What It Is

Regulation (EU) 2024/1689, known as the EU AI Act, is a comprehensive horizontal regulation establishing the first risk-based framework for AI systems across sectors. It applies to providers, deployers, importers, and distributors placing AI on the EU market or using outputs in the EU, with extraterritorial reach. The core approach tiers AI into unacceptable, high, limited, and minimal risk categories.

Key Components

• Prohibited practices (Chapter II): Bans manipulative, discriminatory AI uses.
• High-risk requirements (Chapter III): Risk management, data governance, documentation, human oversight, cybersecurity (Articles 9-15), conformity assessment, CE marking.
• GPAI obligations (Chapter V): Technical documentation, systemic risk mitigations.
• Enforcement via AI Office, national authorities; fines up to 7% global turnover.

Why Organizations Use It

Mandatory for in-scope AI to ensure market access, avoid penalties, mitigate risks to safety and rights. Builds trust, enables procurement in regulated sectors like healthcare, finance; aligns with GDPR.

Implementation Overview

Phased rollout (6-36 months); inventory AI assets, classify risks, build compliance systems (QMS, RMS), conduct assessments. Applies to all sizes using high-risk/GPAI; third-party notified bodies for some high-risk.

What It Is

ISO 22301:2019 is the international standard titled Security and resilience — Business continuity management systems — Requirements. It provides a certifiable framework for establishing, implementing, maintaining, and improving a Business Continuity Management System (BCMS). The primary purpose is to enhance organizational resilience against disruptions like cyberattacks, natural disasters, and supply chain failures. It follows a risk-based approach structured around the PDCA (Plan-Do-Check-Act) cycle.

Key Components

• 10 clauses (4-10 are auditable requirements)
• Core elements: context analysis, leadership commitment, BIA (Business Impact Analysis), risk assessment, operational planning, performance evaluation, and continual improvement
• Built on Annex SL high-level structure for integration
• Certification valid for 3 years with annual surveillance audits

Why Organizations Use It

• Mitigates financial losses, reduces downtime, and ensures regulatory compliance (e.g., NIS Directive)
• Builds stakeholder trust, reputation, and competitive advantages like procurement wins
• Enables proactive risk management and rapid recovery

Implementation Overview

• Phased approach: gap analysis, BIA, policy development, training, testing, audits
• Applicable to all sizes/sectors globally
• Two-stage certification process (6-8 weeks typical)