Evidence, review and the date
The draft is at stage 50.00, registered for formal approval on 13 July 2026. Publication is expected in 2027. What you can do now is keep the evidence that will still be right when the text lands, and watch the record for the change.
ISO records ISO/IEC FDIS 27091 at stage 50.00, final text received or FDIS registered for formal approval, on 13 July 2026. The committee is ISO/IEC JTC 1/SC 27, the edition is the first, and the document is 35 pages. No 50.20, 50.60, 60.00 or 60.60 date is recorded.
The planning date on this site is 18 February 2027, 120 days from the build date. It is an estimate for planning, taken from the stage and the public expectation of publication. It is not an ISO commitment and the site labels it an estimate wherever it appears.
There is no transition deadline, because there is nothing to transition from. No certificate is issued against 27091. The certificate a buyer holds is against ISO/IEC 42001, ISO/IEC 27701 or ISO/IEC 27001, and this record is built to strengthen those, not to replace them.
The evidence to keep is dull and decisive: the system register, the data and provenance record, the impact assessment, the supplier terms, the logs and their retention, the incident route, the review minutes. If the published text asks for something else, that set is still the base you will amend.
What an auditor or a privacy reviewer is likely to ask for
- Scope The AI systems in use and the personal data each one touches, with the role the organization plays in that data.
- Assessment The impact assessment for each system, the groups considered, the harms named and the decision taken.
- Control The data and provenance record, the supplier terms, the retention setting and the test that the control works.
- Review The monitoring thresholds, the log retention, the incident route and the date of the last review.
These are the records this site expects a reader to hold for the area. They are our reading of the public record and the current controls, not 27091 draft text.
Where it commonly fails today
- The AI systems are not listed, so the assessment covers the model and misses the personal data around it.
- The assessment stops at accuracy and never reaches the person the output decides about.
- The data provenance is a folder of files with no record of where each dataset came from or on what basis.
- A supplier changes the model or the retention period and the assessment is not repeated.
- The logs hold prompts and outputs far longer than anyone decided they should.
What to do now, while it is still a draft
Do not rebuild the system around a draft. Do the work that will be right under either instrument: list the systems and the data, settle the role, run the impact assessment, record the provenance, fix the supplier terms, set the retention and test the incident route. If the published guidance differs, the process survives the wording change.
Source for this public record page: the ISO page 56582 and its stage feed, with the current control set where a requirement is stated. The draft text is not public and is not reproduced. Every source.