version is performed by an accredited body. The broader term AI audit also includes risk, bias, and regulatory reviews that are not tied to a single standard. Who performs an AI audit? Internal audits can be run by an organization’s own team or an advisor, while formal certification audits, such as for ISO 42001, must be performed by an independent accredited certification body. A readiness partner prepares the organization but does not perform its own certification.
Labeling AI-Generated Content: What the EU AI Act Requires
Labeling AI-generated content is about to become a legal requirement in the European Union. In June 2026, the European Commission published a voluntary Code of Practice to help organizations meet the AI Act transparency obligations that apply from 2 August 2026. This article explains what must be labeled, what the new Code does, and what it means for any organization whose AI content reaches the EU. What the EU AI Act Requires for Labeling AI-Generated Content The requirement comes from Article 50 of the AI Act, the section that sets transparency obligations for providers and deployers of generative and interactive AI systems. These obligations arrive on two dates, following the digital omnibus approved by the European Parliament in June 2026. From 2 August 2026, deployers must clearly label deepfakes and AI-generated or AI-manipulated text published to inform the public on matters of public interest, and anyone deploying an interactive system such as a chatbot must tell people they are interacting with AI rather than a human. The provider duty to mark AI-generated or AI-manipulated audio, image, video, and text in a machine-readable format, so the content can be detected as artificial, applies from 2 December 2026 for generative systems already on the market before 2 August 2026, with systems launched after that date expected to comply right away. These rules sit within the broader risk-based structure of the AI Act. For how that structure compares with other frameworks, see the guide on EU AI Act compliance alongside NIST and ISO 42001. What the New Code of Practice Does, and Does Not Do On 10 June 2026, the European Commission published the final Code of Practice on marking and labeling of AI-generated content. It was drafted by independent experts through a stakeholder process and is organized into two parts: one for providers, covering machine-readable marking and detection, and one for deployers, covering the labeling of deepfakes and public-interest text. Taken together, it is the EU’s most concrete guidance yet on labeling AI-generated content. The critical point is what the Code is not. It is voluntary, and signing or following it does not by itself prove compliance with the AI Act. It is a practical route to meeting the obligations, not a substitute for them. Organizations remain responsible for satisfying Article 50 whether or not they adopt the Code. What Content Must Be Labeled The obligations target the content most likely to deceive: There are exceptions. Labeling obligations are eased where AI-generated text has undergone human review and sits under editorial responsibility, and where AI performs an assistive or minor editing function. The exact boundaries are part of what the Commission’s accompanying guidelines aim to clarify. The EU Icons for AI-Generated Content To make disclosure consistent, the Commission has published a set of standardized icons for marking AI-generated content. Standard marks matter because labeling only works if readers, regulators, and courts recognize and trust the same signal. Organizations can review the official set on the Commission’s EU Icons for labelling AI-generated content page. Does This Apply to US Companies? Often, yes. The AI Act reaches beyond the borders of the EU. A company based in the United States can fall within scope when it places a generative AI system on the EU market, or when the AI-generated output it produces is used in the EU, regardless of where the company itself is located. For many US organizations publishing content, running chatbots, or shipping AI features that reach European users, the transparency obligations are not optional and the 2 August 2026 date is real. Because applicability turns on specific facts, organizations should assess their own exposure rather than assume distance from Europe puts them outside the rules. How to Prepare for Labeling AI-Generated Content Preparing for labeling AI-generated content is less about a single tool and more about knowing where AI touches the content you publish: Elevate Consult helps organizations turn AI transparency rules into a working program. The ISO 42001 AI Governance Readiness Bundle is a structured place to start. How Elevate Consult Helps Elevate Consult helps providers and deployers prepare for the AI Act transparency obligations as part of a governance program aligned to ISO 42001 and the NIST AI Risk Management Framework. The work spans AI inventory, policy, labeling and provenance controls, and the evidence that demonstrates a good-faith path to compliance. Organizations that want to be ready before 2 August 2026 can start a conversation with the Elevate team. Key Takeaways Frequently Asked Questions What does the EU AI Act require for labeling AI-generated content? Under Article 50 of the AI Act, deployers must clearly label deepfakes and AI-generated text published on matters of public interest, and people must be told when they are interacting with an AI system such as a chatbot. These deployer and disclosure duties apply from 2 August 2026. The separate provider duty to embed machine-readable marking in AI-generated audio, image, video, and text applies from 2 December 2026 under the June 2026 digital omnibus, for generative systems already on the market before 2 August 2026. When do the EU AI Act transparency rules apply? Most apply from 2 August 2026, including the duty to label deepfakes and AI-generated public-interest text and to disclose AI chatbots. The provider duty to embed machine-readable marking in AI-generated content was moved to 2 December 2026 by the digital omnibus approved in June 2026, with a grandfathering allowance for generative systems already on the market before 2 August 2026. Is the EU Code of Practice on AI labeling mandatory? No. The Code of Practice published on 10 June 2026 is voluntary. Following or signing it can support a demonstration of compliance with the AI Act, but it does not by itself establish compliance. The underlying Article 50 obligations are mandatory regardless of whether an organization adopts the Code. Does the EU AI Act apply to US companies? It can. The AI Act applies beyond the EU when a company places a generative AI system on the EU market or when the AI-generated output it