ISO/IEC FDIS 27091 timeline: what is confirmed
There is no transition deadline for ISO/IEC FDIS 27091, because it is guidance and nothing is certified against it. What matters is the stage record and the planning date. This page separates the confirmed dates from the estimate.
| Date or window | What it is | Status | Source |
|---|---|---|---|
| 3 February 2023 | New project approved at stage 10.99. | Confirmed | ISO page 56582 |
| 1 October 2025 | Committee draft approved for registration as a DIS. | Confirmed | ISO page |
| 3 December 2025 | DIS ballot initiated, 12 weeks. | Confirmed | ISO page |
| 26 February 2026 | Close of voting at stage 40.60. | Confirmed | ISO page |
| 8 July 2026 | Full report circulated; DIS approved for registration as an FDIS. | Confirmed | ISO page |
| 13 July 2026 | Final text received or FDIS registered for formal approval, stage 50.00. | Confirmed | ISO page; stage feed |
| Stage 50.20 / 50.60 | FDIS ballot initiated and closed. None is recorded. | Not recorded | ISO page |
| Stage 60.00 / 60.60 | Under publication and published. None is recorded. | Not recorded | ISO page |
| 2027 | Publication expected. No ISO date is recorded. | Expected, not a date | ISO page; public expectation |
| 18 February 2027 | The planning date used by this site, 120 days from the build date. | Estimate, not an ISO date | This record |
What to do at each stage
- Now: list the AI systems and the personal data, settle the role, run the impact assessment and fix the data, supplier and logging gaps the current controls already require.
- When a later stage is recorded: re-read the ISO page, update the record and the watch, and check whether the scope or the subject changed.
- When the document is published: read the published text, compare it with the overlays on this site, and update the procedures and the references. Do not treat publication as a certification deadline.
- If you are certified to ISO/IEC 42001: keep the certificate and its surveillance cycle. The guidance does not change the certificate, and no transition is required.
The rules this is built from
Read from the real rules, not invented. The 38 control pages are the ISO/IEC 42001:2023 Annex A controls, read from the standards library: 101 evidence lines and 80 common failure lines, each cited to its control. The privacy layer is read from the public ISO/IEC FDIS 27091 record, the ISO abstract and the stage feed. The draft text is not public and is not reproduced.
ISO/IEC 42001:2023, Annex A
Each page states the control in our words, the evidence an auditor asks for, the common gaps and the privacy work the draft points at.
Open the control indexWhat the draft covers
Scope and role, the lifecycle, the evaluation of consequences, treatment, operation and evidence.
Read the public recordThe role and the four markets
Controller or processor, the lifecycle stages, and the instruments named for the US, EU, UK and Australia.
Open the referenceThe ISO/IEC FDIS 27091 text is not public and is not reproduced. The ISO/IEC 42001:2023 text is not reproduced either. Every source.