Home / Dated plan
The dated plan
A plan built from the public record, not from a promise. The only date taken from outside this build is the ISO stage record of 29 September 2026. The planning estimate of 17 February 2027 is ours, and it is labelled as an estimate wherever it appears. Everything else is work you can start now.
The estimate: Planning estimate only: 120 days from the build date of 20 October 2026. ISO records stage 50.00 on 29 September 2026. ISO has not announced a publication date.
| Window | Step | What it means | Behind it |
|---|---|---|---|
| Now | Read the record and run the check | Confirm the stage, the scope and the planning date with their basis. Record the answer you give the committee. | This page and the free check |
| Now | Inventory generative AI in use | List every generative AI system and embedded copilot, with the business owner and the technical owner. | 42001 A.4.2, A.4.3 |
| Now | Test one live use against the record | Take the use with the highest exposure and run the identification, analysis and treatment steps by hand. | 23894 6.3 to 6.5 |
| Now | Check the statement of applicability | Confirm every Annex A control the use depends on is included, or that its exclusion is justified. | 42001 Annex A |
| Now | Name the owners and the switch-off route | One name for approval, one for the output and one who can stop the system. | 42001 A.3.2 |
| Before 50.20 | Diarise the ballot window | The next stage opens an eight week ballot. The record gains a date when ISO publishes it. | ISO stage codes |
| Before 50.20 | Complete the impact assessment for the highest exposure use | Signed, dated and attached to the deployment decision. | 42001 A.5.2, A.5.3 |
| Before 50.20 | Run one adversarial test and keep the failures | Prompt injection in uploaded content, a jailbreak attempt and a data exfiltration attempt through a tool call. | 42001 A.6.2.4 |
| At 60.00 | Re-read the record when the text is under publication | The title and identifiers are fixed. Rebuild the register against the published clause list. | ISO stage codes |
| At 60.60 | Rebuild the register from the published text | Replace the companion reading with the draft read as published, and keep the old rows for the audit trail. | This record, changelog |
| Within 60 days of publication | Update the risk criteria and the control mapping | Add the generative AI risk sources and controls the published text names, and record the change. | 23894 6.3.4, 42001 A.6.1.2 |
| At the next AIMS audit | Show the decision log | Show what was decided before publication, on what basis, and what changed after it. | 42001 clause 9.2 |
Why the plan starts now
The AIMS duties and the EU AI Act duties already apply. Waiting for publication leaves the risk work until the point when an auditor can ask why the method does not reflect the new guidance.
Why the plan does not overclaim
It does not say the draft requires anything, because the clause text is not published. It schedules the work the draft's published scope names, against the standards that already carry it.