# Regulatory clock — Provael > Markdown twin of https://www.provael.com/regulatory-clock/ - derived mechanically from the page's own rendered content at > build time (it can state nothing the page does not). Curated, data-driven twins exist for the > key pages; this one is generated so the twin convention has no holes. STALE: REGULATORY CLOCK The regulatory entries on this page were last checked against their primary sources on 19 September 2026 — 54 days before this build’s anchor of 12 November 2026, past this project’s own 30-day window. Every date here was true when it was read and has not been re-read since. Verify against the primary source before relying on it. [The clock, with every source](https://www.provael.com/regulatory-clock/) 13 INSTRUMENTS · LAST VERIFIED 2026-09-19 # Every date, with its source and its limits. The dated record behind the compliance pages, published so you can check it rather than take it. Each entry gives the instrument, its status and date, a link to the primary source, and what a Provael run does not establish for it. - [Machine-readable JSON](https://www.provael.com/regulatory-clock.json) - 9 dated · 4 undated - Verified against EUR-Lex, ISO, IEC, NIST, ANSI webstore, law.go.kr Next dated obligation Last dated obligation · EU AI Act -- days : -- hrs : -- min In force since 2 December 2026 2 December 2026 —Regulation (EU) 2024/1689 — general application, transparency, governance and penalties On this date, further provisions apply. “Next” is counted from 2026-11-12, the day this site’s evidence was last pinned: the page is built without a wall clock, by design, so it cannot ask what today is. The entries were last checked against primary sources on 2026-09-19, the older of the two dates. Judge the page by that date: it is the oldest of the per-entry dates, derived rather than set, so re-checking one instrument cannot refresh the whole clock. Re-verified within 30 days of the date above; past 90 days the build fails. 1 of 13 entries was re-read against primary sources on 2026-09-28 (ISO 10218-1/-2:2025); the remainder still carry 2026-09-19. Not legal advice. This is dated editorial data, not a legal opinion. Verify against the primary official source before relying on any date. A date on this page has been wrong before and was corrected in public — see [errata](https://www.provael.com/errata/). If you hold a signed attestation bundle, check there before relying on a date inside it. The timeline ## Dated obligations, soonest first Dates are the applicable date for the provision named, not the date the instrument entered into force — those differ, often by years, and the applicable date is the one a programme plans against. - In force UNECE / EU ### UN R155 (vehicle cybersecurity and CSMS) UN Regulation No. 155, uniform provisions concerning the approval of vehicles with regards to cybersecurity and cybersecurity management system 6 July 2022 Applies since 6 July 2022 — in application as of 12 November 2026 Para. 6.7 (CSMS certificate valid for a maximum of three years), para. 7.2.2.2 (CSMS processes, incl. (e) testing), para. 7.3.3 (exhaustive risk assessment against Annex 5 Part A), para. 7.3.6 (testing before approval) In force since 22 January 2021. In the EU, Regulation (EU) 2019/2144 Annex II row D4 refuses EU type-approval to new vehicle types without it from 6 July 2022 and prohibits registration of new vehicles without it from 7 July 2024. The mandate is already running; the timing that matters is the cycle: a Certificate of Compliance for a CSMS is valid for a maximum of three years from deliverance (para. 6.7) and the Approval Authority may verify at any time that the requirements continue to be met (para. 6.8). ISO/SAE 21434:2021 (Edition 1, published August 2021, under systematic review) is the engineering standard those audits lean on and is not a regulation. What Provael supports: Adversarial-robustness measurements on a learned policy, held by a Cyber Security Management System as one input among many: the likelihood column for the learned component's rows of the para. 7.3.3 risk assessment, one test in the para. 7.3.6 set, one record of a para. 7.2.2.2(e) testing process. What it does not establish: No type approval, no CSMS certificate, no conformity position under R155 or ISO/SAE 21434; not legal advice. Type approval is granted by a type-approval authority against a CSMS. Simulation only; zero real-hardware results. Who is responsible: Vehicle manufacturer holding the CSMS certificate and filing the vehicle-type evidence with the Approval Authority. [UN R155 (vehicle cybersecurity and CSMS), 6 July 2022 — Primary source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:42021X0387) · [UN R155 (vehicle cybersecurity and CSMS) — Secondary source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02019R2144-20240707) · [UN R155 (vehicle cybersecurity and CSMS), 6 July 2022 — Provael crosswalk](https://www.provael.com/compliance/un-r155-iso-21434/) · verified 2026-09-19 - Published US ### ANSI/A3 R15.06-2025 ANSI/A3 R15.06-2025 (Parts 1+2) / ANSI/A3 R15.06-3-2025 (Part 3) 2025 Published 2025 — a publication date, not a date from which anything applies US industrial-robot safety, incl. the new cybersecurity provisions Parts 1 and 2 are the US national adoption of ISO 10218-1:2025 and ISO 10218-2:2025, reproducing them in their entirety, and replace ANSI/RIA R15.06-2012, which is withdrawn. Part 3 (Use of Industrial Robot Cells) is NOT an ISO adoption: it was developed in the United States with input from Canadian experts, so a US reader gets a clause set ISO 10218 does not contain. What Provael supports: The same adversarial-robustness evidence mappable to an ISO 10218-2 system assessment. What it does not establish: Not conformity to R15.06; not a certificate. Who is responsible: Robot integrator / system assessor (US). [ANSI/A3 R15.06-2025, 2025 — Primary source](https://webstore.ansi.org/standards/ria/ansia3r15062025partspart) · [ANSI/A3 R15.06-2025 — Secondary source](https://webstore.ansi.org/standards/ria/ansia3r15062025) · verified 2026-09-19 - Published International (ISO) ### ISO 10218-1/-2:2025 ISO 10218-1:2025 · ISO 10218-2:2025 (industrial robot safety, incl. cybersecurity) February 2025 Published February 2025 — a publication date, not a date from which anything applies Cybersecurity clauses — requirements added to the extent they apply to industrial robot safety; IEC 62443 appears only in the informative Bibliography Published February 2025 (ISO catalogue records 2025-02; secondary sources commonly cite 5 February). A publication date, not an entry-into-force date. What Provael supports: Adversarial-robustness evidence for the policy driving an industrial robot, mappable to a 10218-2 system assessment. What it does not establish: Not conformity to ISO 10218; not a certificate. Who is responsible: Robot integrator / system assessor. [ISO 10218-1/-2:2025, February 2025 — Primary source](https://www.iso.org/standard/73933.html) · [ISO 10218-1/-2:2025 — Secondary source](https://www.iso.org/standard/73934.html) · [ISO 10218-1/-2:2025, February 2025 — Provael crosswalk](https://www.provael.com/compliance/iso-10218/) · verified 2026-09-28 - In force KR ### Korea AI Framework Act Framework Act on the Development of AI and Establishment of Trust (AI Basic Act) 22 January 2026 Applies since 22 January 2026 — in application as of 12 November 2026 High-impact AI obligations, Art. 34(1): risk-management plan, human management and supervision, safety-and-reliability documentation Promulgated 21 January 2025 and in force 22 January 2026, one year later, under its own Addenda Art. 1, alongside its Enforcement Decree; the digital-medical-device part of Art. 2(4)(d) from 24 January 2026. The first enforceable comprehensive AI statute outside the EU. The Act itself defers nothing: its Addenda carry no provision postponing the penalty articles, so the widely repeated one-year grace before administrative fines is an MSIT enforcement-policy position rather than a statutory deferral. What Provael supports: Adversarial-robustness evidence for a high-impact AI system's risk-management and human-oversight documentation. What it does not establish: No Korean conformity or registration position; not legal advice. Who is responsible: AI business operator placing a high-impact system on the Korean market. [Korea AI Framework Act, 22 January 2026 — Primary source](https://www.law.go.kr/%EB%B2%95%EB%A0%B9/%EC%9D%B8%EA%B3%B5%EC%A7%80%EB%8A%A5%20%EB%B0%9C%EC%A0%84%EA%B3%BC%20%EC%8B%A0%EB%A2%B0%20%EA%B8%B0%EB%B0%98%20%EC%A1%B0%EC%84%B1%20%EB%93%B1%EC%97%90%20%EA%B4%80%ED%95%9C%20%EA%B8%B0%EB%B3%B8%EB%B2%95/(20676,20250121)) · [Korea AI Framework Act — Secondary source](https://cset.georgetown.edu/publication/south-korea-ai-law-2025/) · [Korea AI Framework Act, 22 January 2026 — Provael crosswalk](https://www.provael.com/compliance/korea-ai-framework-act/) · verified 2026-09-19 - Applies now EU ### EU AI Act Regulation (EU) 2024/1689 — general application, transparency, governance and penalties 2 August 2026 Applies since 2 August 2026 — in application as of 12 November 2026 Article 50 transparency; governance framework; notifying authorities; penalties General application date 2 August 2026, retained by Regulation (EU) 2026/1744. Two further prohibited practices (non-consensual intimate imagery and CSAM) apply from 2 December 2026. What Provael supports: Nothing directly — this entry exists so the clock is not misread as 'the AI Act does not apply yet'. What it does not establish: Not a compliance position on any Article 50 obligation. Who is responsible: Provider / deployer as applicable per obligation. [EU AI Act, 2 August 2026 — Primary source](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) · [EU AI Act — Secondary source](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng) · [EU AI Act, 2 August 2026 — Provael crosswalk](https://www.provael.com/compliance/eu-ai-act-article-15/) · verified 2026-09-19 - Adopted, transposition pending EU ### EU Product Liability Directive Directive (EU) 2024/2853 (revised product liability) 9 December 2026 Applies from 9 December 2026 — upcoming as of 12 November 2026 Software and AI systems are 'products'; lowered evidentiary burden; disclosure duties Published OJ 18 November 2024; in force 8 December 2024; Member States must transpose by 9 December 2026. Applies to products placed on the market or put into service after 9 December 2026. What Provael supports: Documented adversarial-robustness testing at the time of placing on the market — evidence toward the state-of-the-art and due-diligence positions a manufacturer will need to argue, and a dated artefact for the disclosure obligation. What it does not establish: Does not establish a defence, does not determine defectiveness, and is not legal advice. Who is responsible: Manufacturer / importer / authorised representative (and, for a component, its manufacturer). [EU Product Liability Directive, 9 December 2026 — Primary source](https://eur-lex.europa.eu/eli/dir/2024/2853/oj/eng) · verified 2026-09-19 - Adopted, applies from EU ### EU Machinery Regulation Regulation (EU) 2023/1230 20 January 2027 Applies from 20 January 2027 — upcoming as of 12 November 2026 Article 54; safety components with self-evolving behaviour pulled into conformity assessment Adopted; applies 20 January 2027 (Art. 54, as corrected by the Corrigendum of 4 July 2023). What Provael supports: Evidence that an AI-driven safety function resists instruction- and perception-level manipulation in simulation, with a measured redirection rate and CI, feeding the technical documentation for a conformity assessment. What it does not establish: Not a conformity assessment, not a certificate; Provael is not a notified body. Who is responsible: Manufacturer of the machinery / safety component (and a notified body for the third-party route). [EU Machinery Regulation, 20 January 2027 — Primary source](https://eur-lex.europa.eu/eli/reg/2023/1230/oj) · [EU Machinery Regulation — Secondary source](https://eur-lex.europa.eu/eli/reg/2023/1230/corrigendum/2023-07-04/oj/eng) · [EU Machinery Regulation, 20 January 2027 — Provael crosswalk](https://www.provael.com/compliance/eu-machinery-regulation/) · verified 2026-09-19 - In force EU ### EU Cyber Resilience Act Regulation (EU) 2024/2847 11 December 2027 Applies from 11 December 2027 — upcoming as of 12 November 2026 Vulnerability handling, SBOM, security updates; reporting duties phase in ahead of full application Reporting obligations (Art. 14) have applied since 11 September 2026, and ENISA's Single Reporting Platform went live at initial operating capability the same day. Full application 11 December 2027. Article 14 — reporting obligations for actively exploited vulnerabilities and severe incidents — applied since 11 September 2026 (as of 12 November 2026) - 24 hours Early warning notification to the CSIRT designated as coordinator and to ENISA. - 72 hours Main notification, adding general information on the vulnerability or incident and any corrective or mitigating measures taken. - 14 days Final report on an actively exploited vulnerability (Art. 14(2)(c)) - due 14 days after a corrective or mitigating measure is available, not 14 days after awareness. - one month Final report on a severe incident (Art. 14(4)(c)) - due one month after the 72-hour incident notification was submitted, NOT after a measure becomes available. [EU Cyber Resilience Act reporting sub-deadlines — Article 14, Regulation (EU) 2024/2847 (Official Journal)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) What Provael supports: SBOM per release, a coordinated vulnerability-disclosure policy, and an RFC 9116 security.txt. What it does not establish: A policy-attack result is not a vulnerability-handling process, and Article 14 is about the process. Article 14 obliges the manufacturer to NOTIFY actively exploited vulnerabilities and severe incidents to ENISA and the coordinating CSIRT on a fixed clock (24h / 72h / 14 days); a Provael run produces neither that process nor those notifications, and cannot start, satisfy or evidence that clock. CRA compliance remains a product-level obligation on the responsible economic operator. Who is responsible: Manufacturer / economic operator placing the product on the EU market. [EU Cyber Resilience Act, 11 December 2027 — Primary source](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) · [EU Cyber Resilience Act — Secondary source](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) · [EU Cyber Resilience Act, 11 December 2027 — Provael crosswalk](https://www.provael.com/compliance/eu-cyber-resilience-act/) · verified 2026-09-19 - Amended, in force EU ### EU AI Act Regulation (EU) 2024/1689 - Article 15 (accuracy, robustness, cybersecurity) 2 August 2028 Applies from 2 August 2028 — upcoming as of 12 November 2026 Article 15; applied to high-risk product-embedded AI systems (Annex I). NOTE: Regulation (EU) 2026/1744 moved Machinery Regulation (EU) 2023/1230 from AI Act Annex I Section A to Section B, so AI Act Chapter III (including Article 15) no longer applies DIRECTLY to AI-enabled machinery. Regulation (EU) 2026/1744: Parliament 16 June 2026, Council 29 June 2026, published OJ 24 July 2026, in force 27 July 2026. For machinery, the AI-robustness requirements are carried across by Commission delegated acts amending Annex III of Regulation (EU) 2023/1230, applicable by 2 August 2028 — not by direct application of AI Act Chapter III. What Provael supports: A measured attack-success rate with a 95% Wilson CI and a benign control is candidate evidence toward Art. 15 robustness documentation. What it does not establish: Does not establish conformity, is not a certificate, and is not a notified-body opinion. Who is responsible: Provider of the high-risk AI system / product manufacturer (and a notified body where a third-party route applies). [EU AI Act, 2 August 2028 — Primary source](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng) · [EU AI Act — Secondary source](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) · [EU AI Act, 2 August 2028 — Provael crosswalk](https://www.provael.com/compliance/eu-ai-act-article-15/) · verified 2026-09-19 No deadline ## Frameworks with no fixed date Listed and labelled rather than dropped: “there is no deadline” is a fact a programme needs. Without them the list above would read as the full set of obligations, when 4 of 13 entries are not deadlines at all. - Committee Draft, not published International ### ISO 25785-1 ISO/CD 25785-1 — Robotics: safety requirements for dynamically stable industrial mobile robots (legged, wheeled, or other forms of locomotion) — Part 1: Robots No fixed applicable date What Provael supports: Nothing toward conformity: there is no stable clause to cite. The humanoid attack family produces an anticipatory adversarial-robustness baseline that exists ahead of the standard. What it does not establish: No conformity position of any kind against a text that is not published, and no prediction of what the published text will require. [ISO 25785-1 — Primary source](https://www.iso.org/standard/91469.html) · [ISO 25785-1 — Provael crosswalk](https://www.provael.com/compliance/iso-25785/) · verified 2026-09-19 - Voluntary framework US (voluntary, international use) ### NIST AI RMF NIST AI 100-1 · Generative AI Profile (NIST AI 600-1) No fixed applicable date What Provael supports: A measured ASR with a CI and a benign control as the Measure-function evidence; a CI red-team gate for the Manage function. What it does not establish: The AI RMF is not certifiable; Provael provides evidence, not conformity. [NIST AI RMF — Primary source](https://www.nist.gov/itl/ai-risk-management-framework) · [NIST AI RMF — Secondary source](https://csrc.nist.gov/pubs/ai/100/2/e2025/final) · [NIST AI RMF — Provael crosswalk](https://www.provael.com/compliance/nist-ai-rmf/) · verified 2026-09-19 - Maintained standard series International (IEC/ISA) ### IEC 62443 IEC 62443 (series) No fixed applicable date What Provael supports: Per-channel adversarial-robustness evidence framed against the SL model, foldable into a 62443-3-3 assessment. What it does not establish: Not an SL certification. [IEC 62443 — Primary source](https://www.iec.ch/cyber-security) · [IEC 62443 — Secondary source](https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards) · [IEC 62443 — Provael crosswalk](https://www.provael.com/compliance/iec-62443/) · verified 2026-09-19 - Open initiative US ### NIST AI Agent Standards Initiative NIST CAISI AI Agent Standards Initiative (autonomous AI agents) No fixed applicable date What Provael supports: Nothing yet. Provael measures a VLA policy's adversarial robustness in simulation; if the initiative's security-controls work later reaches embodied agents, that evidence would be the kind of input it calls for. What it does not establish: Not conformity, not a certificate, not participation in the initiative, and no claim that NIST recognises Provael or its metric. [NIST AI Agent Standards Initiative — Primary source](https://www.nist.gov/artificial-intelligence/ai-agent-standards-initiative) · [NIST AI Agent Standards Initiative — Secondary source](https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure) · verified 2026-09-19 How to use it ## What this page is, and is not It is dated editorial data, maintained by hand and re-verified against primary sources. It is not legal advice and not a compliance determination. Every entry names the primary source precisely so you can stop trusting this page at the moment it matters. For what a Provael report can and cannot be used for under each instrument, see [the compliance pages](https://www.provael.com/compliance/). For the machinery pathway specifically, see [the Machinery Regulation explainer](https://www.provael.com/machinery-regulation/). --- Canonical: https://www.provael.com/regulatory-clock/