Table of Contents

Reach SOC 2 Compliance in 6 Weeks or Less.

  /

  / ISO 14001:2015 vs ISO 14001:2026: Key Differences and What’s Changed

ISO 14001:2015 vs ISO 14001:2026: Key Differences and What’s Changed

ISO 14001:2026 was published on 15 April 2026. Over 600,000 organizations in more than 180 countries are currently certified to the previous edition, and all of them have until approximately May 2029 to transition.

The revision is not a rebuild, but it is not cosmetic either. It sharpens several requirements that were inconsistently applied under the 2015 standard, introduces a formally new clause on change management, and embeds climate change, biodiversity, and lifecycle thinking more directly into the Environmental Management System (EMS) framework.

This article explains what has changed, what has not, and what certified organizations need to do next.

What Is ISO 14001 and Why Is It Being Updated?

A Brief Overview of ISO 14001

ISO 14001 is the internationally recognized standard for Environmental Management Systems (EMS). Published by the International Organization for Standardization (ISO), it gives organizations a structured framework for managing environmental impacts, meeting legal obligations, and pursuing continual improvement in environmental performance. The standard applies to organizations of any size, in any sector, anywhere in the world, and more than one million sites globally are currently certified against it.

Its value lies not in prescribing specific environmental outcomes, but in building the management system infrastructure that makes consistent, improving performance possible. Whether an organization is a manufacturer managing chemical discharge or a logistics provider tracking fuel consumption, ISO 14001 provides the same underlying framework for setting objectives, measuring performance, and driving improvement.

Why ISO 14001:2015 Is Being Revised

The 2015 version replaced ISO 14001:2004 and introduced several significant advances: risk-based thinking, a stronger link to organizational strategy, and the Harmonized Structure that aligned ISO 14001 with ISO 9001 and ISO 45001. It was a substantial step forward. But the environment it was designed for has changed.

Climate change is now a core business risk, not a future projection. Biodiversity loss is accelerating. ESG reporting obligations have multiplied. Investors and regulators expect documented evidence of environmental performance, not just policy statements. The 2015 edition left too much room for organizations to treat climate and biodiversity as optional considerations within context analysis. The 2026 revision corrects that deliberately.

 

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

ISO 14001:2015 vs ISO 14001:2026: Overview of Key Differences

What Has Changed and What Has Stayed the Same

The core architecture of ISO 14001 is unchanged. The standard still follows the Plan-Do-Check-Act (PDCA) cycle and retains the Harmonized Structure it shares with ISO 9001, ISO 45001, ISO 50001, and other major management system standards. The ten-clause framework remains intact.

What has changed is the specificity and accountability required within that framework. Environmental conditions must now be explicitly identified and named in context analysis. Change management is now a formal, auditable requirement rather than an implied expectation. Supply chain thinking is more directly embedded into operational controls. Internal audits must now have defined objectives, not just scope and criteria.

The table below summarizes the most significant differences between the two editions.

Area

ISO 14001:2015

ISO 14001:2026

Climate change

Not explicitly required (added via 2024 amendment)

Formally integrated; required across multiple clauses

Biodiversity

Implied; not named

Explicitly required in context analysis

Change management

No standalone clause

New standalone Clause 6.3

Risks and opportunities

Within Clause 6.1

New standalone Clause 6.1.4

Supply chain scope

“Outsourced processes”

“Externally provided processes, products and services”

Internal audit

Defined scope and criteria

Defined scope, criteria, and objectives

Clause 10.1

Standalone continual improvement clause

Integrated into Clauses 10.2 and 10.3

What the ISO 14001:2026 Revision Is, and Is Not

ISO 14001:2026 is not a new standard. It does not introduce a fundamentally different approach to environmental management. Organizations with a mature, well-run ISO 14001:2015 EMS will not be starting from scratch.

What the revision is: a targeted update that addresses gaps and ambiguities that accumulated since 2015. It makes previously optional considerations mandatory, adds structural clarity where the 2015 edition was ambiguous, and aligns the standard more closely with how environmental management intersects with modern business risk, ESG reporting, and supply chain accountability.

Organizations that applied the 2015 standard in a minimal or box-ticking way will face more substantial transition work. Organizations that ran a genuine, actively managed EMS will find most of what is required already in place, with focused updates needed in a handful of areas.

Clause-by-Clause Comparison: ISO 14001:2015 vs ISO 14001:2026

Clause 4: Context of the Organization

In ISO 14001:2015, Clause 4.1 required organizations to identify external and internal issues relevant to their EMS. Climate change was a possible consideration, but not a named one. The 2026 revision changes this directly.

ISO 14001:2026 now explicitly names four categories of environmental condition that must be assessed when determining organizational context: climate change, pollution levels, biodiversity and ecosystem health, and the availability of natural resources. These are not suggestions, they place these issues squarely on the required agenda for every certified organization.

The practical implication is significant. An organization that previously mapped its context by tracking energy use and waste generation now needs to demonstrate how it has assessed whether biodiversity loss, water scarcity, or local pollution levels are material to its operating environment. If they are, those factors must flow into objectives, risk registers, and operational controls.

Clause 4.3, which covers the scope of the EMS, has also been strengthened. Organizations are now expected to define their scope with explicit reference to their authority and ability to exercise control and influence across the full life cycle of their activities, products, and services. The EMS boundary is no longer limited to the physical boundary of the facility.

Clause 5: Leadership

Top management responsibilities are expanded in the 2026 edition. The 2015 version focused on management roles. The 2026 revision makes clear that leadership must support environmental performance across all relevant functions, including non-management roles.

The environmental policy itself has been updated. ISO 14001:2026 expects the policy to include commitment to conserving natural resources and protecting ecosystems, alongside the existing commitments to pollution prevention and continual improvement.

This clause often receives less attention during gap analyses than the more structural changes in Clause 6. But it is increasingly relevant for organizations facing ESG scrutiny, where auditors and investors want to see leadership accountability that goes beyond a signed policy on a wall.

Clause 6: Planning, Risk and Opportunity Now Clearer and More Auditable

Clause 6 sees the most structural change of any section in the revised standard. The 2015 edition bundled environmental aspects, compliance obligations, and risks and opportunities together in Clause 6.1. ISO 14001:2026 reorganizes this logic.

A new Clause 6.1.4 isolates risks and opportunities as a distinct planning step. This brings ISO 14001 into closer alignment with the risk-based framework of ISO 9001:2015 and makes the risk assessment process more clearly auditable. Organizations must now demonstrate a documented path from identified risk or opportunity to planned action, with that logic visible and reviewable.

The most significant structural addition is Clause 6.3: Planning of Changes. This is the only genuinely new clause in the revision. ISO 14001:2015 had no formal requirement for managing planned changes to the EMS, its absence was a recognized gap, and the 2026 revision fills it. Clause 6.3 requires organizations to evaluate environmental impacts before changes occur, manage new or modified activities and processes in a structured way, and monitor the effectiveness of planned changes. Relevant change events might include business expansion, new product lines, supplier changes, site relocation, or process redesign.

You do not need a formal standalone procedure to demonstrate conformance with Clause 6.3. Evidence can include change forms, meeting notes, or digital workflow logs. What auditors will look for is a defined, repeatable process that is being followed consistently, not necessarily a dedicated document.

Clause 7: Support

Documentation requirements are clarified and standardized. Under ISO 14001:2015, the language around what must be formally documented was inconsistent in places. The 2026 revision standardizes terminology: information that must be available as documented information is now clearly distinguished from information that must be maintained as controlled documentation. The intent is to remove ambiguity without adding bureaucratic load.

Clause 8: Operation, Change Management Now Explicit

Clause 8.1 replaces the previous reference to “outsourced processes” with “externally provided processes, products, and services.” This is more than a terminology update. It broadens the scope of what the EMS must cover in operational controls, extending expectations to a wider range of external providers including suppliers, logistics partners, and service contractors, a development with direct implications for organizations managing complex supply chains or working toward R2 certification or e-waste certification, where supply chain accountability is central.

Clause 8.2, covering emergency preparedness and response, has also been strengthened. Supplier-related risks that the organization can control or influence must now be explicitly factored into emergency planning scenarios, rather than treated as external and therefore outside the EMS.

Clause 9: Performance Evaluation

Two targeted updates in Clause 9 change how internal audits are planned and how management reviews are structured. Under Clause 9.2.2, internal audits must now have defined objectives in addition to the previously required scope and criteria. This distinction matters: an audit designed to verify legal compliance has a different objective than one assessing the effectiveness of a new operational control. Making objectives explicit sharpens audit planning and produces more actionable outputs.

Management reviews have also been updated with clearer guidance on required inputs and expected outputs, bringing them into closer alignment with the structured approach used in other harmonized management system standards.

Clause 10: Improvement

Clause 10.1, previously a standalone continual improvement clause, has been absorbed into Clauses 10.2 and 10.3. The underlying requirements have not changed. The consolidation sharpens the connection between nonconformity management, corrective action, and the EMS improvement cycle, removing the loose separation that existed in the 2015 structure.

Major Thematic Changes in ISO 14001:2026

A Stronger Focus on Real-World Environmental Issues

Climate change, biodiversity, and natural resource use are now core topics within the EMS, not optional context. By explicitly naming these issues in Clause 4, the standard makes it much harder for organizations to treat them as peripheral. Auditors will expect to see documented evidence of how each has been considered. Organizations tracking only energy consumption and carbon emissions will need to broaden their environmental context analysis.

ISO 14001 maps closely to several Corporate Sustainability Reporting Directive (CSRD) reporting obligations, particularly the ESRS E topics covering climate (E1), pollution (E2), water (E3), biodiversity (E4), and circular economy (E5). Organizations with a well-run ISO 14001:2026 EMS will have much of the process infrastructure already in place for regulatory environmental disclosures.

Supply Chain and Lifecycle Thinking Continues to Strengthen

The 2026 revision reinforces a direction that has been building in the standard since 2015: responsibility does not stop at organizational boundaries. The change from “outsourced processes” to “externally provided processes, products, and services” in Clause 8.1, combined with the lifecycle perspective now embedded in the EMS scope, means that supply chain environmental impacts must be actively considered. For organizations subject to Scope 3 emissions reporting under GHG accounting frameworks, this alignment between EMS expectations and sustainability reporting obligations is directly useful.

Environmental Policy Expectations Have Evolved

The environmental policy update in Clause 5 reflects the broader shift in how environmental management is understood externally. Committing to conserving natural resources and protecting ecosystems is now a formal expectation within the policy, not just a best practice. For organizations that have already updated their policies to reflect ESG commitments, this may require little more than a review. For those with older, minimally revised policies, substantive revision will be needed.

Documentation, More Flexible, But Still Important

The standardization of documentation language across the 2026 edition is clarifying rather than restrictive. Organizations do not need elaborate procedure libraries to demonstrate conformance. What auditors look for is accessible, consistent evidence that requirements are being applied in practice, not whether a particular document exists in a particular format.

ISO 14001:2026 Transition Timeline and What to Expect

Three-Year Transition Period Explained

ISO 14001:2026 was published on 15 April 2026. The transition period is three years, consistent with standard International Accreditation Forum (IAF) practice for major management system standard revisions. The expected transition deadline is approximately May 2029.

During the transition period, ISO 14001:2015 certifications remain valid. Organizations can continue operating under their current certificate until their transition audit is completed. Certification bodies accredited by national bodies, such as UKAS (United Kingdom Accreditation Service) in the UK, or equivalent bodies elsewhere, will need to complete their own accreditation updates before issuing certificates to the new edition.

Key Deadlines for Certified Organizations

Transition can be conducted as a standalone transition audit or incorporated into the regular surveillance or recertification audit cycle. Most practitioners recommend using the existing surveillance cycle where possible, since it reduces disruption and cost. Certification bodies are expected to begin offering transition audits during 2027, once their own accreditation processes are finalized. First ISO 14001:2026 certificates are likely to be issued during 2027 or 2028.

Why Consider Transitioning Early

The three-year window is generous, but organizations that wait until 2028 will face compressed timelines, potential bottlenecks with certification bodies, and the risk of rushed updates. Gap analysis, documentation review, internal audit training, and management review preparation all take time, particularly for large or multi-site organizations. Starting now places organizations well ahead of both the deadline and the expected demand on certification body capacity.

What ISO 14001:2026 Means for Your Business

Impact on Currently Certified Organizations

For organizations with a mature, actively managed ISO 14001:2015 EMS, transition will require targeted updates rather than wholesale redesign. The areas that typically require the most attention are: context analysis (broadening it to explicitly address climate, biodiversity, resource availability, and pollution); change management (formalizing a process for Clause 6.3); lifecycle and supply chain thinking (extending operational controls and aspect assessments beyond direct operations); and internal audit planning (adding defined objectives to the audit program). Organizations that implemented the 2015 standard minimally, without genuine integration into operational decision-making, will face more substantial work.

Key Steps to Prepare for the Transition Now

  • First: read and understand the revised requirements, with priority attention to Clauses 4, 6, and 8.
  • Second: run a gap analysis comparing the current EMS against the 2026 requirements. 
  • Third: update the context analysis and environmental policy to reflect the new expectations. 
  • Fourth: build or formalize a change management process for Clause 6.3. 
  • Fifth: review and extend operational controls across the supply chain. 
  • Sixth: update the internal audit program to include objectives, run an internal audit against the updated requirements, and prepare for the transition audit with the certification body. For a mature EMS, a realistic timeline for this sequence is three to six months of focused work.

How ISO 14001:2026 Relates to Other Standards (ISO 9001, ISO 45001)

The updated Harmonized Structure alignment in ISO 14001:2026 makes integrated management systems easier to operate and audit consistently. Organizations running ISO 14001 alongside ISO 9001 or ISO 45001 will find that the structural consistency across all three standards is now stronger than it was in 2015.

ISO 9001 is also undergoing revision, with publication expected in September 2026. Organizations managing both certifications may be able to coordinate transition planning, reducing the overall effort of updating an integrated management system and avoiding two separate rounds of internal disruption.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

What Is the Difference Between ISO 14001:2015 and ISO 14001:2026?

ISO 14001:2026 builds on the 2015 version without replacing its fundamental structure. The main differences are: explicit requirements for climate change, biodiversity, and natural resource considerations in organizational context (Clause 4); a new Clause 6.3 on change management; a new Clause 6.1.4 separating risks and opportunities; broader supply chain scope in operational controls; standardized documentation language; and defined objectives now required for internal audits. The PDCA cycle and the Harmonized Structure remain unchanged.

Yes, during the transition period. ISO 14001:2015 certifications remain valid until approximately May 2029. After that deadline, certificates to the 2015 edition will no longer be recognized, and all certified organizations must have completed their transition to the 2026 edition.

The transition deadline is approximately May 2029, three years from the April 2026 publication date. This is consistent with IAF guidance for management system standard transitions and applies to all currently certified organizations worldwide.

Not from scratch. Transition does not require a full recertification process. It is typically handled as a transition audit, which can be a standalone event or integrated into regular surveillance or recertification audits. Contact us or your accredited certification body for specific guidance on how they plan to manage transition audits and what evidence they will require.

Climate change is now explicitly required in context analysis under Clause 4. The 2024 amendment (ISO 14001:2015/Amd 1:2024) already made this mandatory for organizations certified to the 2015 edition. The 2026 revision formally integrates that requirement and extends the climate lens further, connecting it to biodiversity, ecosystem health, and natural resource availability across multiple clauses.

Audits will evolve to reflect the new requirements. Clause 6.3 is new, so auditors will look for evidence of a defined change management process and documented examples of how changes have been planned and controlled. Context analysis reviews will need to show explicit consideration of the four named environmental conditions. Internal audits will be expected to have documented objectives alongside scope and criteria. Organizations should expect audit checklists and criteria to be updated by certification bodies during 2026 and 2027 as accreditation processes are finalized.

Axipro Author

Picture of Pedro Dias

Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

Blog Highlights

Explore More Articles

Plenty of companies treat an ISO 27001 certificate as proof of GDPR compliance. It is not. The two frameworks overlap heavily, but they answer different questions, and the gap between them is exactly where regulators tend to look. ISO 27001 tells you how to build a defensible security program. GDPR tells you what the law expects when that program touches personal data. Run one without understanding the other, and you will either over-engineer security you do not strictly need, or miss privacy obligations that carry real financial exposure. This article maps where ISO 27001 and GDPR meet, where they part ways, and how to run them as a single coordinated effort rather than two competing projects. What Is ISO 27001? ISO/IEC 27001 is the international standard for an Information Security Management System, or ISMS. The current edition is ISO 27001:2022. It is not a checklist of technical fixes. It is a management framework: a structured, repeatable way to identify information security risks, decide how to treat them, document those decisions, and improve over time. Clauses 4 to 10 of the standard define the mandatory ISMS requirements, covering leadership, risk assessment, internal audit, and management review. Annex A then lists 93 controls grouped into four themes: organisational, people, physical, and technological. You do not implement all 93 by default. You select the controls that address your assessed risks and justify your choices in a document called the Statement of Applicability. Certification against ISO 27001 is voluntary and is granted by an accredited third-party body after an audit. What Is GDPR? The General Data Protection Regulation is European Union law. It has been applied since 25 May 2018, and it applies to any organisation that processes the personal data of people in the EU, wherever that organisation is based. GDPR is fundamentally about the rights of individuals, not just the security of data. It grants people rights over their personal data, including access, correction, erasure and portability. It places obligations on the organisations that decide how data is used (controllers) and those that process it on their behalf (processors). It requires a lawful basis for every processing activity, mandates breach notification, and demands transparency about what happens to people’s information. You do not implement GDPR and receive a certificate. You obey it, and a regulator decides whether you have. Key Differences Between ISO 27001 and GDPR Scope and Purpose ISO 27001 protects all information assets an organisation holds: intellectual property, financial records, operational data, source code and, yes, personal data. Its purpose is the confidentiality, integrity and availability of information in general. GDPR is narrower in one sense and broader in another. It covers only personal data of individuals in the EU, but it protects the person behind the data, not merely the data itself. A system can be flawlessly secure and still violate GDPR. Legal Obligation vs. Voluntary Certification This is the difference that catches people out. GDPR is binding law. If you process EU personal data, compliance is not optional, and there is no opting out. ISO 27001 is a voluntary standard. Organisations pursue it for assurance, for competitive advantage, and because customers increasingly demand it. Crucially, there is no such thing as a GDPR certificate. Regulators assess compliance through investigation and enforcement, not through a badge you can display. Penalties for Non-Compliance GDPR fines run on two tiers under Article 83. Less severe infringements — such as failures around records of processing or breach notification — can reach €10 million or 2% of global annual turnover, whichever is higher. The more serious tier, covering breaches of the core processing principles and data subject rights, can reach €20 million or 4% of global annual turnover. Failing an ISO 27001 audit carries no legal fine at all. The consequence is commercial: you do not get the certificate, or you lose it, and that can cost you contracts. How ISO 27001 and GDPR Align Despite their different purposes, the two frameworks were built on compatible logic, which is why running them together works. Both treat information security as central. GDPR Article 32 requires “appropriate technical and organisational measures” to secure personal data. That phrasing is almost a direct description of what an ISO 27001 ISMS produces. The controls an organisation selects for confidentiality and access already serve the regulation’s security expectations. Both are risk-based. ISO 27001 starts every control decision from a risk assessment. GDPR expects the same proportionality: the measures you apply should match the sensitivity of the data and the likelihood and severity of harm. One risk methodology can serve both, provided you assess personal data processing risks alongside broader security risks. Both demand incident response. ISO 27001’s incident management controls require organisations to detect, assess and respond to security events. GDPR Article 33 requires notifying the supervisory authority of a personal data breach within 72 hours of becoming aware of it. The ISO process is the engine that makes the GDPR deadline achievable. How ISO 27001 Can Help You Comply With GDPR Four areas of an ISMS do direct, practical work toward GDPR compliance. Asset management. ISO 27001 requires an inventory of information and associated assets, with owners assigned. You cannot protect personal data, respond to access requests, or maintain records of processing if you do not know where that data lives. The asset inventory is the foundation for both frameworks. Access control. Identity management, privileged access controls and the principle of least privilege limit who can see personal data. That directly supports the GDPR requirement to ensure confidentiality and to prevent unauthorised access. Operational security. Logging, malware protection, backup and secure configuration keep personal data accurate, available and resistant to compromise. These map cleanly onto the integrity and availability expectations in Article 32. Techniques such as data masking for GDPR and ISO 27001 also sit within this space, reducing exposure without sacrificing operational utility. Incident management. A defined process for detecting and handling security events gives you the evidence trail and the response capability you need to

A company that already holds a SOC 2 report has, by most industry estimates, already built somewhere between 60 and 80 percent of what ISO 27001 certification requires. Yet only a small fraction of organizations actually capture that overlap. Teams run the second framework as a fresh project, rewrite policies that already exist, and re-collect evidence they already have on file. The result is paying twice for the same security program. SOC 2 to ISO 27001 mapping is the discipline that stops this. It is a control crosswalk: a structured comparison that shows which SOC 2 controls already satisfy which ISO 27001 requirements, where the genuine gaps sit, and what new work the second framework actually demands. Done well, it turns the second audit from a rebuild into a mapping exercise. What Is SOC 2 to ISO 27001 Mapping? SOC 2 to ISO 27001 mapping links each SOC 2 Trust Services Criterion to its corresponding ISO 27001 clause or Annex A control. The output is a single control library: each control is defined once, tagged to both frameworks, and backed by evidence that both auditors will accept. Worth being clear about upfront: a crosswalk does not make you compliant with anything. It shows where coverage already exists and where it does not. The real work still sits in control design, evidence discipline, and keeping the mapping current as systems and vendors change. A spreadsheet built once and never touched again becomes an audit liability, not an asset. For a structured starting point, a thorough SOC 2 to ISO 27001 gap analysis will surface those liabilities before an auditor does.   SOC 2 Trust Services Criteria: An Overview SOC 2 is an attestation framework from the American Institute of Certified Public Accountants (AICPA). It is built on five Trust Services Categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is the only mandatory category, and every SOC 2 report includes it. The Security category is evaluated through the Common Criteria, written as CC1 through CC9, containing 32 individual criteria in total. CC1 through CC5 cover the control environment, communication, risk assessment, monitoring, and control activities, and they align directly with the COSO internal control framework. CC6 through CC9 are more technology-specific, covering logical and physical access, system operations, change management, and risk mitigation. A SOC 2 audit produces one of two report types. A Type 1 report assesses control design at a single point in time. A Type 2 report assesses both design and operating effectiveness across an observation window, usually 3 to 12 months. A licensed CPA firm issues the report. SOC 2 is an attestation, not a certification, and there is no such thing as a SOC 2 certificate. ISO 27001 Annex A Controls: An Overview ISO/IEC 27001 is the international standard for an information security management system, or ISMS. The current version, ISO 27001:2022, has two distinct layers, and the distinction matters for any mapping effort. Clauses 4 through 10 define the management system itself: organizational context, leadership, planning, risk treatment, support, operations, performance evaluation, and improvement. These clauses are mandatory. Annex A is the second layer, a reference catalogue of 93 controls grouped into four themes: Organizational (37 controls), People (8), Physical (14), and Technological (34). The 2022 revision consolidated the previous 114 controls and 14 domains and added 11 new controls covering areas such as threat intelligence and cloud security. Annex A controls are not all mandatory. Organizations select controls based on a risk assessment and record their choices, including any exclusions and the reasoning behind them, in a Statement of Applicability. Certification is granted by an accredited body, lasts three years, and requires annual surveillance audits. Learn more about what the full certification process involves.   Key Structural Differences That Affect Mapping The two frameworks share a large security foundation, but they are built differently, and a mapping that ignores the structural gaps will fail. Understanding ISO 27001 vs SOC 2 at a structural level is the prerequisite for any mapping work worth doing. Four differences matter most. ISO 27001 certifies a management system, while SOC 2 attests to a set of controls. ISO Clauses 4 through 10 have no direct SOC 2 equivalent, because SOC 2 never asks you to prove you run a continuous, governed program; it asks only whether specific controls met specific criteria during the review period. Scope differs too. An ISO 27001 ISMS is expected to cover the organization broadly, while SOC 2 scope is set at the level of a system or service. The outputs differ as well: ISO produces a pass or fail certificate, whereas a SOC 2 report can carry noted exceptions or a qualified opinion and still be a valid, useful report. And because SOC 2 Type 2 tests evidence across a defined window, a control that worked only on audit day will not pass. The most common mapping mistake is treating ISO 27001 as SOC 2 plus a few extra controls. It is not. The Annex A controls map cleanly, but the ISMS management clauses, including internal audit, management review, and continual improvement, are a separate body of work with no SOC 2 starting point. Budget for them as net-new.   SOC 2 Common Criteria to ISO 27001 Control Mapping The Common Criteria map to ISO 27001 with a high degree of overlap. The table below is a practical starting crosswalk for the CC series. It lists the primary ISO 27001 references rather than every possible match, and your auditor’s judgment will shape the final mapping. SOC 2 Common Criteria Topic Primary ISO 27001:2022 References CC1 Control Environment Clauses 5 (Leadership), 6 (Planning), A.5.1, A.5.2, A.6.1–A.6.4 CC2 Communication and Information Clause 7.4 (Communication), A.5.1, A.6.3, A.8.2 CC3 Risk Assessment Clause 6.1 (Risk Assessment), A.5.7, A.8.8 CC4 Monitoring Activities Clause 9 (Performance Evaluation), A.5.35, A.5.36, A.8.16 CC5 Control Activities Clause 6.1.3 (Risk Treatment), A.5.37, A.8.9 CC6 Logical and Physical Access A.5.15–A.5.18, A.5.31, A.7.1–A.7.4, A.8.2–A.8.5, A.8.18 CC7 System Operations and Incident Response A.5.24–A.5.28, A.8.15, A.8.16 CC8

The world’s first comprehensive AI law is not a single switch that flips on in August 2026. It is a layered regulation that has been activating in stages since February 2025. As of May 2026, it is already being rewritten to give companies more time on the hardest parts. Anyone trying to plan around a single deadline is working from a map that no longer matches the territory. The law’s reach is also global. Just as GDPR exported European privacy norms worldwide, the EU AI Act is producing a Brussels Effect for artificial intelligence: a regulation drafted in Europe that becomes the de facto global standard. Companies in the US, the UK, Bahrain, and anywhere else with EU customers or EU-facing outputs are already in scope, whether or not they have a European office. This guide cuts through the noise. It explains what the EU AI Act actually requires, who it applies to, which rules are already live, which were just pushed back by the EU’s recent simplification deal, and what the penalties really look like for companies of different sizes. What Is the EU AI Act? The EU AI Act (Regulation (EU) 2024/1689) is a horizontal law that sets harmonised rules for developing, placing on the market, and using artificial intelligence systems across the European Union. It is the first comprehensive AI law passed by any major regulator anywhere in the world, and it entered into force on 1 August 2024. The Act takes a risk-based approach. Rather than regulating AI as a single category, it sorts AI systems into tiers based on the harm they could cause to health, safety, or fundamental rights. The higher the risk, the stricter the obligations. Prohibited uses are banned outright. High-risk uses are heavily regulated. Most everyday AI — like spam filters and product recommenders — is left alone. The law also creates a separate, parallel regime for general-purpose AI (GPAI) models, the foundation models behind systems like ChatGPT, Claude, and Gemini. That regime is enforced at the EU level rather than at the national level. Why Was the EU AI Act Created? The official answer is to foster trustworthy AI in Europe. The real answer is broader: the EU watched generative AI go mainstream in late 2022 and concluded that existing law — particularly GDPR — was not enough to address the specific risks AI systems pose. Opacity in decision-making, bias in hiring tools, biometric surveillance, and the manipulation potential of generative models all sat uneasily in the regulatory gap between data protection law and product safety law. The EU’s stated goals are to protect health, safety, and fundamental rights, while preserving innovation and the single market. The political subtext is the Brussels Effect: do for AI what GDPR did for privacy, and let European rules become the global default by virtue of market access. Brazil, Canada, the UK, several US states, and Gulf jurisdictions, including Bahrain, are already drafting AI rules that borrow heavily from the EU framework. For a broader view of how AI governance is likely to evolve through the end of the decade, the trajectory is already becoming clear. Who Does the EU AI Act Apply To? The Act does not apply to AI itself. It applies to people and organisations that build, sell, or use AI systems. Article 3 defines those roles without reference to company size, so a two-person startup is in scope on the same legal basis as a Fortune 500 enterprise. Providers and Developers A provider is anyone who develops an AI system — or has one developed — and places it on the EU market or puts it into service under their own name or trademark. Providers carry the heaviest load of obligations, particularly for high-risk systems: risk management, technical documentation, conformity assessment, post-market monitoring, and incident reporting. A provider is distinct from a downstream developer who simply integrates a third-party AI component. But the line moves: if you take a general-purpose model and put your name on the resulting product, you can become a provider yourself. Deployers and Operators A deployer is anyone using an AI system in a professional capacity. If you are a bank running a credit-scoring model you bought from a vendor, you are a deployer. Deployers have lighter obligations than providers but still carry real ones: ensuring human oversight, monitoring system behaviour, informing affected individuals, and conducting fundamental rights impact assessments where required. The term operator in the Act is an umbrella that covers providers, deployers, importers, distributors, and authorised representatives. Application Outside the EU This is where many non-EU companies get caught. The AI Act applies extraterritorially. A US LLC training a model in Texas, a UK firm running an AI hiring tool, or a Bahrain-based fintech using AI for credit scoring is in scope the moment the output affects someone in the EU. If a US company develops an AI hiring tool and a German employer uses it on German candidates, the US provider is in scope — even with no EU office. The trigger is whether the system’s output is used in the Union, not where the company sits. Pro Tip: Selling AI tools to EU customers outside the EU. If you sell AI tools to EU customers from outside the EU, you must appoint an authorised representative established in a Member State before placing high-risk systems on the market. This is not optional and is one of the most commonly missed obligations for non-EU providers. The Risk-Based Approach: How the EU AI Act Classifies AI Systems The framework sorts AI systems into four tiers. The obligations scale with the tier. Unacceptable Risk: Prohibited AI Practices Article 5 prohibits eight categories of AI practice outright. These prohibitions became enforceable on 2 February 2025, well before the rest of the Act. The banned practices are: Subliminal or manipulative techniques are designed to distort behaviour and cause significant harm. Exploitation of vulnerabilities related to age or disability. Social scoring by public or private actors —