EU AI Act · ISO/IEC 42001:2023
How ready is your organisation for the EU AI Act?
58 requirements integrating the AI Act (with the Digital Omnibus amendments), the GDPR provisions it relies on, and the Annex A controls of ISO/IEC 42001:2023. You get compliance percentages, prioritised gaps, guidance and a PDF report. Usable by any organisation established or operating in the EU; national implementing laws are out of scope.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: compliance % by area, by source and by control group; P1/P2 gaps.
- PDF report: results, prioritised action plan with guidance, control map, roadmap.
58 requirements · 12 assessment areas · mapped to ISO 42001 · 45-90 minutes
Assessment areas
- GOV – Governance, roles and AI policy
Start with a mandate from top management: an AI policy, a cross-functional AI committee and a named owner for every system. The legal role (provider / deployer / importer / distributor) must be determined per system and re-examined whenever a system is rebranded, substantially modified or repurposed (Art. 25). - INV – Inventory and risk classification
No inventory, no compliance. Capture AI embedded in SaaS and individual use of generative tools. Classify with a decision tree (prohibited -> Annex I -> Annex III -> Art. 50 -> minimal) and re-classify on every change of intended purpose. - PRO – Prohibited practices
Add a mandatory gate to project and procurement processes using an Art. 5 checklist. Pay attention to emotion recognition at work and in education, and to the new prohibitions applicable from 2 December 2026 (Digital Omnibus). - LIT – AI literacy and competence
Art. 4 remains in force after the Digital Omnibus: adopt documented, role-proportionate measures. Three tiers (all staff, users of critical systems and system owners, developers/compliance), repeated yearly and on each new system. - TRA – Transparency and synthetic content
Art. 50 obligations apply from 2 August 2026: chatbot disclosure, machine-readable marking of synthetic content (legacy systems by 2 December 2026), deepfake labelling, and disclosure of AI-generated text on matters of public interest unless under human editorial responsibility. - HRP – High-risk systems – provider obligations
For providers of high-risk systems 2027 is the preparation year: risk management, data governance, Annex IV technical file, logging, human oversight design, accuracy/robustness/cybersecurity testing, QMS, conformity assessment, EU database registration and post-market monitoring. Annex III systems: 2 December 2027; Annex I systems: 2 August 2028. - HRD – High-risk systems – deployer obligations
Deployers must use systems per the provider's instructions, assign competent human overseers, monitor and keep logs (>= 6 months), inform workers and affected persons, and carry out a fundamental rights impact assessment (FRIA) where required. - GPA – General-purpose AI models
Model providers: Annex XI/XII documentation, copyright policy honouring TDM opt-outs, public training-data summary; systemic-risk models add evaluations, red teaming, incident reporting and cybersecurity. Downstream integrators: obtain and assess the downstream information package. - DAT – Data protection and data governance
Involve the DPO in every AI project; combine DPIA, FRIA and the ISO 42001 impact assessment in one procedure; guarantee meaningful human review of automated decisions (GDPR Art. 22); document data sources and quality controls for every system. - TPR – Supply chain, suppliers and customers
AI due diligence in procurement, standard contractual clauses (information, assistance, audit, incidents, indemnities) based on the Commission's model clauses, and customer documentation aligned with real system capabilities. - MON – Incidents, monitoring and improvement
Define 3-5 KPIs per system (accuracy, drift, human-override rate, complaints), integrate AI incidents into the existing incident process with Art. 73 timelines (2/10/15 days), and maintain a post-market monitoring plan. - AMS – AI management system (ISO/IEC 42001)
An ISO/IEC 42001 AIMS gives a structured, auditable way to demonstrate compliance and underpins the Art. 17 QMS. Use the control map of this tool as the basis for the Statement of Applicability; plan internal audits and management reviews.
Key regulatory dates
| Date | Source | Status | |
|---|---|---|---|
| 02/02/2025 | AI Act | Prohibited practices (Art. 5) and AI literacy (Art. 4) | In force |
| 02/08/2025 | AI Act | GPAI model obligations, EU governance, penalties regime | In force |
| 02/08/2026 | AI Act (Digital Omnibus) | Art. 50 transparency obligations; Commission fines for GPAI providers | In force |
| 02/12/2026 | AI Act (Digital Omnibus) | New prohibitions (non-consensual sexual content, CSAM); Art. 50(2) marking for systems already on the market | Imminent – priority |
| 02/08/2027 | AI Act | Compliance of GPAI models placed before 02/08/2025; national sandboxes operational | Future |
| 02/12/2027 | AI Act (Digital Omnibus) | High-risk obligations for Annex III systems (Art. 8-27, FRIA, registration, Art. 86) | Future – prepare in 2027 |
| 02/08/2028 | AI Act (Digital Omnibus) | High-risk obligations for Annex I systems (safety components of regulated products) | Future |
Frequently asked questions
Is the EU AI Act self-assessment free?
Yes. The tool is free, requires no account and stores nothing on our servers: the assessment runs entirely in your browser and you download the PDF report and an optional save file to your computer.
Which standard is the EU AI Act assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 42001:2023. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
Compliance, legal, IT security and risk functions of organisations established or operating in the EU; it is a self-assessment and does not constitute legal advice.
How up to date is the regulatory content?
The regulatory snapshot is dated 2026-10-31 (version 1.0). Proposals not yet adopted are labelled as such. References point to official sources (EUR-Lex, European authorities, ISO).
Other assessments
- GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
Self-assessment tool for information purposes only; it does not constitute legal advice. References and dates must be verified against the official texts (EUR-Lex). No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.