International standards
One control layer across the AI factory, mapped to the management systems you certify against, the risk frameworks you report to and the law you are bound by.
Standard by standard
What each one asks of an organisation running AI, and where the platform supplies the control or the evidence for it.
- Certifiable
ISO/IEC 42001:2023
The management system standard for AI: how an organisation governs the AI it builds, provides or uses.
What it asks
Clauses 4 to 10 set the management system. Annex A lists 38 reference controls under nine objectives, from AI policy and impact assessment to the AI system lifecycle, data for AI, and third-party relationships.
Where Kronos Lab supplies the control or the evidence
- AI system lifecycle (A.6): gates at intake, test, release and run, each with a recorded decision
- Data for AI systems (A.7): provenance, quality checks and signed datasets
- Third-party relationships (A.10): every external model, dataset, skill and MCP server scanned and registered
- Inventory of AI systems with their versions, owners and approvals
- Certifiable
ISO/IEC 27001:2022
The information security management standard. Its Annex A has 93 controls in four themes: organisational, people, physical and technological.
What it asks
Your ISMS scope now includes AI systems: their data, models, pipelines and the services they call.
Where Kronos Lab supplies the control or the evidence
- ICT supply chain security (A.5.21) for models, datasets and agent components
- Malware protection (A.8.7) on every artifact and document at intake
- Data masking and leakage prevention (A.8.11, A.8.12) through PII redaction and output filters
- Logging and monitoring (A.8.15, A.8.16) through the immutable decision record
- Use of cryptography (A.8.24): signing, customer-held keys and post-quantum algorithms
- Guidance
ISO/IEC 23894:2023
Guidance on risk management for AI. It applies the ISO 31000 process to AI-specific risk sources across the lifecycle. It is not certifiable on its own; it feeds the risk process of ISO/IEC 42001.
What it asks
Identify, analyse, evaluate, treat and monitor AI risks, from design and data collection through deployment and retirement.
Where Kronos Lab supplies the control or the evidence
- Risk treatment applied as policy at each gate, versioned as code
- Continuous monitoring through red-team runs and drift detection
- A record of every treatment decision for the risk register
- Voluntary
NIST AI RMF 1.0 and the Generative AI Profile
The US AI Risk Management Framework organises risk work into four functions: Govern, Map, Measure and Manage. Its Generative AI Profile (NIST AI 600-1, July 2024) names twelve risks that generative AI creates or makes worse.
What it asks
Govern sets accountability; Map finds the systems and what could go wrong; Measure tests them; Manage responds to what you find.
Where Kronos Lab supplies the control or the evidence
- Map: an inventory of models, datasets, agents and their sources
- Measure: scheduled red teaming, guardrail scores and drift metrics
- Manage: fail-closed gates and SOC playbooks per class of event
- Profile risks covered directly: information security, data privacy, value chain and component integration, confabulation
- Regulation
EU AI Act (Regulation (EU) 2024/1689)
The EU's risk-based AI law. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) moved the main high-risk deadlines.
What it asks
Prohibitions apply from 2 February 2025, general-purpose model obligations from 2 August 2025, and transparency duties under Article 50 from 2 August 2026. High-risk systems in Annex III follow from 2 December 2027, and those in products under Annex I from 2 August 2028.
Where Kronos Lab supplies the control or the evidence
- Risk management (Art. 9) and data governance (Art. 10): gated, signed and traceable data
- Record-keeping (Art. 12): automatic, tamper-evident logs of every decision
- Human oversight (Art. 14): reason codes and a queue for review
- Accuracy, robustness and cybersecurity (Art. 15): defences against data poisoning, model poisoning and adversarial inputs, tested continuously
- Guidance
CIS Controls v8.1 and the AI companion guides
The Center for Internet Security's prioritised controls. In April 2026 CIS published companion guides that apply them to large language models, AI agents and MCP.
What it asks
Inventory, secure configuration, data protection, access control, audit log management and penetration testing, applied to AI systems.
Where Kronos Lab supplies the control or the evidence
- Inventory of AI assets: models, datasets, agents, skills and MCP servers
- Access control per tenant, model and tool
- Audit log management through the decision record and SIEM forwarding
- Continuous adversarial testing of live endpoints
- Principles
OECD AI Principles
The intergovernmental principles for trustworthy AI, adopted in 2019 and updated in 2024. Many national AI policies, including in the Gulf, build on them.
What it asks
Robustness, security and safety; transparency and explainability; accountability across the AI lifecycle.
Where Kronos Lab supplies the control or the evidence
- Robustness and security: fail-closed gates and adversarial testing
- Transparency: a reason code on every decision
- Accountability: an attributable, verifiable record of who and what decided
EU AI Act: the dates that apply
As amended by the Digital Omnibus on AI, in force since 27 July 2026.
| From | What applies | Status |
|---|---|---|
| 2 February 2025 | Prohibited practices and AI literacy | In force |
| 2 August 2025 | General-purpose AI model obligations; governance and penalties | In force |
| 2 August 2026 | Transparency duties under Article 50; Commission enforcement of general-purpose model rules | In force |
| 2 December 2026 | Machine-readable marking for AI-generated content, for systems already on the market | Upcoming |
| 2 December 2027 | High-risk systems listed in Annex III, such as employment, education and credit | Upcoming |
| 2 August 2028 | High-risk systems in products covered by Annex I, such as medical devices and machinery | Upcoming |
Dates are as published in the Official Journal and reviewed in October 2026. Which obligations apply to you depends on your role (provider or deployer) and the risk class of each system; take legal advice for your case.