When it applies

6 dates carry an obligation in this collection, 2 of them still ahead. Dates are taken from each obligation's own applicability column rather than restated here, so this page and the provision pages cannot disagree. Where a date is not self-explanatory — a transitional provision, a deferred application, a later amendment moving it — the reason is recorded against it.

Still to come

1. 2 December 2027

   • Annex VII, points 4.3 to 4.5 — Conformity based on an assessment of the quality management system and an assessment of the technical documentation

     Annex III standalone high-risk systems, under Article 113 third paragraph point (c) as replaced by Regulation (EU) 2026/1744. This is the date that matters for the Annex III point 1 systems capable of routing to Annex VII.

2. 2 August 2028

   • Annex VII, points 4.3 to 4.5 — Conformity based on an assessment of the quality management system and an assessment of the technical documentation

     Annex I embedded high-risk systems, under the same amended provision.

Already in force

1. 9 January 2024

   • IIA Standard 13.3 — Engagement Objectives and Scope

     The date the Global Internal Audit Standards, 2024 edition, were published. This identifies the current edition and is not a compliance deadline: the Standards state no effective date of their own, and the 2017 framework they replaced is no longer effective.

   • IIA Standard 13.4 — Evaluation Criteria

     The publication date of the 2024 edition of the Global Internal Audit Standards. It marks which edition is current rather than any deadline for conformance; no effective date is stated in the Standards, and the 2017 framework is no longer effective.

   • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

     The publication date printed on the Global Internal Audit Standards, 2024 edition — the date the current edition was published, not an effective date and not a compliance deadline. The Standards carry no separate effective-date statement; the 2017 framework they supersede is no longer effective.

   • IIA Standard 14.6 — Engagement Documentation

     The date the 2024 edition of the Global Internal Audit Standards was published. It marks the current edition, not a deadline: no compliance date attaches to it, the Standards state no separate effective date, and the 2017 framework they replace is no longer effective.

   • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

     Publication date of the 2024 edition of the Global Internal Audit Standards. It records when the current edition appeared and imposes no deadline; the Standards set out no separate effective date, and the superseded 2017 framework is no longer effective.

   • NIST AI RMF MEASURE 2.3 · IIA Standard 14.1 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)

     Publication date of the Global Internal Audit Standards, 2024 edition — when the current edition appeared, not a compliance deadline, and the Standards state no effective date. The NIST framework is voluntary guidance, published January 2023 and carrying no application date.

   • Standards 14.3, 15.1 and 15.2 — Evaluation of Findings · Final Engagement Communication · Confirming the Implementation of Recommendations or Action Plans

     The publication date printed on the Global Internal Audit Standards, 2024 edition — an edition date for a professional standard, not a compliance deadline. No separate effective date is asserted: the 2024 framework supersedes the 2017 IPPF, which is no longer effective for internal audit functions.

2. 31 July 2025

   • ISO 19011:2026 clause 7 · ISO/IEC 42006:2025 clause 7.1 — Competence and evaluation of auditors · Competence of personnel

     BSI adoption of ISO/IEC 42006:2025 as BS ISO/IEC 42006:2025, identical to the ISO text. Again an edition date rather than a deadline; ISO’s own publication date is not asserted here.

   • ISO/IEC 42006:2025 — Information technology. Artificial intelligence. Requirements for bodies providing audit and certification of artificial intelligence management systems

     BSI adoption, published as BS ISO/IEC 42006:2025 and identical to ISO/IEC 42006. A current-edition date for a voluntary standard, not a compliance deadline. ISO’s own publication date is not asserted here because it could not be verified.

3. 27 May 2026

   • ISO 19011:2026 clause 7 · ISO/IEC 42006:2025 clause 7.1 — Competence and evaluation of auditors · Competence of personnel

     BSI publication of ISO 19011:2026, the current edition. An edition date for voluntary guidance, not a compliance deadline — and a reason to re-check clause numbers, since material written against the 2018 edition may now be misnumbered.

   • ISO 19011:2026, clause 5 — Managing an audit programme

     BSI publication of ISO 19011:2026, the current edition. A current-edition date for voluntary guidance, not a compliance deadline. Clause numbering differs from the 2018 edition, so older references to programme clauses should be re-checked.

   • ISO 19011:2026, clause 6 — Conducting an audit

     BSI publication of ISO 19011:2026. This is the current-edition date for voluntary guidance, not a compliance deadline; the standard imposes no dated duty on anyone.

4. 2 August 2026

   • Annex VII, points 4.3 to 4.5 — Conformity based on an assessment of the quality management system and an assessment of the technical documentation

     General applicability of the Regulation. The conformity-assessment machinery exists from this date; whether a given provider is yet obliged to use it depends on which route its system takes.