What the two frameworks actually ask for, why the deferred deadline is not a reprieve, and how we turn a quarter of checked outputs into evidence an auditor can use.
The challenge
If you run AI in a regulated business, sooner or later somebody asks: does this cover ISO 42001? Does it meet the EU AI Act?
The honest answer starts with what those frameworks actually certify. ISO/IEC 42001 sets requirements for an organisation's AI management system, and certification against it is carried out by an accredited certification body. The EU AI Act assesses an AI system and the quality management of whoever provides it. Neither certifies a single AI output, so no product can certify one for you under either framework, whatever its marketing says.
What an auditor actually asks for is evidence that your controls work. That accuracy is checked against criteria you have written down. That the system is monitored over time. That when something goes wrong, a named person looks at it and decides what happens. Under the AI Act, providers of high-risk systems have to declare accuracy levels and the metrics behind them, document their testing, design human oversight and monitor the system once it is in use.
The timetable has moved, and some have read that as a reprieve. The Digital Omnibus, Regulation (EU) 2026/1744, pushed the high-risk obligations for Annex III systems to 2 December 2027, and for AI built into regulated products to 2 August 2028. They were deferred mainly because the technical standards were not ready, not because the requirements went away. The European standard for accuracy and robustness was still being drafted this summer.
In most firms this evidence does not exist as a record. It gets assembled by hand when somebody asks, from spot checks, spreadsheets and email threads, and it rarely says what was checked against what, or who decided what afterwards. A certificate on one output does not fix that. It tells you whether one output was right. The auditor is asking whether you know, as a matter of routine.
The vision
Accuracy treated as a control, not a claim. Measured routinely, against criteria you set. Every finding reviewed by your own people, with a decision and a reason on record. The evidence built up as the work happens, so it exists before anybody asks for it.
And honest about its limits. The evidence should map itself to the clauses it answers, say how strongly it covers each one, and state plainly what it does not cover. A document that overclaims to an auditor does more harm than no document at all.
How Analect answers: the Accuracy Assurance Pack
The Accuracy Assurance Pack is a fixed-price service from ETT, run on Analect, over one quarter for one AI system. It builds on the Accuracy Evidence File: every output is still checked claim by claim against its source, with what it left out reported on its own.
What it adds is what the auditor asks about next:
- The system. We define it with you: what it is for, what produces its outputs, how you classify it under the AI Act, and whether you are its provider or deployer. Those are your statements. We record them, and we do not decide them for you.
- Your criteria. You set what counts as acceptable, such as no contradicted claim in any output. Every certificate is checked against the criteria in force when it ran.
- Your reviewers. Each month we certify up to 30 outputs. Anything flagged goes to a reviewer you name, who records a decision and a reason. A review never changes a verdict, and reviews by our own engagement lead are counted apart from yours, because the oversight has to be yours.
- The pack. At the end of the quarter, one signed pack registered under its own reference, with every certificate in it still checkable on its own.
The pack maps the evidence to the clauses of ISO/IEC 42001 and the EU AI Act it bears on, and rates each one as partial, context or not evidenced. Partial is the highest rating it ever prints, because a check on outputs cannot show a whole management system. Robustness, cybersecurity, bias, data governance and impact assessment are listed as not evidenced, so nobody assumes they are covered. Until the mapping has been independently reviewed, every pack says so on its cover. It also states in writing that it does not confer a presumption of conformity with the EU AI Act, and that it is not a certification under ISO/IEC 42001.
Then the part I think matters most. Our checker is itself AI grading AI output, so the first fair question about any accuracy figure is how good the grader is. We measured it on a battery of synthetic outputs with planted faults, each run three times. Counts of planted faults include all three runs.
Where it held:
- It caught 48 of 48 planted contradictions.
- It found 24 of 24 planted omissions.
- It wrongly called 0 of 15 true but unsourced claims contradicted.
Where it fell short:
- It caught 9 of 12 misattributions. The other 3 were disputed and left for a person.
- It gave a clean result on 12 of 15 runs of faithful outputs. The other 3 did not settle, so no grade was issued.
- It wrongly called 2 of 1,646 untouched claims contradicted.
- Across repeat runs of the same output, 33 of 569 claims changed verdict.
- Its weakest result: when an output carried a fact in words unlike the source's own, it recognised it only 9 times out of 21. It recorded the fact as dropped 6 times and disputed it 6 times.
We publish the weak results beside the strong ones. A pack quotes that record only when its certificates ran on exactly the same models and settings, and otherwise says the checker is not validated for that configuration.
If you are being asked how you know your AI is accurate, the Accuracy Assurance Pack starts with one system.