EU AI Act
EU regulation for risk-based AI system governance
ISO 27017
International code of practice for cloud security controls.
Quick Verdict
EU AI Act mandates risk-based compliance for AI systems in EU with hefty fines, while ISO 27017 provides voluntary cloud security guidance extending ISO 27001. Companies adopt AI Act for legal EU market access; ISO 27017 for cloud assurance and audits.
EU AI Act
Regulation (EU) 2024/1689 Artificial Intelligence Act
Key Features
- Risk-based four-tier AI classification framework
- Prohibits unacceptable-risk AI practices outright
- Mandates high-risk conformity assessments and CE marking
- Regulates general-purpose AI models separately
- Phased implementation with staggered deadlines
ISO 27017
ISO/IEC 27017:2015 Code of practice for cloud security controls
Key Features
- Introduces 7 cloud-specific CLD security controls
- Clarifies shared responsibilities for CSPs and CSCs
- Provides guidance for 37 ISO 27002 controls in cloud
- Addresses multi-tenancy and VM segregation risks
- Integrates with ISO 27001 ISMS certification
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
EU AI Act Details
What It Is
Regulation (EU) 2024/1689, the EU AI Act, is a comprehensive horizontal regulation establishing a risk-based framework for AI systems across sectors. It prohibits unacceptable risks, regulates high-risk systems via lifecycle controls, mandates transparency for limited-risk AI, and minimally regulates others. Its product-safety approach treats AI as regulated products with conformity requirements.
Key Components
- **Four risk tiersprohibited, high-risk (Annex I/III), limited-risk, minimal-risk.
- **High-risk obligationsrisk management (Art. 9), data governance (Art. 10), documentation (Arts. 11-13), human oversight (Art. 14), cybersecurity (Art. 15).
- GPAI rules (Chapter V) for foundation models, including systemic risk duties.
- **Enforcementfines up to 7% global turnover; CE marking, EU database registration.
Why Organizations Use It
Mandated for EU market access, it mitigates legal risks, ensures compliance with extraterritorial scope, builds trust via transparency, and provides competitive edges in regulated sectors like HR, biometrics, infrastructure.
Implementation Overview
Phased rollout (6-36 months); involves AI inventory, classification, QMS integration, conformity assessments, post-market monitoring. Applies to providers/deployers EU-wide; requires cross-functional governance, no universal certification but notified bodies for some high-risk systems.
ISO 27017 Details
What It Is
ISO/IEC 27017:2015 is a code of practice extending ISO/IEC 27002 with cloud-specific information security controls. It provides implementation guidance for cloud services across IaaS, PaaS, SaaS, using a risk-based approach within an ISO 27001 ISMS.
Key Components
- 37 adapted ISO 27002 controls with cloud guidance
- 7 additional CLD controls (e.g., shared responsibilities, VM segregation, asset removal)
- Structured around 14 security domains
- Integrated into ISO 27001 certification via audit scope extension
Why Organizations Use It
- Addresses shared responsibility in cloud models
- Meets procurement, regulatory demands (e.g., GDPR alignment)
- Mitigates multi-tenancy, virtualization risks
- Builds stakeholder trust, competitive differentiation for CSPs/CSCs
- Enables efficient risk management
Implementation Overview
- Extend existing ISO 27001 ISMS with cloud risk assessments
- Implement controls, update SoA, train staff
- Applies to CSPs, CSCs globally, all sizes
- Audited jointly (9-12 months typical)
Key Differences
| Aspect | EU AI Act | ISO 27017 |
|---|---|---|
| Scope | Risk-based AI systems, prohibitions, high-risk obligations | Cloud-specific information security controls |
| Industry | All sectors using AI in EU, global extraterritorial reach | Cloud providers and users, all industries globally |
| Nature | Mandatory EU regulation with fines | Voluntary guidance extending ISO 27001 |
| Testing | Conformity assessments, notified bodies for high-risk | ISO 27001 audits including cloud controls |
| Penalties | Up to 7% global turnover fines | No legal penalties, certification loss only |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about EU AI Act and ISO 27017
EU AI Act FAQ
ISO 27017 FAQ
You Might also be Interested in These Articles...
SOC 2 Audit Survival Guide: Auditor Questions, Red Flags, and Evidence Prep for First-Time Pass
Ace your SOC 2 audit with predicted auditor questions, model answers, red flags, and evidence checklists from CPA best practices & SignWell's journey. Reduce st
How to Implement CIS Controls v8.1 as a ‘Control Backbone’ for NIS2 & DORA (Step-by-Step Implementation Guide)
Deploy CIS Controls v8.1 as a control backbone for NIS2 & DORA compliance. Step-by-step roadmap (IG1→IG2), deliverables, metrics & evidence model for hybrid/clo
CIS Controls v8.1, Operationalized: Top 10 Reasons Compliance Monitoring Software Accelerates Real-World Implementation
Operationalize CIS Controls v8.1 with compliance monitoring software. Turn checklists into dashboards, tickets, and audit-proof workflows. Top 10 reasons it acc
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
FERPA vs GLBA
Discover FERPA vs GLBA: Compare education records privacy (FERPA) with financial data safeguards (GLBA). Unlock key differences, compliance tips, and strategies to protect sensitive info now.
RoHS vs CSA
Compare RoHS vs CSA: EU hazardous substance bans in electronics vs Canadian safety standards (Z1000/Z1002). Key differences, exemptions, testing & compliance. Achieve global market access!
GMP vs NIST 800-171
Explore GMP vs NIST 800-171: Compare pharma quality standards with CUI cybersecurity controls for compliance mastery. Safeguard ops & boost market access now!