The EU AI Act, the UK position and ISO 42001, in plain English.
What the EU AI Act reaches, what the UK actually requires, what an ISO 42001 certificate is and isn’t worth, and where the questions really come from. It’s general information, not legal advice.
By Wolsten Studios · Sources last checked September 2026
Does any of this actually apply to you?
It may be less than you’ve been told, so it’s worth ten minutes to check before anyone sells you a programme of work.
The EU AI Act
Regulation (EU) 2024/1689 entered into force on 1 August 2024. The prohibitions and AI literacy duties applied from 2 February 2025, general-purpose AI model rules from 2 August 2025, and the bulk of the Regulation from 2 August 2026. The high-risk obligations were then pushed back by the AI Omnibus, which entered into force on 27 July 2026: Annex III high-risk systems now apply from 2 December 2027, and AI embedded in regulated products under Annex I from 2 August 2028.
Being a UK business is not the test. Under Article 2 the Regulation reaches providers who place an AI system on the Union market whether or not they are established in the EU, and providers and deployers outside the EU where the output the system produces is used in the Union. If your system or its output lands inside the EU, it is in scope. If it genuinely does not, a great deal of what is being marketed to you right now is not aimed at your situation.
The UK
There is no UK AI Act. The framework is five cross-sectoral principles (safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress), issued to existing regulators. The government’s white paper states plainly that they are non-statutory, with a duty on regulators to have due regard to them anticipated when parliamentary time allows.
So your obligations do not arrive as one new statute. They arrive through the regulator you already answer to, your professional body, your indemnity insurer, and your clients’ due-diligence questionnaires. Those are the four places the question actually gets asked.
Some of that has already happened. For surveyors, the RICS professional standard on responsible use of AI has applied since 9 March 2026. For solicitors in England and Wales, the broker Howden reports that PII underwriters now include questions about AI in proposal forms. See what this means for law firms and for surveying firms.
A certificate is not a compliance shortcut.
ISO/IEC 42001:2023 sets requirements for running an artificial intelligence management system: an AI policy, risk assessment across the life of a system, an assessment of its impact, defined controls and human oversight, and records of all of it. It is about how an organisation governs AI work, and an organisation can have it certified by an independent certification body.
It is not a harmonised standard under the AI Act and it confers no presumption of conformity. The European Commission’s own guidance on AI Act standardisation says that while ISO/IEC 42001 helps set up an AI management system, its goals and definitions are not aligned with the quality management system the Act requires, which is why the Commission asked CEN and CENELEC to develop a separate European standard instead. That standard, EN 18286, was published in July 2026. The Commission has not yet cited it in the Official Journal, so for now it confers no presumption of conformity either.
There is no compliance shortcut on sale today, from us or from anyone else. A supplier who tells you their certificate makes you compliant has either not read the Commission’s position or is hoping you have not.
What our certificates cover, and what they don’t.
Wolsten Studios holds ISO 9001:2015, ISO 27001:2022 and ISO 42001:2023 certificates, issued by Citation ISO Certification Limited. They certify our own management systems over one scope: “Provision of bespoke and custom-built software, including AI integration and systems globally.” That scope covers the software we build for clients.
They are not product certificates, and they don’t make any client compliant with anything. We went through the ISO 42001 audit ourselves in 2026. So when your insurer or a client asks how AI is used, what policy covers it and who checks the output, we’ve already had to answer the same kind of questions about our own business.
Certificate records and ICO registrationThe AI Evidence Pack.
£1,500 fixed
Remote. Five working days, then a 30-minute walkthrough.
Prices exclude VAT, which is added where applicable.
It turns how your firm actually uses AI into a written record you can show an insurer, a regulator or a client. You get:
- AI use register. The AI tools the firm uses, as far as the interviews and the settings review show: which teams use each one, what client data goes into it, and whether the provider trains on that data.
- A one-page AI policy. What staff may and may not do with AI.
- Supervision protocol. Who reviews AI-assisted work before it reaches a client, and how that review is recorded.
- Written answers for insurers and clients. Draft answers for the AI sections of PII proposal forms and client due-diligence questionnaires, based on what the register shows.
- Staff briefing and training record. A live 45-minute remote briefing for staff on the policy and the supervision protocol, recorded, with a record of who has had it and when.
- One-page verdict. What to fix now and what to leave alone, written so it can be forwarded to whoever has to approve it.
It also helps where an AI tool has been tried in one team and nobody will approve it for client work. The register and the supervision protocol are what the person approving it needs to see.
If you are an RICS-regulated firm, the pack covers part of what the RICS standard asks for, and our page for surveying firms lists, item by item, what it covers and what your firm still needs to do.
It is not certification, an audit, or legal advice. If the honest finding is that you need none of this, that is what the document will say.
What’s in the AI Evidence PackFive things a well-governed AI system has.
When we build an AI system for a client, these five things go into it. Our ISO 42001 certificate covers how we run our own work. It doesn’t certify your system or make it compliant with anything.
Data boundaries
What the workflow may see, where it is processed, which suppliers are involved, and what must stay outside the system entirely.
Human review, placed deliberately
An accountable reviewer at the point where an incomplete or wrong output would actually matter, rather than a checkbox at the end.
Evaluation against real cases
Representative examples tested before launch and re-tested whenever a model, prompt or source changes.
A record that survives the question
Inputs, outputs, who reviewed what, when, and what they changed, kept in a form you can show a client or an insurer.
Named ownership
Who is accountable when the system is wrong, and what happens next. Written down before go-live, not after an incident.
Questions worth asking.
Does your ISO 42001 certificate make our AI compliant with the EU AI Act?
No, and be wary of anyone who says otherwise. ISO 42001 is a management system standard, not a harmonised standard under the AI Act. Under EU law a presumption of conformity comes from complying with a harmonised standard whose reference has been published in the Official Journal, and the Commission has not published any for the AI Act yet.
Then what is the certificate actually worth to us?
It is third-party evidence that how we govern AI work is audited rather than asserted, and our certified scope is the software we build for clients rather than a back office. It also means we have been through the process you are facing. When your risk partner, your insurer or your client asks who reviews AI output and what record exists, we have had to answer that about ourselves.
We are a UK firm. Does the EU AI Act apply to us?
It can, and being outside the EU is not the test. Article 2 reaches providers who place an AI system on the Union market regardless of where they are established, and providers and deployers outside the EU where the output the system produces is used in the Union. Whether it catches a particular workflow depends on where that system and its output land. That is worth establishing before you build, not after.
When do the high-risk rules actually bite?
Later than first planned, because they moved. The AI Omnibus entered into force on 27 July 2026. High-risk systems under Annex III now apply from 2 December 2027, and AI embedded in regulated products under Annex I from 2 August 2028. The prohibitions and AI literacy duties have applied since 2 February 2025, and general-purpose AI model rules since 2 August 2025.
Is there a UK equivalent we should be preparing for?
Not as a single statute. The UK has five cross-sectoral principles issued to existing regulators, and the government’s white paper is explicit that they are non-statutory, with a duty on regulators to have due regard to them anticipated when parliamentary time allows. In practice the pressure arrives through your regulator, your professional body, your indemnity insurer and your clients’ due-diligence questionnaires well before it arrives through legislation.
Do we need ISO 42001 ourselves?
Not necessarily, and we will say so if that is the answer. For a small firm the first useful step is a written record of which AI tools are in use, what data each may touch, who reviews the output and what happens when it is wrong. That is what the AI Evidence Pack produces. Certification is a later and more expensive decision.
Is this legal advice?
No. We’re not a law firm. We can tell you how a workflow is built, what it touches, where a human sits in it and what evidence it produces. Whether a specific obligation applies to your firm is a question for your own advisers, and we will tell you when you have reached that line.
What if the rules change again?
They already have once, which is part of the point. The work we do is not a snapshot of one regulation. It is a record of what your systems do, what data they touch and who is accountable, which is what any version of the rules, any insurer and any client questionnaire asks for.
Start with a written record of how your firm uses AI.
A 20-minute call is enough to tell whether the AI Evidence Pack is the right first step, or whether you need nothing at all.
Prefer email? hello@wolstenstudios.com. We read every enquiry.