Secure AI Deployment

Q: When do the obligations for high-risk AI take effect?

Later than originally planned. Regulation (EU) 2026/1744 has postponed the deadlines: to December 2, 2027, for standalone high-risk systems under Annex III, and to August 2, 2028, for systems embedded in products. The original deadline of August 2, 2026, has thus been eliminated.

Q: Do we need a management system in accordance with ISO 42001?

It is not mandatory. ISO/IEC 42001:2023 describes a management system for artificial intelligence and can be integrated with an existing ISMS based on ISO 27001. However, certification does not confer a presumption of conformity under the AI Act; a harmonized standard for this purpose is currently lacking.

Q: How do we get started?

Start with an assessment: Which AI systems do you use, in what capacity – as a provider or an operator – and what risk class do they fall into? This classification is essential for even knowing which deadlines apply to you. It’s worth doing regardless of the postponement.

Q: What is shadow AI, and why is it a problem?

AI tools that departments implement on their own without IT or information security being aware of them. The problem isn’t the tool itself, but the lack of visibility: Without knowledge of the systems in use, it’s impossible to determine a risk class, enforce a policy, or provide information.

Using Artificial Intelligence Safely and Profitably

Artificial intelligence offers companies enormous potential for increased efficiency, automation, and innovation. At the same time, regulatory requirements – particularly those under the EU AI Act – are increasing, as are the expectations of customers and partners regarding the responsible and secure use of AI.

Companies therefore face the challenge of implementing AI correctly – not only from a technological standpoint, but also from an organizational, legal, and security perspective. We help companies systematically integrate the secure use of AI into their ISMS – taking into account the requirements of ISO/IEC 27001 as well as the interfaces with ISO/IEC 42001 and the EU AI Act.

With a structured AI strategy, you’ll benefit from:

Efficiency gains through automation and intelligent processes
Better decision-making through data-driven analytics
Competitive advantages through innovative business models
Legal certainty in dealing with regulatory requirements
Transparency and control over the AI systems in use

How we support you in implementing AI for security

We guide you from the initial idea to the secure and compliant implementation of AI in your organization:

Identification and evaluation of suitable AI use cases
Conducting maturity analyses and potential assessments
Development of a customized AI strategy and roadmap
Support in selecting and integrating suitable AI solutions
Assessment of risks (e.g., data protection, IT security)
Implementation of governance structures in accordance with the EU AI Act
Training and raising awareness among your employees

Our approach combines innovation with security – practical, structured, and aligned with your business goals.

AI governance and accountability

The use of AI requires clear responsibilities and robust processes. Issues such as traceability, transparency, risk management, and compliance are increasingly coming under the scrutiny of regulatory authorities and auditors.

We support you in establishing a robust AI governance framework:

Integrating AI into existing management systems (e.g., ISMS, data protection)
Establishing control and monitoring mechanisms
Preparing for regulatory requirements and audits

Why we’re the right partner

Our AI consulting combines technological expertise with in-depth know-how in information security, data protection, and compliance:

Experience in regulated environments and security-critical industries
A combination of AI expertise and ISMS/governance expertise
A practical approach focused on feasibility and added value
Support from strategy through to operational implementation

Our goal is not only to successfully launch your AI initiatives but also to operate them in a sustainable, secure, and compliant manner.

FAQs

Which obligations under the EU AI Act are already in effect today?

Two apply to virtually every company that uses AI: the AI competence requirement under Article 4, which has been in effect since February 2, 2025, and the transparency obligations under Article 50, which have been in effect since August 2, 2026. For Article 4, simply using an AI assistant in day-to-day work is sufficient; a company does not need to have its own AI application.

When do the obligations for high-risk AI take effect?

Do we need a management system in accordance with ISO 42001?

How do we get started?

What is shadow AI, and why is it a problem?

TISAX^® is a registered trademark of the ENX Association. The mention of the TISAX^® trademark does not imply any statement by the trademark owner regarding the suitability of the services advertised here. The exclusive responsibility for the content of the website and the services presented here lies with abat.

Our customers in the area protect

Saskia

ISMS Consultant
Bremen

For me, abat is: fun, exciting projects - great customers and colleagues packed into a respectful and trusting atmosphere with plenty of room for continuous development!