Most AI systems your company deploys will face one AI Act obligation: AI literacy. The heavy requirements apply to high-risk systems, which the Luxembourg data protection regulator expects to make up about 10 to 15% of AI systems on the market. If you run one of those, you have until December 2027 for most of the rules, and the choice of how to prove compliance is already open.
That was the starting point of "AI Compliance and Certification", a webinar the European Centre for Certification and Privacy (ECCP) held on 26 October. Sébastien Ziegler, President of the Europrivacy International Board of Experts, chaired a panel of a regulator, a certification body and a legal researcher. Each speaker covered one way to show compliance. Below is what we took from it for companies that build or deploy AI in their operations.
What the AI Act Asks, and When
Alain Herrmann is a Commissioner at the CNPD, Luxembourg's data protection authority. Under Luxembourg's draft law implementing the AI Act, the CNPD becomes the country's main AI regulator and market surveillance authority. He described the Act as product regulation: it governs the AI system placed on the market, with obligations scaled to risk.
The timeline he gave:
- Since 2 February 2025, prohibited practices are banned, including social scoring, harmful manipulation, facial image scraping and emotion recognition.
- Since August 2026, Article 50 transparency rules apply. If a customer talks to your chatbot, they must know it is an AI system.
- In December 2026, two bans added by the AI omnibus take effect: non-consensual intimate AI content and child sexual abuse material.
- In December 2027, most obligations for high-risk systems apply. The last part follows on 2 August 2028.
Herrmann's warning on these dates was blunt. They are the dates by which you must be compliant, not the dates to start working on it.
High-risk systems are listed in Annex III of the Act. His examples were AI used in employment, in education and in public services. If an agent screens candidates or processes student data, check it against that list first.
Three Ways to Show Compliance
The panel compared three instruments. They answer different questions, so they are not interchangeable.
CEN-CENELEC harmonised standards. The European Commission asked CEN-CENELEC for ten standards that map to the AI Act's requirements. A high-risk system that conforms to them is presumed to conform to the Act. So far only one is adopted: EN 18286, a quality management system standard covering Article 17, published in July. Giovanni Francescutti, Global Technical Manager at DNV, said it mainly targets providers of high-risk systems in the EU, and certification against it is at an early stage. Herrmann added that the standards are voluntary. A company can meet the same requirements by other means.
ISO/IEC 42001. Published in 2023, it is a global standard for an AI management system: roles, risk analysis, controls, KPIs and continuous improvement. Francescutti said hundreds of certificates have already been issued. Its scope is wider than EN 18286. It covers providers and developers, and also companies that use AI in their own business processes without selling AI tools. The trade-off is that it is a business standard, valid worldwide, so mapping it to the AI Act is your own work.
AIA Cert. Vasiliki Tsiompanidou of ECCP presented this scheme. It certifies specific AI processing or a specific service rather than the company's management system. Its criteria cover the AI Act, the OECD AI Principles (adopted in 2019 and updated in 2024) and the Council of Europe Framework Convention on AI, and each criterion is mapped to the article or principle it comes from. It does not give a presumption of conformity. Its purpose is to reduce legal risk and show customers and partners that a service meets the rules in more than one jurisdiction.
How to Pick
The speakers agreed on one point: every scheme here is voluntary, so begin by deciding what you need to prove and to whom.
- You provide a high-risk system in the EU and need a route to conformity: the CEN-CENELEC standards, starting with EN 18286.
- You use AI across your operations and want customers to see it is governed: ISO/IEC 42001.
- You want one service checked against legal obligations in several jurisdictions: AIA Cert.
Herrmann drew one more line. AI Act compliance concerns the product. When your AI system processes personal data, you are also under the GDPR, and that is a separate question with its own evidence.
Two practical points stood out. Francescutti's advice was to define the scope first, start with one small process and extend later. Ziegler noted that you can use a scheme's criteria as a self-assessment checklist without asking anyone to certify you. For a company that is not sure yet where it stands, that is a low-cost first step.
What This Means if You are Automating With AI
If an agent you are building touches hiring, education or public services, count back from December 2027. Francescutti walked through what certification involves: a document review, an initial audit, then a three-year certificate with an audit every year. At the initial audit, the auditor asks for evidence that you have already measured your controls, so the work has to be running before you book it.
Cody is certified to ISO/IEC 42001:2023, the AI management system standard described above, so the AI we build for clients is governed under a certified system. Our ISO/IEC 27001:2022 certification covers information security, which is where the GDPR side of an AI project sits. We also hold ISO 9001:2015, ISO/IEC 20000-1:2018 and ISO 14001:2015.
Watch the full recording on the Europrivacy YouTube channel: ECCP Webinar: AI Compliance and Certification.
