Table of Contents

Reach SOC 2 Compliance in 6 Weeks or Less.

  / ISO 9001:2026: Key Changes, Timeline & Transition Guide

ISO 9001:2026: Key Changes, Timeline & Transition Guide

A new version of the world’s most widely adopted quality management standard is on the way. The Draft International Standard (ISO/DIS 9001) was released on 27 August 2025, and ISO member bodies voted to approve it in December 2025. Final publication is targeted for September 2026, with a three-year transition window expected to follow. Over 1.3 million organizations worldwide currently hold ISO 9001 certification. For every one of them, understanding what is changing, and what is not, matters.

This guide covers the confirmed changes in the DIS, the full revision timeline, what the update means for currently certified organizations, and how to plan your transition. Whether you are managing an existing Quality Management System (QMS) or considering certification for the first time, this is what you need to know.

What Is ISO 9001:2026?

ISO 9001 is the international standard that defines requirements for a Quality Management System. Published by the International Organization for Standardization (ISO), it provides a framework organizations can use to consistently deliver products and services that meet customer and regulatory requirements, and to drive continual improvement. Certification to ISO 9001 is recognized in virtually every industry and country worldwide.

ISO 9001:2026 is the sixth edition of the standard. It succeeds ISO 9001:2015 and is being developed by ISO/TC 176/SC 2, the technical subcommittee responsible for quality management system standards. The revision is being drafted by Working Group 29 (WG 29), a body of international experts convened specifically for this purpose.

Why Is ISO 9001:2015 Being Revised?

ISO standards undergo a formal review cycle every five years. Member bodies assess whether a standard remains relevant, needs updating, or should be discontinued. After a 2020 user survey led the committee to confirm ISO 9001:2015 without revision, a 2023 re-evaluation by a new task force reversed that decision. The conclusion: the world had changed enough since 2015 to warrant an update.

Three broad forces are driving the revision. The first is sustainability and climate change. ISO formally amended ISO 9001:2015 in February 2024, requiring organizations to consider climate change as part of their context analysis. That amendment is now being embedded directly into the body of the 2026 standard. The second is digital transformation. Since 2015, AI, IoT, cloud computing, and remote auditing have moved from emerging technologies to standard business practice. The standard needs to reflect that reality. The third is stakeholder expectations. Customers, employees, suppliers, and communities now expect organizations to operate transparently and ethically, not just efficiently.

The revision also reflects feedback from quality practitioners globally, who found certain parts of the 2015 standard, particularly the treatment of risks and opportunities, unclear in practice.

Pro Tip: EU and UK Customers

If your EU or UK customers ask for “an ISAE 3000 report” without specifying the assurance level, clarify upfront. A limited assurance engagement involves materially less testing and a lower fee, but some enterprise buyers will only accept reasonable assurance. Getting alignment early saves weeks of rework.

Current Status of the ISO 9001:2026 Revision

Draft International Standard (DIS)

The DIS was published on 27 August 2025, marking the first time the revised text was available to ISO member bodies for formal review and ballot. The voting period closed on 4 December 2025, with member countries approving the proposal. That approval is a significant milestone: it confirms the standard will be published and locks in the broad direction of the changes, though minor editorial refinements are still possible before final publication.

The DIS itself is not freely available, but its content has been widely discussed by national body experts, certification bodies such as DNV and Intertek, and quality management organizations globally. The picture of what is changing is now clear.

Final Draft International Standard (FDIS)

Following DIS approval, the working group addresses submitted comments before preparing the Final Draft International Standard (FDIS), expected in early 2026. This is typically a near-final text, with only minor adjustments possible at this stage. Once the FDIS is approved, the standard moves directly to publication.

ISO 9001:2026 Publication and Transition Timeline

Publication is targeted for September 2026. Following publication, the International Accreditation Forum (IAF) will establish the official transition timeline and accreditation requirements for certification bodies.

Important: The IAF has not yet formally confirmed the transition period. Based on precedent with previous major revisions, a three-year window is expected. Do not finalize your planning around any specific deadline until the IAF publishes its official transition rules after the standard is published.

Key Changes in ISO 9001:2026

The DIS confirms that ISO 9001:2026 is an evolutionary update, not a rebuild. The core requirements in Clauses 4 through 10 have changed modestly. The most significant additions appear in the non-mandatory Annex A, which has been substantially expanded to provide clearer implementation guidance. For organizations currently certified to ISO 9001:2015, the transition burden is expected to be manageable.

Ethics and Integrity Within Leadership

Clause 5.1.1 now explicitly requires top management to promote and demonstrate a culture of quality and ethical behavior. Previous editions required leadership commitment to the QMS, but the 2026 version makes quality culture and ethical conduct formal leadership responsibilities,  not just implied expectations.

Clause 7.3 adds a corresponding requirement at the workforce level: employees must be aware of what quality culture and ethical behavior mean in their context. This pairs leadership obligation with organizational awareness, creating accountability at both ends of the organization.

Enhanced and Restructured Risk Management

Risk-based thinking has been part of ISO 9001 since 2015, but practitioners consistently reported that the standard did not give enough guidance on how to handle risks and opportunities differently. The 2026 revision addresses this directly.

Clause 6.1 is restructured into sub-sections: 6.1.2 for actions to address risks, and 6.1.3 for actions to address opportunities. This is not just editorial. The separation forces organizations to treat opportunity management as a distinct planning activity, not simply the positive counterpart to risk. Many organizations with mature QMS processes had already made this distinction informally,  the standard now makes it explicit.

Greater Emphasis on Stakeholder Engagement

The revision places stronger emphasis on understanding and responding to the perspectives of interested parties: customers, employees, suppliers, regulatory bodies, and the broader community. This reflects a decade of change in how organizations are expected to operate, particularly around transparency and social accountability. The requirements stop well short of making ISO 9001 an ESG standard, but the direction is clear.

Digital Transformation and Industry 4.0

The standard does not mandate specific technologies or tools. However, the 2026 revision acknowledges that quality management now routinely involves digital workflows, automated monitoring, AI-assisted analysis, and remote audit capabilities. Organizations using these tools are expected to ensure their QMS reflects and governs them appropriately. The documented information requirements in Clause 7.5 are expected to be clarified to better accommodate modern digital record-keeping,  a welcome update for organizations that have moved well beyond paper-based systems.

Sustainability, Climate Change, and Social Responsibility

ISO 9001:2026 does not attempt to replicate ISO 14001 or become an ESG framework. But sustainability concerns are more visible than in previous editions. The Climate Change Amendment of 2024, already binding on certified organizations, is formally embedded in Clause 4.1. Organizations are required to consider whether climate change is relevant to their context and to reflect that assessment in their QMS if it is.

The 2024 amendment added two short but consequential notes to Clauses 4.1 and 4.2 of ISO 9001:2015. Clause 4.1 now includes a note that relevant interested parties can have requirements related to climate change. Clause 4.2 notes that climate change can be a relevant external issue to consider. These are not requirements to act on climate change,  they are requirements to consider it. The integration of these notes into the body of ISO 9001:2026 formalizes what has already been expected since February 2024.

Pro tip: If your organization has not yet updated its context analysis (Clause 4.1) and interested party register (Clause 4.2) to reflect the 2024 Climate Change Amendment, do it now. Certification bodies are already checking for this during regularly scheduled audits,  and it is also the most straightforward part of your ISO 9001:2026 preparation.

Greater Flexibility and Simplification

One persistent criticism of ISO 9001 has been that it creates unnecessary documentation burden, particularly for smaller organizations. The 2026 revision continues the trend toward flexibility. Several clauses have been editorially revised to make requirements clearer and easier to audit, without adding new obligations. Quality objectives must be measurable, but only where practical,  a nuance that gives organizations more room to set meaningful targets in complex environments.

Improved Alignment with Other Management Systems

The Harmonized Structure introduced in 2015 aligned ISO 9001 with other management system standards. ISO 9001:2026 deepens this alignment by updating terminology and clause structure to reflect changes across the ISO management system family since 2015. Organizations running integrated management systems covering quality, environment, and occupational health and safety will find the 2026 version easier to integrate with updated editions of ISO 14001 and ISO 45001. For organizations that also manage information security, it is worth reviewing how ISO 9001 compares with and integrates with data protection frameworks.

What Isn’t Changing in ISO 9001:2026

The seven quality management principles that underpin ISO 9001 remain unchanged: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management. These principles, codified in ISO 9000:2015, are the philosophical foundation of the standard and are not being revised.

The Plan-Do-Check-Act (PDCA) cycle remains the operational model. The process approach is unchanged. The High-Level Structure (HLS) is maintained, preserving compatibility with ISO 14001, ISO 27001, ISO 45001, and other management system standards. Organizations certified to ISO 9001:2015 will not need to redesign their QMS from scratch. For most, the transition will be a focused update, not a reinvention.

What ISO 9001:2026 Means for Your Organization

Impact on Currently Certified Organizations

The transition burden for currently certified organizations is expected to be low. The core requirements you implemented for ISO 9001:2015 remain valid. The changes that require active attention are the ethics and quality culture requirements in Clauses 5.1.1 and 7.3, the restructured approach to risks and opportunities in Clause 6.1, and the formal integration of the climate change considerations you should already have addressed following the 2024 amendment.

Documentation updates will be required to reflect the revised clause structure. Internal audit programs will need to be updated to check against the new requirements. Leadership briefings are worth prioritizing early, since the quality culture and ethical behavior expectations now sit explicitly at the top management level.

Impact on Organizations Not Yet Certified

For organizations that have not yet pursued ISO 9001 certification, there is no reason to wait for the 2026 edition. ISO 9001:2015, supplemented by the 2024 Climate Change Amendment, remains the current standard and is fully certifiable today. A QMS built to that standard will provide a solid foundation for the 2026 transition. Beginning the certification journey now means you gain the operational and commercial benefits of certification sooner, and your system will already be mature by the time the 2026 transition window opens.

Your Certification Is Secure Until 2029

Existing ISO 9001:2015 certificates will remain valid during the transition period. Based on precedent with the 2015 revision, organizations will have approximately three years from the date of publication to transition to the new standard. If ISO 9001:2026 is published in September 2026, the 2015 version would likely remain valid until September 2029, subject to formal IAF confirmation.

How to Prepare for the ISO 9001:2026 Transition

Conducting a Gap Analysis

A gap analysis compares your current QMS against the requirements of ISO 9001:2026. With the DIS now approved, the picture of what is changing is sufficiently clear to begin this exercise. For a detailed walkthrough of the process, the gap analysis guide provides a practical framework that translates well across management system standards. Focus particularly on how your organization currently documents quality culture, how leadership commitment to ethical behavior is demonstrated, and how your risk and opportunity planning distinguishes between the two,  these are the areas most likely to reveal gaps.

Training and Awareness

The explicit awareness requirement in the revised Clause 7.3 means that employee training programs will need updating. Quality culture and ethical behavior need to be defined in your organizational context, communicated clearly, and evidenced in training records. Leadership briefings should start early, since top management is now formally responsible for demonstrating these behaviors.

Updating Documentation

Documentation updates for the 2026 transition are primarily structural: updating clause references, revising the QMS manual or policy documents to reflect the new requirements, and ensuring records support the separated risk and opportunity planning approach. No organization should find itself rebuilding its entire documented system. The task is refinement and alignment, not reconstruction.

Internal Audits

Your internal audit programs should be updated to include the new and revised requirements once the final standard is published. Auditors will need training on the specific changes, particularly the quality culture and ethics requirements and the restructured Clause 6.1. Scheduling a focused internal audit against the 2026 requirements before your first external transition audit is strongly recommended.

Engaging Stakeholders

The stronger emphasis on interested parties in the 2026 revision means that your stakeholder register,  and the processes you use to identify and respond to their needs,  should be reviewed. This is particularly relevant for organizations operating in sectors where customer, regulatory, or community expectations around sustainability and transparency have shifted significantly since 2015.

Investing in Technology

The standard does not require any specific technology. However, organizations that still rely heavily on paper-based or legacy document control systems may find that the 2026 revision is a practical prompt to modernize. Digital QMS platforms can simplify compliance evidence, automate KPI tracking, and make the audit process significantly more efficient. Investing in these capabilities before the transition also gives you time to validate them properly.

Pro tip: Map a rough three-year transition plan from September 2026 now. Gap analysis in months 1–6, documentation and training updates in months 6–18, internal audits in months 18–24, and your transition certification audit scheduled before the September 2029 deadline. When the IAF publishes official transition rules, adjust accordingly. Starting with a plan is far better than waiting for certainty.

Action Plans for the ISO 9001:2026 Transition

For Companies Not Yet Certified

Start your ISO 9001:2015 implementation now, including the 2024 Climate Change Amendment. Do not wait for the 2026 edition,  you gain no advantage from waiting and lose time in which your QMS could be delivering operational benefit. ISO 9001 certification is available today, and a well-implemented 2015 system will make your eventual 2026 transition straightforward. Explore our certification services to understand how to get started efficiently.

For Companies Already Certified

Conduct a gap analysis against the DIS changes now. Prioritize the climate change amendment compliance check, the quality culture and ethics awareness updates, and the risk-opportunity separation review. Begin updating training materials and leadership briefings. Schedule your transition audit well in advance of the 2029 deadline to avoid the bottleneck that typically develops in the final year of any ISO transition window.

For Individuals Considering Professional Certification

ISO 9001:2015 auditor and implementer certifications remain fully valid and highly valued. Obtaining them now gives you immediate credibility in the job market while positioning you to update your knowledge when the 2026 edition is published. The changes are not extensive enough to make current qualifications obsolete.

For Individuals with Existing Professional Certification

Monitor updates from the ISO/TC 176/SC 2 committee and from your certification body or professional association. Once the final standard is published, seek formal transition training. Focus your continuing professional development on the areas of change: quality culture, ethical behavior, risk-opportunity separation, and the sustainability and digital dimensions of the 2026 update.

When Is ISO 9001:2026 Coming Out?

Publication is targeted for September 2026. The DIS was approved by ISO member bodies in December 2025, and the Final Draft International Standard (FDIS) is expected in early 2026. Barring unexpected delays, the September 2026 timeline is considered reliable.

The confirmed changes in the DIS include: formal integration of the 2024 Climate Change Amendment into Clause 4.1; a new leadership requirement for promoting quality culture and ethical behavior in Clause 5.1.1; a new employee awareness requirement on quality culture and ethics in Clause 7.3; separation of risks and opportunities into distinct sub-clauses (6.1.2 and 6.1.3); and a substantially expanded Annex A providing clearer implementation guidance. The core requirements of Clauses 4–10 remain largely unchanged.

Not immediately. Certification bodies must complete accreditation training before they can issue certificates to the new standard. This process is expected to take approximately 12 months following publication, meaning very few ISO 9001:2026 certificates will be issued before late 2027.

Your ISO 9001:2015 certificate remains valid during the transition period, expected to run until approximately September 2029. You are not required to transition before that date, though transitioning earlier avoids a last-minute rush and gives your organization more time to embed the new requirements properly.

No. ISO 9001:2015, with the 2024 Climate Change Amendment, is the current standard and remains fully certifiable. Waiting delays both certification and the operational benefits it delivers. A well-implemented 2015 QMS will require only targeted updates to transition to 2026.

For most certified organizations, the transition is expected to be manageable. The core requirements are not changing. The work involves a gap analysis, documentation updates to reflect the new clause structure, training updates for quality culture and ethics awareness, and revisions to risk and opportunity planning. It is not comparable in scope to the 2008-to-2015 transition, which required organizations to adopt an entirely new structure and philosophy.

ISO reviews all management system standards every five years. The 2023 re-evaluation concluded that changes in sustainability expectations, digital technology, and stakeholder transparency since 2015 justified a revision. The goal is to keep ISO 9001 relevant and effective as a quality management tool without disrupting the enormous installed base of certified organizations worldwide. If you want expert support navigating the transition, whether you are starting from scratch or updating an existing system, contact us to discuss how we can help.

Axipro Author

Picture of Pedro Dias

Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

Blog Highlights

Explore More Articles

Plenty of companies treat an ISO 27001 certificate as proof of GDPR compliance. It is not. The two frameworks overlap heavily, but they answer different questions, and the gap between them is exactly where regulators tend to look. ISO 27001 tells you how to build a defensible security program. GDPR tells you what the law expects when that program touches personal data. Run one without understanding the other, and you will either over-engineer security you do not strictly need, or miss privacy obligations that carry real financial exposure. This article maps where ISO 27001 and GDPR meet, where they part ways, and how to run them as a single coordinated effort rather than two competing projects. What Is ISO 27001? ISO/IEC 27001 is the international standard for an Information Security Management System, or ISMS. The current edition is ISO 27001:2022. It is not a checklist of technical fixes. It is a management framework: a structured, repeatable way to identify information security risks, decide how to treat them, document those decisions, and improve over time. Clauses 4 to 10 of the standard define the mandatory ISMS requirements, covering leadership, risk assessment, internal audit, and management review. Annex A then lists 93 controls grouped into four themes: organisational, people, physical, and technological. You do not implement all 93 by default. You select the controls that address your assessed risks and justify your choices in a document called the Statement of Applicability. Certification against ISO 27001 is voluntary and is granted by an accredited third-party body after an audit. What Is GDPR? The General Data Protection Regulation is European Union law. It has been applied since 25 May 2018, and it applies to any organisation that processes the personal data of people in the EU, wherever that organisation is based. GDPR is fundamentally about the rights of individuals, not just the security of data. It grants people rights over their personal data, including access, correction, erasure and portability. It places obligations on the organisations that decide how data is used (controllers) and those that process it on their behalf (processors). It requires a lawful basis for every processing activity, mandates breach notification, and demands transparency about what happens to people’s information. You do not implement GDPR and receive a certificate. You obey it, and a regulator decides whether you have. Key Differences Between ISO 27001 and GDPR Scope and Purpose ISO 27001 protects all information assets an organisation holds: intellectual property, financial records, operational data, source code and, yes, personal data. Its purpose is the confidentiality, integrity and availability of information in general. GDPR is narrower in one sense and broader in another. It covers only personal data of individuals in the EU, but it protects the person behind the data, not merely the data itself. A system can be flawlessly secure and still violate GDPR. Legal Obligation vs. Voluntary Certification This is the difference that catches people out. GDPR is binding law. If you process EU personal data, compliance is not optional, and there is no opting out. ISO 27001 is a voluntary standard. Organisations pursue it for assurance, for competitive advantage, and because customers increasingly demand it. Crucially, there is no such thing as a GDPR certificate. Regulators assess compliance through investigation and enforcement, not through a badge you can display. Penalties for Non-Compliance GDPR fines run on two tiers under Article 83. Less severe infringements — such as failures around records of processing or breach notification — can reach €10 million or 2% of global annual turnover, whichever is higher. The more serious tier, covering breaches of the core processing principles and data subject rights, can reach €20 million or 4% of global annual turnover. Failing an ISO 27001 audit carries no legal fine at all. The consequence is commercial: you do not get the certificate, or you lose it, and that can cost you contracts. How ISO 27001 and GDPR Align Despite their different purposes, the two frameworks were built on compatible logic, which is why running them together works. Both treat information security as central. GDPR Article 32 requires “appropriate technical and organisational measures” to secure personal data. That phrasing is almost a direct description of what an ISO 27001 ISMS produces. The controls an organisation selects for confidentiality and access already serve the regulation’s security expectations. Both are risk-based. ISO 27001 starts every control decision from a risk assessment. GDPR expects the same proportionality: the measures you apply should match the sensitivity of the data and the likelihood and severity of harm. One risk methodology can serve both, provided you assess personal data processing risks alongside broader security risks. Both demand incident response. ISO 27001’s incident management controls require organisations to detect, assess and respond to security events. GDPR Article 33 requires notifying the supervisory authority of a personal data breach within 72 hours of becoming aware of it. The ISO process is the engine that makes the GDPR deadline achievable. How ISO 27001 Can Help You Comply With GDPR Four areas of an ISMS do direct, practical work toward GDPR compliance. Asset management. ISO 27001 requires an inventory of information and associated assets, with owners assigned. You cannot protect personal data, respond to access requests, or maintain records of processing if you do not know where that data lives. The asset inventory is the foundation for both frameworks. Access control. Identity management, privileged access controls and the principle of least privilege limit who can see personal data. That directly supports the GDPR requirement to ensure confidentiality and to prevent unauthorised access. Operational security. Logging, malware protection, backup and secure configuration keep personal data accurate, available and resistant to compromise. These map cleanly onto the integrity and availability expectations in Article 32. Techniques such as data masking for GDPR and ISO 27001 also sit within this space, reducing exposure without sacrificing operational utility. Incident management. A defined process for detecting and handling security events gives you the evidence trail and the response capability you need to

A company that already holds a SOC 2 report has, by most industry estimates, already built somewhere between 60 and 80 percent of what ISO 27001 certification requires. Yet only a small fraction of organizations actually capture that overlap. Teams run the second framework as a fresh project, rewrite policies that already exist, and re-collect evidence they already have on file. The result is paying twice for the same security program. SOC 2 to ISO 27001 mapping is the discipline that stops this. It is a control crosswalk: a structured comparison that shows which SOC 2 controls already satisfy which ISO 27001 requirements, where the genuine gaps sit, and what new work the second framework actually demands. Done well, it turns the second audit from a rebuild into a mapping exercise. What Is SOC 2 to ISO 27001 Mapping? SOC 2 to ISO 27001 mapping links each SOC 2 Trust Services Criterion to its corresponding ISO 27001 clause or Annex A control. The output is a single control library: each control is defined once, tagged to both frameworks, and backed by evidence that both auditors will accept. Worth being clear about upfront: a crosswalk does not make you compliant with anything. It shows where coverage already exists and where it does not. The real work still sits in control design, evidence discipline, and keeping the mapping current as systems and vendors change. A spreadsheet built once and never touched again becomes an audit liability, not an asset. For a structured starting point, a thorough SOC 2 to ISO 27001 gap analysis will surface those liabilities before an auditor does.   SOC 2 Trust Services Criteria: An Overview SOC 2 is an attestation framework from the American Institute of Certified Public Accountants (AICPA). It is built on five Trust Services Categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is the only mandatory category, and every SOC 2 report includes it. The Security category is evaluated through the Common Criteria, written as CC1 through CC9, containing 32 individual criteria in total. CC1 through CC5 cover the control environment, communication, risk assessment, monitoring, and control activities, and they align directly with the COSO internal control framework. CC6 through CC9 are more technology-specific, covering logical and physical access, system operations, change management, and risk mitigation. A SOC 2 audit produces one of two report types. A Type 1 report assesses control design at a single point in time. A Type 2 report assesses both design and operating effectiveness across an observation window, usually 3 to 12 months. A licensed CPA firm issues the report. SOC 2 is an attestation, not a certification, and there is no such thing as a SOC 2 certificate. ISO 27001 Annex A Controls: An Overview ISO/IEC 27001 is the international standard for an information security management system, or ISMS. The current version, ISO 27001:2022, has two distinct layers, and the distinction matters for any mapping effort. Clauses 4 through 10 define the management system itself: organizational context, leadership, planning, risk treatment, support, operations, performance evaluation, and improvement. These clauses are mandatory. Annex A is the second layer, a reference catalogue of 93 controls grouped into four themes: Organizational (37 controls), People (8), Physical (14), and Technological (34). The 2022 revision consolidated the previous 114 controls and 14 domains and added 11 new controls covering areas such as threat intelligence and cloud security. Annex A controls are not all mandatory. Organizations select controls based on a risk assessment and record their choices, including any exclusions and the reasoning behind them, in a Statement of Applicability. Certification is granted by an accredited body, lasts three years, and requires annual surveillance audits. Learn more about what the full certification process involves.   Key Structural Differences That Affect Mapping The two frameworks share a large security foundation, but they are built differently, and a mapping that ignores the structural gaps will fail. Understanding ISO 27001 vs SOC 2 at a structural level is the prerequisite for any mapping work worth doing. Four differences matter most. ISO 27001 certifies a management system, while SOC 2 attests to a set of controls. ISO Clauses 4 through 10 have no direct SOC 2 equivalent, because SOC 2 never asks you to prove you run a continuous, governed program; it asks only whether specific controls met specific criteria during the review period. Scope differs too. An ISO 27001 ISMS is expected to cover the organization broadly, while SOC 2 scope is set at the level of a system or service. The outputs differ as well: ISO produces a pass or fail certificate, whereas a SOC 2 report can carry noted exceptions or a qualified opinion and still be a valid, useful report. And because SOC 2 Type 2 tests evidence across a defined window, a control that worked only on audit day will not pass. The most common mapping mistake is treating ISO 27001 as SOC 2 plus a few extra controls. It is not. The Annex A controls map cleanly, but the ISMS management clauses, including internal audit, management review, and continual improvement, are a separate body of work with no SOC 2 starting point. Budget for them as net-new.   SOC 2 Common Criteria to ISO 27001 Control Mapping The Common Criteria map to ISO 27001 with a high degree of overlap. The table below is a practical starting crosswalk for the CC series. It lists the primary ISO 27001 references rather than every possible match, and your auditor’s judgment will shape the final mapping. SOC 2 Common Criteria Topic Primary ISO 27001:2022 References CC1 Control Environment Clauses 5 (Leadership), 6 (Planning), A.5.1, A.5.2, A.6.1–A.6.4 CC2 Communication and Information Clause 7.4 (Communication), A.5.1, A.6.3, A.8.2 CC3 Risk Assessment Clause 6.1 (Risk Assessment), A.5.7, A.8.8 CC4 Monitoring Activities Clause 9 (Performance Evaluation), A.5.35, A.5.36, A.8.16 CC5 Control Activities Clause 6.1.3 (Risk Treatment), A.5.37, A.8.9 CC6 Logical and Physical Access A.5.15–A.5.18, A.5.31, A.7.1–A.7.4, A.8.2–A.8.5, A.8.18 CC7 System Operations and Incident Response A.5.24–A.5.28, A.8.15, A.8.16 CC8

The world’s first comprehensive AI law is not a single switch that flips on in August 2026. It is a layered regulation that has been activating in stages since February 2025. As of May 2026, it is already being rewritten to give companies more time on the hardest parts. Anyone trying to plan around a single deadline is working from a map that no longer matches the territory. The law’s reach is also global. Just as GDPR exported European privacy norms worldwide, the EU AI Act is producing a Brussels Effect for artificial intelligence: a regulation drafted in Europe that becomes the de facto global standard. Companies in the US, the UK, Bahrain, and anywhere else with EU customers or EU-facing outputs are already in scope, whether or not they have a European office. This guide cuts through the noise. It explains what the EU AI Act actually requires, who it applies to, which rules are already live, which were just pushed back by the EU’s recent simplification deal, and what the penalties really look like for companies of different sizes. What Is the EU AI Act? The EU AI Act (Regulation (EU) 2024/1689) is a horizontal law that sets harmonised rules for developing, placing on the market, and using artificial intelligence systems across the European Union. It is the first comprehensive AI law passed by any major regulator anywhere in the world, and it entered into force on 1 August 2024. The Act takes a risk-based approach. Rather than regulating AI as a single category, it sorts AI systems into tiers based on the harm they could cause to health, safety, or fundamental rights. The higher the risk, the stricter the obligations. Prohibited uses are banned outright. High-risk uses are heavily regulated. Most everyday AI — like spam filters and product recommenders — is left alone. The law also creates a separate, parallel regime for general-purpose AI (GPAI) models, the foundation models behind systems like ChatGPT, Claude, and Gemini. That regime is enforced at the EU level rather than at the national level. Why Was the EU AI Act Created? The official answer is to foster trustworthy AI in Europe. The real answer is broader: the EU watched generative AI go mainstream in late 2022 and concluded that existing law — particularly GDPR — was not enough to address the specific risks AI systems pose. Opacity in decision-making, bias in hiring tools, biometric surveillance, and the manipulation potential of generative models all sat uneasily in the regulatory gap between data protection law and product safety law. The EU’s stated goals are to protect health, safety, and fundamental rights, while preserving innovation and the single market. The political subtext is the Brussels Effect: do for AI what GDPR did for privacy, and let European rules become the global default by virtue of market access. Brazil, Canada, the UK, several US states, and Gulf jurisdictions, including Bahrain, are already drafting AI rules that borrow heavily from the EU framework. For a broader view of how AI governance is likely to evolve through the end of the decade, the trajectory is already becoming clear. Who Does the EU AI Act Apply To? The Act does not apply to AI itself. It applies to people and organisations that build, sell, or use AI systems. Article 3 defines those roles without reference to company size, so a two-person startup is in scope on the same legal basis as a Fortune 500 enterprise. Providers and Developers A provider is anyone who develops an AI system — or has one developed — and places it on the EU market or puts it into service under their own name or trademark. Providers carry the heaviest load of obligations, particularly for high-risk systems: risk management, technical documentation, conformity assessment, post-market monitoring, and incident reporting. A provider is distinct from a downstream developer who simply integrates a third-party AI component. But the line moves: if you take a general-purpose model and put your name on the resulting product, you can become a provider yourself. Deployers and Operators A deployer is anyone using an AI system in a professional capacity. If you are a bank running a credit-scoring model you bought from a vendor, you are a deployer. Deployers have lighter obligations than providers but still carry real ones: ensuring human oversight, monitoring system behaviour, informing affected individuals, and conducting fundamental rights impact assessments where required. The term operator in the Act is an umbrella that covers providers, deployers, importers, distributors, and authorised representatives. Application Outside the EU This is where many non-EU companies get caught. The AI Act applies extraterritorially. A US LLC training a model in Texas, a UK firm running an AI hiring tool, or a Bahrain-based fintech using AI for credit scoring is in scope the moment the output affects someone in the EU. If a US company develops an AI hiring tool and a German employer uses it on German candidates, the US provider is in scope — even with no EU office. The trigger is whether the system’s output is used in the Union, not where the company sits. Pro Tip: Selling AI tools to EU customers outside the EU. If you sell AI tools to EU customers from outside the EU, you must appoint an authorised representative established in a Member State before placing high-risk systems on the market. This is not optional and is one of the most commonly missed obligations for non-EU providers. The Risk-Based Approach: How the EU AI Act Classifies AI Systems The framework sorts AI systems into four tiers. The obligations scale with the tier. Unacceptable Risk: Prohibited AI Practices Article 5 prohibits eight categories of AI practice outright. These prohibitions became enforceable on 2 February 2025, well before the rest of the Act. The banned practices are: Subliminal or manipulative techniques are designed to distort behaviour and cause significant harm. Exploitation of vulnerabilities related to age or disability. Social scoring by public or private actors —