Skip to main content
BSS/OSS Academy

Law, regulation and standards

Law is binding and enforced by regulators. Standards are voluntary: adopted to organise controls and show auditors you have them. Knowing which is which separates legal deadlines from programme choices.

Binding law and voluntary standards

InstrumentBinding?What it asks for
EU AI Act (2024/1689, amended by 2026/1744)YesObligations scaled to risk: prohibited practices, high-risk requirements, transparency, AI literacy
GDPR (2016/679)YesLawful basis, minimisation, impact assessments, limits on solely automated decisions
ISO/IEC 42001:2023No; certifiableAn AI management system: policy, roles, risk, controls, monitoring
ISO/IEC 27001:2022No; certifiableInformation security; the AI platform falls inside it like any other system
ISO/IEC 23894:2023, NIST AI RMFNo; guidanceHow to manage AI-specific risk

How the AI Act is structured

It regulates uses, not technologies: the same model can be unregulated in one system and high-risk in another.

  • Prohibited (Art. 5): e.g. inferring staff emotions at work, so no emotion-scoring of contact-centre agents.
  • High-risk (Art. 6, Annexes I and III): risk management, logging, human oversight, accuracy.
  • Transparency (Art. 50): people must know they are talking to an AI.
  • General-purpose models: duties fall mainly on model providers; an operator using an API is normally a deployer.
  • AI literacy (Art. 4): staff who use AI systems are supported to understand them.

When the AI Act applies

DateWhat applies
2 February 2025Prohibited practices and AI literacy
2 August 2025General-purpose AI model obligations
2 August 2026General application, including Article 50 transparency
2 December 2027High-risk obligations under Annex III (was 2 August 2026)
2 August 2028High-risk obligations under Annex I
As amended by Regulation (EU) 2026/1744, in force since 27 July 2026. Check current status before planning.

Are telco assistants high-risk?

Mostly not: knowledge assistants, ticket summarisers and drafting tools are not listed. They become high-risk when used for:

  • Employment: screening applicants, allocating work, evaluating staff.
  • Credit: creditworthiness checks on individuals; fraud detection is excluded.
  • Critical digital infrastructure: a safety component in running the network. A legal judgement, made before an agent can change live configuration.

ISO/IEC 42001 shares 27001’s structure, so an operator can extend its existing security governance. No standard is, by itself, evidence of AI Act compliance.

What it solves

Separates legal deadlines from programme choices.

What it does not solve

It does not classify your systems; that needs a written intended use and a legal reading.

What it adds

A moving timetable and tracking each system’s intended use.

Sources