The European Council and Parliament have continued to adjust the AI Act timetable through the Digital Omnibus process. Buyers should confirm the current legal schedule against official EU sources for their system and role rather than relying on a vendor countdown.
What remains useful for procurement is the distinction between static documentation and contemporaneous operating evidence. A system description can be written after a demo. Identity, policy, approval, route, and outcome evidence must be produced while the workflow runs if a reviewer is expected to reconstruct the decision later.
Build the evidence model before the vendor comparison. Select one representative workflow. Define who may initiate it, which sources it may use, what the AI may draft or change, where human approval is required, and which record must remain.
Test the demonstrated configuration. Ask the vendor to run the workflow in the evaluation tenant, retrieve the resulting operating record, and repeat the test with a different user or source. The result should follow the configured authority rather than the wording of the prompt.
Keep certification and product evidence separate. ISO 42001 can structure an organization’s management system. A platform can provide deployment-specific operating evidence. Neither statement turns a framework mapping into organizational certification.
Track official sources. Legislative schedules and implementation guidance change. The stable buying requirement is to preserve evidence from the point at which the workflow is used, not to assemble a policy pack after the decision.
For non-EU organizations. The legal framework may differ, but customer reviews, insurer questions, board oversight, and sector regulation still create an operating-evidence test. The useful question is whether the team can reproduce the decision record without relying on the vendor’s prepared dashboard.
The position from here. The reason to build evidence-rich AI governance is not a calendar or penalty figure. It is that an organization should be able to show how a consequential AI-assisted decision was authorized, constrained, approved, and recorded.
Primary sources: Council of the EU and European Parliament.