The Auditor Who Does Not Exist Yet

The European Commission holds formal investigative and enforcement authority over general-purpose AI model providers and over the AI Act's prohibited practices as of 2 August 2026, and the Commission sent its first enforcement information requests to more than 30 AI companies, covering safety and security of general-purpose and frontier models, and copyright and transparency. The European AI Office, working with 24 national market surveillance authorities, opened its first scheduled wave of compliance inspections, with three high-risk system types in scope: automated resume screening, algorithmic credit assessment, and AI medical triage. The enforcement regime is live, the companies know it, and the procurement question has sharpened: show us the ISO 42001 certificate, or show us what you have instead.

Here is the part nobody said out loud in Brussels. Armanino Certified LLC and ControlCase Assessments hold ANAB accreditation for ISO/IEC 42001, with the ControlCase grant effective 13 August 2026. ANAB lists 20 certification bodies accredited for ISO/IEC 42001 in its directory as of 21 September 2026, ranging from US audit firms that also certify ISO 27001 and ISO 27701 to global registrars with more than 30 locations. Twenty bodies. UKAS granted BSI its first accreditation for ISO 42001 certification on 15 January 2026. The timeline tells you everything: the EU AI Act's high-risk obligations were supposed to land on 2 August 2026, the Digital Omnibus deferred them to December 2027, and ISO 42006, the standard that tells certification bodies what their auditors must know, was only published to set out additional requirements for bodies that audit and certify AI management systems according to ISO/IEC 42001, building on ISO/IEC 17021-1 in July 2025. The accreditation bodies began adding it to their criteria documents in late 2025 and through the first half of 2026. Accreditation bodies are turning ISO 42006 from a published standard into operational criteria for ISO 42001 certifiers during 2026, with ANAB listing the final standard in its AIMS accreditation requirements, European Accreditation making it mandatory for member accreditation programmes, and national bodies creating transition policies.

So the market surveillance authority has companies saying they need certificates to satisfy procurement officers who read the AI Act and concluded ISO 42001 was the cleanest path to demonstrable conformity, even though the Act does not require it. The companies have certification bodies who hold accreditation. And the certification bodies have a problem: ISO 42006 requires AIMS certification bodies to demonstrate that audit teams possess knowledge spanning artificial intelligence, management systems, auditing, AI governance and the technical activities within the certification scope, focusing on collective audit-team competence rather than assuming a conventional management-system auditor can evaluate every AI environment without specialist expertise. That is the squeeze. A management-system auditor can read ISO 27001 and ISO 9001 and add a three-day training course and be useful on an ISO 42001 Stage 1 audit. They cannot assess whether a company's model-risk framework is fit for a 70B foundation model, whether the bias-detection methodology scales past the three test datasets the vendor gave them, or whether the logging meets the traceability obligations for a high-risk system under Annex III. Auditors must possess specialised expertise in AI technologies such as machine learning and data analytics, in addition to general auditing skills.

The standard allows the certification body to field a team. A CB can field a lead auditor with deep management-system experience, an AI specialist who understands model risk and lifecycle controls, and a domain expert for the sector under audit, and none of them needs to be all three at once. That sounds reasonable until you price it. Certification bodies may need AI specialists, auditor training, competence evaluation processes, revised audit-time methodology and accreditation assessments, with clients experiencing those costs indirectly through audit pricing. The AI specialist is not on the payroll; they are a contractor bill, and the project margin on a four-day Stage 2 audit does not comfortably absorb a second senior rate. Two organisations with similar employee counts can require very different audit effort when their AI portfolios, regulatory exposure or system risks differ substantially. The company deploying one customer-support chatbot and the company training a hiring model on 400,000 records both want an ISO 42001 certificate, and ISO 42006 says the audit work is not the same.

The deferral bought time, but it also hardened expectations. Regulation (EU) 2026/1744, effective 27 July 2026, preserved the August transparency and enforcement date but postponed core requirements for many high-risk systems, with relevant Chapter III rules for stand-alone high-risk systems under Article 6(2) and Annex III scheduled for 2 December 2027. December 2027 is fourteen months from now. Every enterprise compliance lead I have spoken to since the Omnibus passed has the same three-month window in their plan: get the ISO 42001 audit scheduled in Q2 2027, leave June for remediation if Stage 2 produces nonconformities, and have the certificate in procurement's hands by 1 September 2027 so the high-risk deployment does not have to pause in December. Twenty accredited certification bodies, call it 60 to 80 qualified lead auditors across them, and maybe 30 credible AI specialists who can satisfy ISO 42006's competence requirements and are willing to join audit teams at CB day rates rather than doing the advisory work that pays better. I am not guessing: the main unresolved issue is how consistently ISO 42006 will be implemented across accreditation markets, with major accreditation bodies incorporating the standard, but the pipeline has a name on every accreditation certificate and the count is public.

Now put yourself in the chair of the market surveillance authority in France, Germany or Spain. A company tells you its high-risk hiring system complies with the Act. You ask for the conformity assessment. They do not have one yet; the certification body is booked until March 2028 and they are on a waiting list. What do you enforce? The Act does not require ISO 42001 certification. ISO 42001 certification does not constitute EU AI Act compliance. But the technical documentation the company has to produce under Article 11, the risk-management system under Article 9, the data governance under Article 10, and the logs under Article 12 map cleanly to ISO 42001 Clauses 6, 7, 8 and 9.2, and every legal opinion the procurement department read said the certificate would be the fastest way to show the board that the deployment was defensible. The company built to the standard. They cannot get the audit. You are supposed to decide whether the system is compliant, but the conformity-assessment infrastructure that would give you a third-party number to lean on is eighteen months behind demand.

Article 50 transparency obligations apply from 2 August 2026, and Article 50(2) reaches systems already on the market from 2 December 2026, giving organisations more time to build the governance evidence an AIMS audit examines. Transparency you can check: did the system tell the user they were interacting with AI, did the provider mark synthetic content, can the deployer produce the summary of the system's functioning that Article 13 requires? The high-risk obligations in Chapter III are the ones that need the auditor. A hiring system has to log every decision, document the training data, run bias testing, and maintain a quality-management system. You can open the log file. You can read the data-governance policy. What you cannot do, as the market surveillance authority, is determine whether the bias-testing methodology the company chose is fit for the model architecture and the labour market it operates in. That is not a legal question. That is a technical judgement, and the person qualified to make it is the AI specialist on the ISO 42001 audit team, and that team is not available.

The European AI Office is building evaluation capacity. The Commission will launch a call to increase EU evaluation capacity of AI models before they are placed in the EU market, expected to be operational by 2027, strengthening third-party assessment of AI capabilities and risks. Operational by 2027 means the first cohort of evaluators will finish training and accreditation around the time the December 2027 deadline lands. The timing is not malicious; it is the honest answer to how long it takes to build the workforce. Auditors need experience gained under the supervision and evaluation of a more experienced auditor in the course of participation in at least one initial certification or re-certification audit and at least one surveillance audit, including review of documentation and risk assessment, implementation assessment, and audit reporting, and must maintain current knowledge related to AI systems and auditing through ongoing professional development. You cannot compress that into a weekend bootcamp. The accreditation body has to witness the audit, verify the competence, and sign off. The pipeline moves at the speed it moves.

I have sat in rooms where the market surveillance authority, the certification body and the company all agree the system needs to be assessed, all agree ISO 42001 is a reasonable framework, and none of them can name the auditor who will do the work before the deadline. The company asks if they can self-certify against the standard. No: ISO 42001 certification is a formal, third-party assessment that an accredited body issues after auditing your AI management system against ISO/IEC 42001:2023, earned by building the management system, running it long enough to produce evidence, and passing a two-stage audit. The certification body asks if the authority will accept a certificate issued under the old accreditation rules, before ISO 42006 was mandatory. The authority says maybe, but the next company will ask why their competitor got a certificate from an auditor without AI competence and they did not, and the answer to that question lands back on the authority's desk as a state-aid complaint or a market-distortion case. The company asks what happens if they deploy without the certificate. The authority says we will open an investigation, we will request the technical documentation, and if we find the system does not meet the obligations we will issue a corrective measure or a fine. The company asks what the fine is. The EU AI Act sets a hard deadline of 2 August 2026, with fines up to €35 million or 7% of global annual turnover for non-compliant high-risk AI systems. The room goes quiet.

This is the governance question ISO 42006 tried to solve and accidentally made worse. The standard is correct: AI systems present unique challenges in areas like ethics, data quality, risk, and transparency, and to certify that an organisation responsibly manages these challenges, auditors themselves need specialised knowledge and clear rules for conducting assessments, ensuring that the audit and certification of AI management systems is performed consistently and credibly. Correct, necessary, and twelve months too late to staff the market ahead of the first enforcement wave. The Commission can defer the deadline again. The Omnibus already moved it once. Another deferral tells every board in Europe that the regulation is not real, that the dates are negotiable, and that the twenty-month planning cycle they ran to hit December 2027 was wasted effort. Or the authority enforces without the certificates, writes the compliance assessment itself, hires consultants to do the technical review, and defends that process when the first company challenges the fine on the grounds that the authority lacked the specialist competence the EU's own standard says is required.

The auditor who can certify your high-risk AI system under ISO 42001, meeting ISO 42006's requirements, backed by an accredited certification body, probably exists. You are competing with 200 other companies for their time, and the price reflects that. The auditor who will be available when you need them does not exist yet. They are in a training programme somewhere, or they are finishing their supervised audit hours, or they are waiting for the accreditation body to complete the witness assessment. The regulation is live. The evaluation infrastructure is not.

Tarry Singh is the founder and CEO of Real AI (realai.eu), an enterprise AI advisory and deployment firm working with global enterprises on production agent systems, model risk, and AI sovereignty strategy. He also leads Earthscan (earthscan.io) for Energy AI, and is a founding contributor to the EU-funded HCAIM and PANORAIMA programmes for responsible AI education across European universities. He writes at tarrysingh.com.