ISO 42001 and the EU AI Act over one AI estate

The product's core idea is that these are not two projects. There is one AI inventory, one identity per system (tenant_id, asset_id), and the two regimes are lenses over the same records. This is what lets you say, truthfully, "nothing was re-entered."

Two regimes, one system of record

• ISO/IEC 42001 is a management system (an AIMS): scope, policy, risk, controls (SoA), competence, audit, management review — how the organisation runs AI governance as a repeatable discipline, and the basis for certification.
• The EU AI Act is law: it classifies each system by role and risk and attaches obligations. It is not a subset of ISO 42001 and must never be framed as one — a well-run AIMS helps you meet the Act, but the statutory duties stand on their own.

In the product the same asset carries both: its ISO controls and evidence, and its Act role, classification and obligations. Change control, incidents and evidence serve both lenses at once.

The regulatory clock — state it precisely

Under the Digital Omnibus timeline, be exact (there may be lawyers in the room):

• Article 50 transparency duties are LIVE today. Where a customer deploys an interactive AI (Joule, a support chatbot) or generates synthetic media, disclosure obligations already apply.
• Annex III high-risk obligations are PROSPECTIVE — for the employment use cases in the demo (candidate screening, workforce models) obligations bind on 2 December 2027. Present these as prospective high-risk with an owner and a dated plan, never as "applies today."
• Prohibited practices (Article 5) are absolute — the demo shows an emotion-inference add-on screened out as a permanent do-not-deploy determination.

A trust story in itself

The EU AI Act pack is a priced product, but it never gates the statutory surfaces — the Act's compliance workflows are available regardless of SKU, enforced by an automated test and a documented commercial ruling. You can tell a customer, honestly, that the product will not withhold a legal obligation behind a paywall. For an SI selling trust, that is a differentiator worth naming.

For most SAP manufacturing customers the honest position is clean: they are a deployer for almost everything, employment AI is prospective Annex III high-risk, Article 50 is live, and you avoid the hard verticals (medical devices, credit scoring) where classification gets contentious.