ISO 42001 and the EU AI Act for Georgian software exporters

The EU AI Act applies to AI systems placed on the EU market or used in the EU, wherever the developer is based. For Georgian companies building AI features for EU clients, ISO/IEC 42001 is a practical way to organise the work.

Why a Georgian company is affected

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. It applies to providers who place AI systems on the EU market, to deployers using AI in the EU, and to providers and deployers outside the EU where the output of the system is used in the EU. A team in Tbilisi that builds a recruitment screening tool for a German client, or a credit scoring model for a Lithuanian lender, is within its reach through the client relationship even though Georgia is not an EU member.

In practice, EU clients will pass AI Act requirements into contracts and supplier questionnaires. A Georgian provider needs to be able to say what role it plays, what risk category the system falls into and what evidence it can give.

Dates as of October 2026

2 February 2025. Prohibitions on certain AI practices apply, such as social scoring and manipulative techniques.
2 August 2025. Obligations for providers of general-purpose AI models apply.
2 August 2026. Transparency obligations under Article 50 apply, for example telling people they are interacting with an AI system and marking AI-generated content. Generative systems already on the market before that date have until 2 December 2026 for the marking requirement.
2 December 2027. Obligations for high-risk systems listed in Annex III (such as employment, credit scoring, education, access to essential services) apply. This date was moved from August 2026 by the Digital Omnibus on AI, adopted by the EU in mid-2026.
2 August 2028. Obligations for high-risk AI that is a safety component of products covered by EU product legislation in Annex I.

The delay for high-risk systems is time to prepare, not a reason to wait. Clients are already asking about risk classification and governance in tenders.

What ISO/IEC 42001 is

ISO/IEC 42001:2023 specifies requirements for an AI management system (AIMS). It follows the same structure as ISO/IEC 27001 and ISO 9001: context, leadership, planning, support, operation, performance evaluation and improvement. On top of that it requires AI risk assessment, AI system impact assessment covering effects on individuals and society, and a set of Annex A controls for data, transparency, human oversight, the AI system life cycle and third parties.

Certification to ISO/IEC 42001 is available from accredited certification bodies. It does not, by itself, prove conformity with the AI Act. It does give you a governed process that produces much of the evidence the Act expects.

How the two fit together

Inventory and role. List every AI system and model you build or use, and record whether you act as provider, deployer, importer or distributor for each. The AIMS requires this inventory; the AI Act depends on it.
Risk classification. Classify each system against the Act's categories: prohibited, high-risk, limited-risk with transparency duties, or minimal. Record the reasoning.
Impact assessment. The ISO/IEC 42001 impact assessment can be designed to also cover what the Act expects from risk management for high-risk systems.
Data governance. Training, validation and test data sources, quality checks and bias testing, documented in one place.
Technical documentation and logs. Life cycle controls in the AIMS can produce the records a high-risk provider must keep.
Human oversight and transparency. Instructions for use, user notices and oversight measures defined per system.
Supplier control. If you build on third-party models, the AIMS manages what you know about them and what you pass on to clients.

Personal data and security

AI projects almost always involve personal data. The GDPR applies to EU data subjects and the Law of Georgia on Personal Data Protection to processing in Georgia, including impact assessments for high-risk processing. Security of models, data pipelines and inference infrastructure is usually best handled by an existing ISO/IEC 27001 ISMS, with the AIMS added on top. See our GDPR page and ISO 27001 for IT companies.

How BALTUM helps

We start with an AI inventory and role and risk classification against the AI Act, then a gap assessment against ISO/IEC 42001. We help build the AI policy, impact assessment method and life cycle controls, integrate them with your ISMS where you have one, train product and engineering teams, and run the internal audit before certification by an accredited body. The plan and duration are set after the first assessment. Details are on our ISO 42001 page.

This article is general information, not legal advice. To discuss your AI products, use the form on this site or write to info@baltum.org.

Frequently asked questions

Does the EU AI Act apply to a company registered in Georgia?

It can. The Act applies to providers placing AI systems on the EU market and to providers outside the EU whose system output is used in the EU, regardless of where the company is registered.

Is ISO 42001 certification enough for AI Act compliance?

No. ISO/IEC 42001 certification shows you run an audited AI management system. AI Act conformity, especially for high-risk systems, has its own specific requirements, though the AIMS produces much of the evidence.