Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Getting an AI policy approved is not the same as being ready for ISO/IEC 42001 certification. Your organization may already have risk registers, information security controls, model documentation, supplier assessments and responsible AI principles. The more important question is whether these elements operate together as an Artificial Intelligence Management System (AIMS) — and whether you can demonstrate that with evidence. Before asking: “How quickly can we get ISO 42001 certified?”

NIS2 and GDPR cannot be merged into one legal obligation, but much of the compliance work behind them can be consolidated. Organisations can use one control framework, shared asset and risk information, common supplier assessments and a single incident record while maintaining separate legal registers and notification workflows. The key is to consolidate evidence and operational processes — not the obligations themselves.

A CRA compliance gap assessment compares what your organization does with what Regulation (EU) 2024/2847 requires. It reviews each product and each role. It then produces a prioritized list of shortfalls. The list includes named owners, evidence pointers, and dates. It is not a conformity assessment. A conformity assessment decides whether a product may carry the CE marking. A gap assessment tells you whether you would survive one.