DE
Book a call

Framework timeline

What changed, and what’s next

The framework and regulatory milestones that shape security and AI compliance programs. Upcoming dates are highlighted.

Last reviewed: November 2026. Dates come from official publications; always confirm current status before acting.

  1. ISO/IEC 27001:2022

    The updated standard restructures Annex A into four themes with a consolidated control set.

  2. NIST AI RMF 1.0

    NIST publishes the voluntary AI Risk Management Framework, a common reference alongside ISO 42001.

  3. HITRUST CSF v11

    HITRUST releases CSF v11, supporting the e1, i1 and r2 assessment structure.

  4. ISO/IEC 42001:2023

    The first certifiable international standard for AI management systems is published.

  5. NIST CSF 2.0

    NIST CSF 2.0 adds a new Govern function and broadens scope beyond critical infrastructure.

  6. EU AI Act in force

    The EU AI Act enters into force, with obligations phasing in over the following years.

  7. EU AI Act: prohibitions

    Bans on prohibited AI practices and AI literacy requirements start to apply.

  8. EU AI Act: general-purpose AI

    Obligations for providers of general-purpose AI models start to apply.

  9. ISO 27001 transition deadline

    Certificates to the 2013 version expire; organizations must hold ISO/IEC 27001:2022 certification.

  10. EU AI Act: most obligations

    Most remaining obligations, including many high-risk system requirements, are scheduled to apply. Check for amendments, as changes to timing have been proposed.

  11. EU AI Act: regulated products

    Rules for high-risk AI embedded in regulated products are scheduled to apply.

Get updates in your inbox

The Lightwork Brief covers changes like these each month, with what they mean for your program.

Subscribe

Not sure what applies to you?

Take the free readiness assessment or book a call and we will map the changes that matter for your company.

Take the assessment