EU AI Act compliance: deadlines, duties, penalties | Enzai
“Who counts as a provider or deployer under the EU AI Act, what each must do, the dates set by the 2026 Digital Omnibus, and the fines that apply.”
Enzai
“Enzai provides purpose-built AI infrastructure for governing autonomous AI agents and models, replacing legacy GRC bolt-ons for the EU AI Act and ISO 42001.”
Products & services
ISO 42001 certification: clauses, Annex A, audits | Enzai
“What ISO/IEC 42001 asks of you: clauses 4 to 10, the 38 Annex A controls, the Statement of Applicability, the certification audit and what it won’t cover.”
NIST AI RMF: functions, GenAI profile, 2026 status | Enzai
“What the NIST AI RMF asks under GOVERN, MAP, MEASURE and MANAGE, the 12 risks in its generative AI profile, why Texas cites it, and where the revision stands.”
Questions & answers
What problem does Enzai solve?
“Enzai gives enterprises one place to see, govern and control their AI. It finds the AI tools and agents in use, runs intake, risk and compliance workflows against the EU AI Act, ISO 42001 and NIST AI RMF, and enforces your policies as AI is used, blocking agent actions they don’t allow.”
How does Enzai enforce your policies?
“Enzai’s enforcement layer applies your AI policies at the moment an agent or AI tool tries to act, blocks unsanctioned tool calls before they execute, and records every decision for audit.”
Who is Enzai built for?
“Enzai is built for organizations operating in high-stakes environments, from scaling companies to global enterprises. It enables Legal, Risk, Compliance, and AI engineering teams to collaborate around a shared governance process.”
How is Enzai different from other AI governance tools?
“Three ways. Enzai enforces policy as AI is used, as well as recording it. Its frameworks and assessment content are written by regulatory lawyers. And it ships configured, so simple workflows run on defaults while complex ones can be configured in full.”
When does the EU AI Act apply to our organisation?
“The EU AI Act applies if you place AI systems on the EU market, put them into service in the EU, or use AI systems in the EU as a deployer. Non-EU organisations are in scope if the AI system's output is used in the EU.”
What changed with the May 2026 Article 6(3) guidelines?
“The Commission's May 2026 draft guidelines tightened the Article 6(3) exception path for AI systems that don't substantially influence high-risk decisions. Several use cases previously assessed as exception-eligible likely classify as high-risk under the new reading.”
What are the new Article 5 prohibitions in the Digital Omnibus?
“Two new prohibitions take effect 2 December 2026: AI-generated non-consensual intimate imagery and mandatory watermarking of AI-generated output. Both attach to providers of AI systems capable of producing such content, with deployer obligations following downstream.”
What evidence does Article 11 documentation require?
“Per high-risk system, Article 11 requires documented system purpose, training-data provenance, validation procedures, risk-management evidence, monitoring outputs, human-oversight mechanism, and post-market monitoring plan. Enzai captures each artifact continuously through the platform.”
What's the difference between ISO 42001 and ISO 27001?
“ISO 27001 is the information security management system standard. ISO 42001 is the AI management system standard, covering governance and operational controls for AI specifically. The two are complementary, and an AI-using enterprise typically needs both rather than one or the other.”
Is ISO 42001 mandatory?
“ISO 42001 is a voluntary management-system standard, but it is becoming a de facto procurement requirement. Enterprise buyers increasingly require ISO 42001 certification or evidence of readiness from AI vendors, similar to ISO 27001's trajectory a decade ago.”
How long does ISO 42001 certification typically take?
“From AIMS design to certification award, certification typically takes 9-18 months depending on starting maturity. Enzai compresses the build phase and provides continuous evidence capture for the operational phase that auditors examine during Stage 2.”
How do Annex A controls map to operational workflows?
“Annex A is structured as control objectives (A.5 risk management, A.6 risk treatment, A.7 impact assessment, A.8 third-party use, A.9 data quality, others). Enzai implements each Annex A control as an operational workflow tied to the AI inventory.”
Is NIST AI RMF mandatory for federal contractors?
“NIST AI RMF itself is voluntary. But federal procurement teams increasingly condition contract awards on documented NIST AI RMF alignment, particularly under OMB AI guidance and agency acquisition rules. For federal contractors, it is becoming a procurement-grade expectation.”
What are the four NIST AI RMF functions?
“The framework is structured around four functions: Govern (cultivate a risk-management culture), Map (establish context for the AI system), Measure (analyse and monitor risks), and Manage (allocate resources to highest-priority risks). Each function has sub-categories with specific outcomes.”
How does the Generative AI Profile (AI 600-1) extend the framework?
“NIST AI 600-1 adds GenAI-specific implementation guidance across all four functions, addressing risks like confabulation, data leakage, copyright exposure, prompt-injection vulnerabilities, and deepfake misuse that don't apply to traditional ML in the same way.”
How does NIST AI RMF relate to Treasury FS AI RMF?
“Treasury FS AI RMF is a sectoral overlay for financial institutions, building on NIST AI RMF's four-function structure with FS-specific control objectives including GV-1.6 documentation requirements and overlays consistent with SR 11-7 model risk management.”
What's in an Enzai AI inventory entry?
“Each entry holds the system's name, owner, business purpose, active use cases, underlying vendor and model references, risk tier, autonomy level, mapped frameworks, and the evidence of assessments completed. The entry updates continuously as the system evolves.”
How does Enzai surface Shadow AI?
“Enzai’s AI discovery finds the AI tools people use, sanctioned or not, and imports bring in agents and models from the platforms you build on. Together they show AI that no survey would catch.”
Does Enzai satisfy EU AI Act Article 11 documentation?
“Yes. Inventory entries capture the technical documentation Article 11 enumerates : system purpose, training data, validation procedures, risk-management evidence, monitoring outputs, and human-oversight mechanisms. Continuously, not reconstructed at audit time.”
How does the inventory connect to the rest of governance?
“The inventory is the foundational data layer for the Enzai platform. Risk assessments run against inventory entries; intake decisions feed new entries; vendor reviews link to vendor entries; framework mapping happens per entry; reporting aggregates from entries.”
Does Enzai work with our cloud and data stack?
“Enzai syncs with AWS, Azure, GCP, Databricks, Watsonx, and Snowflake for AI asset discovery and monitoring. Model governance covers OpenAI, Anthropic, and proprietary internal models through the same platform, with workflow handoffs into Jira, ServiceNow, and Slack.”
Data formats & record details
Download this profile and inspect its supporting evidence.
- Entity ID
- urn:readyscan:entity:enzai-q139782901
- Material fingerprint
- fnv1a64:70d0f09d5019eb13
- Entity revision
- fnv1a64:13dee974910af5d0
- Published
- 2026-10-20
- Modified
- 2026-10-20
- Source summary
- Enzai: “Enzai provides purpose-built AI infrastructure for governing autonomous AI agents and models, replacing legacy GRC bolt-ons for the EU AI Act and ISO 42001.”