ISO & Compliance Implementation articles.
End-to-end ISO implementation — gap assessment, documentation, audit and certification readiness, plus SOC 2.
Latest in ISO & Compliance Implementation.
EN 18286:2026: The EU AI Act’s First Harmonized Standard
Cited in the EU Official Journal on 15 October 2026, EN 18286 is the first harmonized standard under the AI Act — a quality management system standard giving providers a presumption of conformity with one specific obligation.
Read article →ISO/IEC 27090:2026 Explained: What the New AI Security Threats Standard Covers
Published 14 October 2026, ISO/IEC 27090 catalogues nine AI-specific security threats and their mitigations — and clarifies it isn’t certifiable, but feeds the risk assessment under ISO 27001 and 42001.
Read article →SOC 2 Type II Readiness: The Trust Services Criteria Explained
“SOC 2 report” gets used loosely, but the Trust Services Criteria, Type I vs Type II, and who actually performs the assessment are worth being precise about.
Read article →The EU Cyber Resilience Act: A Compliance Timeline for Software and Connected-Device Vendors
If you sell software or connected hardware into the EU market, the Cyber Resilience Act applies to you whether or not you’re based there — and its first binding deadline is closer than most vendors’ current compliance roadmaps assume.
Read article →ISO 42001 Explained: What the New AI Management System Standard Requires
As enterprises scale AI deployments, “how do you govern this responsibly?” has moved from an ethics-committee question to a procurement and audit question — and ISO/IEC 42001 is the standard increasingly showing up on both sides of that conversation.
Read article →ISO/IEC 27701:2025: What Standalone PIMS Certification Changes
ISO/IEC 27701 was revised in October 2025 — it’s now independently certifiable, not just an ISO 27001 extension. What that means for your PIMS.
Read article →EU AI Act vs. ISO 42001: What Each Requires
The EU AI Act is binding law with tiered obligations and penalties up to €35M or 7% of global turnover. ISO/IEC 42001 is a voluntary, certifiable standard. How they relate, and where 42001 supports Act compliance.
Read article →Vendor Risk Management: Building a Third-Party Security Assessment Programme That Scales
A growing share of major breaches trace back not to the victim organization’s own systems, but to a vendor or supply-chain partner with weaker controls and privileged access. Vendor risk management has moved from a compliance checkbox to a genuine security priority.
Read article →ISO 42001 vs. NIST AI RMF: Picking a Governance Framework
ISO/IEC 42001 is a certifiable management-system standard. NIST’s AI RMF is a voluntary, non-certifiable risk-management framework built around four functions. A practical comparison for picking the right starting point.
Read article →SOC 2 vs ISO 27001: Which Should Your SaaS Company Get First?
This is one of the most common questions from SaaS founders and CTOs facing their first enterprise security questionnaire: SOC 2 or ISO 27001 — and the honest answer is that it depends on who’s asking, not which framework is objectively “better.”
Read article →From Spreadsheet GRC to Continuous Control Monitoring: Automating Compliance Evidence
The weeks before an audit, spent screenshotting settings and chasing down evidence that controls are actually operating, are the clearest sign a compliance programme is running on spreadsheets and goodwill rather than continuous monitoring.
Read article →ISO 27001 Certification: A Realistic Timeline and Readiness Checklist
“How long will ISO 27001 take?” is almost always the first question, and the honest answer is: it depends more on your organization’s readiness than on the standard itself.
Read article →