EU AI Act, ISO/IEC 42001 and GDPR readiness, one report

What it is for

Most organisations meet AI security, data protection and the AI Act as three projects with three consultants and three reports that do not agree. G1 does them together, in one engagement, with one report.

The dates that matter now

Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moved several AI Act dates.^⁠[1][2] As amended:

• the transparency obligations of Article 50 apply from 2 August 2026, with a grace period to 2 December 2026 for certain marking duties of systems already on the market;^⁠[3]
• the rules for high-risk systems listed in Annex III apply from 2 December 2027;^⁠[2]
• the rules for high-risk systems in products covered by Annex I apply from 2 August 2028.^⁠[2]

What we look at

• Classification: whether each system is prohibited, high-risk, subject only to transparency duties, or minimal risk, and whether you act as provider or deployer.
• ISO/IEC 42001: the AI management system standard published in December 2023,^⁠[4] and its Annex A control objectives, from policies related to AI to third-party and customer relationships.^⁠[5]
• GDPR: data protection by design and by default under Article 25,^⁠[6] the impact assessment under Article 35,^⁠[7] and the European Data Protection Board’s Opinion 28/2024 on personal data in AI models.^⁠[8]
• Article 50: whether people are told when they are dealing with an AI system.^⁠[9]

What you receive

One report with the classification, the gaps, an outline of the technical documentation and a DPIA, written so that engineering, the board and your counsel can work from the same text.

What it is not

G1 is technical and governance readiness work. It is not legal advice and it is not a guarantee of compliance; your counsel decides how the law applies to you. Where ISO/IEC 42001 certification is your goal, G1 prepares you for an accredited certification body; TriOngle does not certify.