HodeiShield®

AI Act and ISO/IEC 42001: what is measured today and what is in preparation.

For an organisation that uses or integrates AI: we measure your AI Act coverage, score ISO/IEC 42001 control by control and treat your AI providers as third parties. The AI systems register is in preparation, with no date.

Request a demoRead the documentation (opens in a new tab)
  • AI Governance: in preparation, with no date and no promises
  • Data in the EU (OVH, Gravelines); Cloudflare (US) handles DNS, CDN and TLS on the request path

What the AI Act requires, in brief

It regulates AI by the risk of the system and the role you play: provider or deployer.

Informational summary, not legal advice. Dates have changed recently; check the consolidated version on EUR-Lex.

Prohibited practices
Some uses of AI are prohibited (Article 5), and providers and deployers must take measures to support the AI literacy of their staff, without guaranteeing a specific level (Article 4).
High-risk systems
Those in Annexes I and III have requirements on risk management, data, technical documentation, event logging and human oversight. Those who deploy them have obligations of their own (Article 26).
Transparency and general-purpose models
There are duties to inform users (Article 50) and specific requirements for providers of general-purpose models.
Role and calendar
What applies to you depends on whether you are a provider or a deployer and on the system's risk. The high-risk timeline was amended by Regulation (EU) 2026/1744; check the consolidated version on EUR-Lex.

A phased calendar

Dates under Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Check the consolidated text before planning.

  1. 2 Feb 2025

    Chapters I and II: prohibitions and AI literacy

    Article 5 (prohibited practices) and Article 4 (AI literacy) apply. Regulation (EU) 2026/1744 reworded Article 4, which applies in its new form since 27 July 2026: support the development of AI literacy, without guaranteeing a specific level.

  2. 2 Aug 2025

    Penalties, general-purpose models and governance

    Chapter XII on penalties (except Article 101), the obligations for providers of general-purpose AI models (Chapter V) and the governance rules apply; infringements of Article 5 can be fined from this date (Article 113(b)).

  3. 2 Aug 2026

    Transparency obligations

    General date of application. Article 50 applies: duties to inform people who interact with an AI system or are exposed to AI-generated or manipulated content. Generative systems placed on the market before this date have a transition until 2 December 2026 (Article 111(4)).

  4. 2 Dec 2026

    New prohibited practices

    The points added to Article 5 by Regulation (EU) 2026/1744 apply: Article 5(1)(ba) and (bb), and Article 5(1a) and (1b). The same day is the deadline for generative systems placed on the market before 2 August 2026 to comply with Article 50(2) (Article 111(4)).

  5. 2 Dec 2027

    Annex III high-risk

    Chapter III, Sections 1 to 3, apply to high-risk systems under Article 6(2) and Annex III, including deployer obligations (Article 26) and the fundamental rights impact assessment (Article 27) (Article 113(c)(i)).

  6. 2 Aug 2028

    Annex I high-risk

    Chapter III, Sections 1 to 3, apply to high-risk systems under Article 6(1) and Annex I, which are safety components of regulated products or regulated products themselves (Article 113(c)(ii)).

  7. 2 Aug 2030

    Public authorities

    Providers and deployers of high-risk AI systems intended to be used by public authorities must comply by this date, even if the system was already on the market (Article 111(2)).

HodeiAI: the platform's own AI, described with its limits

An example of how an AI is governed inside a product, not a declaration of conformity.

Model
Mistral AI, a sub-processor of Hodeitek.
Pseudonymisation first
HodeiAI and the virtual CISO pseudonymise the personal data they recognise before sending; the mapping lives in memory only. The risk analysis of supplier scans does not pseudonymise: it sends the supplier's domain and the findings.
Administrator switch
An administrator of your organisation can turn HodeiAI off; when off, no call to the model is made.
Never acts without confirmation
HodeiAI proposes; a person with a write role approves, once, within 15 minutes and bound to the proposal's hash.

From each obligation to a HodeiShield capability

With the phase of the cycle. This is where it is clearest what exists today and what does not.

Direct: the platform does it. Partial: it supplies evidence or one part, the rest is yours. Not covered: outside HodeiShield.

  • Obligation:

    Measure your coverage against the AI Act

    Regulation (EU) 2024/1689

    What HodeiShield does:

    The AI Act is among the 17 frameworks as coverage measured against the canonical controls.

    Docs · Compliance (opens in a new tab)
    PhaseSENSEPREDICT
    ScopePartial
  • Obligation:

    Organise AI governance as a management system

    ISO/IEC 42001

    What HodeiShield does:

    Control-by-control ISO/IEC 42001 scoring with evidence that has an owner and a validity date. The standard helps organise governance; it does not equal AI Act compliance.

    Docs · Compliance (opens in a new tab)
    PhaseSENSEPREDICT
    ScopeDirect
  • Obligation:

    Treat AI providers as third parties

    Art. 25 and 26

    What HodeiShield does:

    A provider of AI models or services joins the graph like any supplier: questionnaire, periodic external scanning, CVEs and concentration.

    Docs · Risk engine (opens in a new tab)
    PhaseSENSEPREDICT
    ScopePartial
  • Obligation:

    AI literacy measures and their evidence

    Art. 4 (literacy)

    What HodeiShield does:

    A policy library and an evidence engine with owner, validity and status.

    Docs · Compliance (opens in a new tab)
    PhaseSENSE
    ScopePartial
  • Obligation:

    Inventory of AI systems and risk classification

    Art. 6 and Annex III

    What HodeiShield does:

    The AI systems register belongs to the AI Governance module, which is in preparation, with no date. It does not exist in the platform today.

    PhaseOutside the cycle
    ScopeNot covered
  • Obligation:

    Technical documentation, event logging and impact assessment

    Art. 11, 12 and 27

    What HodeiShield does:

    Outside HodeiShield.

    PhaseOutside the cycle
    ScopeNot covered
  • Obligation:

    Human oversight of AI

    Art. 14 and 26

    What HodeiShield does:

    Applied in HodeiAI: it proposes and a person approves. For your own AI systems, oversight is yours.

    Docs · HodeiAI (opens in a new tab)
    PhaseACT
    ScopeNot covered

What HodeiShield does not do with the AI Act

More limits than on the other pages, because the module does not exist yet.

  • There is no AI systems register

    AI Governance is in preparation. We give no date and do not present it as available.

  • It does not classify your systems by risk or assess conformity

    That classification, the technical documentation and the conformity assessment are yours.

  • AI Act coverage is measured against the canonical controls

    It is reported against canonical controls, without claiming to cover every requirement of the regulation.

  • ISO/IEC 42001 is not the AI Act

    It helps organise AI governance but does not replace the regulation's obligations.

Questions about the AI Act

With what exists today and what does not.

Does HodeiShield have an AI systems register?

Not yet. The AI Governance module, which would include that register, is in preparation and has no date. Today you can measure AI Act coverage and score ISO/IEC 42001.

Am I a provider or a deployer?

It depends on how you use AI. Whoever develops or places a system on the market is a provider; whoever uses it under their authority is a deployer. Your legal counsel pins it down.

What AI does HodeiShield use?

HodeiAI uses Mistral AI. Before sending, HodeiAI and the virtual CISO pseudonymise recognised personal data; the risk analysis of supplier scans does not pseudonymise. An administrator can switch HodeiAI off.

Does ISO/IEC 42001 make me AI Act-compliant?

Not on its own. It is a management-system standard that helps organise AI governance. The regulation's obligations still have to be met.

When does the AI Act apply?

In phases, under Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744: Articles 4 and 5 since 2 February 2025 (Article 4 in its reworded form since 27 July 2026); penalties and the obligations for general-purpose models since 2 August 2025; the general date, including Article 50, on 2 August 2026 (with a transition until 2 December 2026 for generative systems already on the market, Article 111(4)); the new points of Article 5 on 2 December 2026; Annex III high-risk systems on 2 December 2027 and Annex I high-risk systems on 2 August 2028. Check the consolidated text on EUR-Lex.

Related solutions

Other use cases

A framework-coverage session

For now the demo is a coverage session: what is measured for the AI Act and ISO/IEC 42001, with what evidence, and what remains in preparation.

No commitment and no promised dates.

Request a demoRead the documentation (opens in a new tab)