The rules already have dates.

The GDPR becomes applicable

The General Data Protection Regulation sets the European baseline for personal data processing. It matters for AI because no serious system can be governed without governing the data it uses, generates, infers or transforms.

ISO/IEC 27001:2022

The current edition of the international standard for information security management systems is published. Its relevance to AI is direct: without security, access control, traceability and risk management, governance remains incomplete.

AI Risk Management Framework 1.0

NIST publishes a voluntary framework for managing artificial intelligence risks. It is neither a law nor a certifiable standard, but it has become an international reference for structuring risks, trust, bias, security, transparency and oversight.

Data Governance Act applicable

The focus is not on banning AI, but on structuring data availability, reuse and governance. For AI, this matters because models are not governed solely through the algorithm: they are also governed through the data architecture that feeds them.

ISO/IEC 42001:2023

First international AI management system standard

ISO/IEC 42001 establishes requirements for creating, implementing, maintaining and improving an artificial intelligence management system. It marks the shift from general ethical discussion to auditable governance: policies, objectives, responsibilities, risks, monitoring, improvement and evidence.

The AI Act enters into force

From this point, the phased application timetable begins. The discussion shifts from whether there will be AI regulation to which provisions apply, when they apply and what evidence each organisation will need to demonstrate.

Argentine guidance on responsible AI and data protection

AAIP publishes guidance for public and private entities on transparency and personal data protection in the use of artificial intelligence. It is not an AI law, but it anticipates criteria for algorithmic transparency, impact assessment and the lifecycle.

NIS2 transposition deadline

Member States were required to transpose the NIS2 Directive. Its effects may extend to Latin American supply chains when they work with clients, parent companies or services linked to the European market.

Cyber Resilience Act enters into force

The European cybersecurity framework for products with digital elements enters into force. The core obligation does not apply immediately, but the clock starts ticking for manufacturers, developers and suppliers of digital products.

DORA starts to apply

Digital operational resilience ceases to be an isolated good practice in the European financial sector and becomes part of the regulatory system: ICT risks, incidents, continuity, testing, critical third parties and supervision.

AI Act

Prohibited practices and AI literacy

The prohibitions on unacceptable-risk practices and obligations related to AI literacy start to apply. Before scaling up AI, an organisation must know which uses it cannot accept and which minimum capabilities it needs to govern it.

ISO/IEC 42005:2025

AI system impact assessment

The standard provides guidance on conducting impact assessments of artificial intelligence systems. It complements ISO/IEC 42001 by bringing governance down to a concrete question: what foreseeable effects an AI system may produce and how they are documented throughout its life cycle.

Code of practice for general-purpose models

The Code of Practice for general-purpose AI models is published. It is voluntary, but relevant: it offers a practical route to demonstrating compliance with AI Act obligations on transparency, copyright, safety and models with systemic risk.

AI Act

Governance and general-purpose models

Obligations related to AI Act governance and general-purpose AI models become applicable. Providers can no longer rely solely on general statements: they must demonstrate documentation, traceability, information for integrators and risk management where applicable.

Data Act becomes applicable

The Data Act affects the data economy: access, use, sharing, portability and rules for data generated by connected products and related services. For AI, data access and governance become a structural part of compliance.

Operational close of the transition to ISO/IEC 27001:2022

The three-year transition from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 within the accredited certification scheme ends. The critical point was not to change the certificate, but to demonstrate a real transition: gaps, SoA, risks and control effectiveness.

AI Omnibus

Final approval to adjust the AI Act timeline

The Council of the EU gave the final green light to the Digital Omnibus on AI. The text simplifies certain AI Act rules and sets new dates for high-risk systems, transparency of AI-generated content, new prohibitions and coordination with sectoral legislation.