The Questionnaire Outran the Regulator: What Automation Sellers Must Prove in Late 2026

What the delay did and did not do

The facts first, because they are widely misreported. The European Commission proposed the deferral in its Digital Omnibus package on 19 November 2025, citing the late arrival of the harmonised technical standards that vendors were meant to build against. After negotiations that nearly collapsed in April, EU lawmakers reached political agreement on 7 May 2026. The result, as summarised by law firms including Travers Smith, Gibson Dunn, DLA Piper and Holland & Knight, moves the compliance date for standalone high-risk systems listed in Annex III from 2 August 2026 to 2 December 2027, and for AI embedded in products already covered by EU product-safety law to 2 August 2028.

What did not move is the part that touches ordinary automation work most directly. The transparency duties in Article 50 applied on schedule from 2 August 2026: an AI system that interacts with a person has to disclose that it is an AI, generated images, audio, video and text must be marked in machine-readable form, and deepfakes and AI-generated text on matters of public interest must be clearly labelled. Non-compliance carries fines of up to 15 million euros or 3 percent of worldwide annual turnover. A narrow grace period applied only to the marking and detection duty, and only for systems already on the market before 2 August 2026, running to 2 December 2026. We covered the mechanics of the Act itself in the EU AI Act and business automation; this article is about the commercial aftershock rather than the statute.

That aftershock has a simple logic. A deferral removes the vendor's legal obligation. It does not remove the buyer's exposure. The bank, hospital, insurer or public agency that deploys your workflow still answers to its own supervisor, its insurer, its audit committee and its customers, and none of those parties agreed to wait until December 2027. So the requirement did not disappear. It migrated from public law, where it would have been uniform and predictable, into private contracts, where it is neither.

What the questionnaire now asks

Vendor security reviews used to be about encryption, access control and uptime. By mid-2026, the AI-specific addenda attached to those reviews had grown into a separate document with its own demands. Reading across published procurement guidance and the checklists compliance vendors now sell against, the recurring asks are remarkably consistent:

• A named model inventory. Which models do you call, from which providers, in which regions, and what happens to the data you send them.
• A subprocessor list that includes AI vendors. Not just your hosting and email providers, but every inference API in the path.
• Model change control. What happens when your provider deprecates a model or silently updates it, and how the buyer is notified.
• Human-in-the-loop boundaries. Which actions the automation may take alone and which require a named human approval.
• A kill switch. How the buyer stops the automation immediately without opening a support ticket.
• An evidentiary audit trail. Logs that can reconstruct why a given decision was taken, retained long enough to matter.
• Outcome-based service levels. Commitments on accuracy or resolution, not just on uptime.
• An attestation. SOC 2 Type II, ISO 27001, and increasingly ISO/IEC 42001 by name.

The full document set a serious buyer expects is longer still: a SOC 2 Type II report with a bridge letter, an ISO certificate with its scope statement, a penetration test summary, the subprocessor list, a data flow diagram, a data processing agreement with an AI addendum, a retention matrix and an insurance certificate. None of this is exotic. What is new is that a three-person automation studio is now asked for the same pack as a funded software company, and that the AI-specific half of it did not exist two years ago.

The cost of arriving without it is measurable. Benchmarking circulated through 2026 puts legal review for AI-specific contracts at roughly 14.7 weeks, against about 4.2 weeks for conventional software, with security review alone adding two to six weeks in enterprise deals and two to four weeks in mid-market ones. Vendors with no governance story at all are reported to face delays measured in quarters. These numbers come from compliance vendors rather than independent auditors and deserve a discount, but the direction is not seriously disputed by anyone selling into a regulated buyer this year.

Three attestations, and what each actually proves

Sellers routinely offer the wrong certificate and then wonder why the questionnaire keeps coming back. The three in circulation answer genuinely different questions, and a buyer's risk team knows the difference even when the salesperson does not.

ISO/IEC 42001:2023 is the one doing the work in 2026. It was the first international standard for an AI management system, and it is currently the only broadly recognised certificate that speaks specifically to AI governance. That scarcity is precisely why procurement teams latched onto it: asking for a named certificate is the cheapest way for a large organisation to push accountability down its supply chain, and an accredited certificate answers in one document what would otherwise be a bespoke written response for every deal. Certification runs through a two-stage audit, the certificate is valid for three years, and it is maintained by annual surveillance audits.

The carve-out problem nobody puts in the sales deck

There is a structural gap in the evidence most automation sellers hand over, and sophisticated buyers have started finding it. SOC 2 reports typically treat subservice organisations using the carve-out method, meaning those providers sit explicitly outside the auditor's testing. One 2026 analysis of SOC 2 reports found that 89.6 percent now disclose subservice providers, up from 82 percent the year before. Disclosure is progress. It is also an admission: the provider is named, and then excluded from scope.

For a conventional software vendor that gap is usually a hosting provider with its own well-known audit. For an automation seller it is the model. The component that produces the output your buyer is relying on — the inference API that decides whether an invoice is approved, whether a ticket is escalated, whether a candidate is screened — is frequently the one part of your stack that your own attestation never examined. A buyer who reads the report properly will notice, and will ask you to close the gap yourself.

Automation makes this worse than it is for single-product software, because a workflow is a chain. A realistic flow might receive a webhook from one SaaS tool, enrich the record through a second, call a model hosted in a third region, write to a CRM, and notify a messaging platform. Every hop is a processor, a jurisdiction, a retention policy and a potential point of failure. Your buyer is not really buying a workflow. They are inheriting your supply chain, and the questionnaire is how they find out what is in it. The adjacent problem of where that chain physically sits is covered in automation security and compliance.

What certification costs, and when it is worth buying

Published 2026 guidance from compliance vendors clusters around a consistent range. For a small organisation, the combined Stage 1 and Stage 2 audit fees run roughly 5,000 to 15,000 dollars. The all-in figure for a small company with one or two AI systems in scope lands between about 15,000 and 40,000 dollars once implementation, gap remediation and internal staff time are included, and a widely repeated rule of thumb is that implementation costs two to three times the audit fee on its own. Larger or more complex scopes are quoted far higher. Timelines run four to twelve months from a standing start, or three to four months for an organisation that already holds ISO 27001 and can reuse its management system, risk register and internal audit machinery.

These are vendor-published estimates, not audited market data, and the firms publishing them sell implementation services. Treat them as a planning range and get real quotes. But even at the low end, the decision is a genuine capital allocation question for a small seller, so decide it on pipeline rather than on anxiety:

1. Certify now if a named deal in financial services, healthcare, insurance or public sector procurement is gated on it, and the contract value clears the all-in cost within two years. In those segments the certificate has effectively become a bid requirement.
2. Sequence it if you do not yet hold ISO 27001. Get 27001 first: it is the cheaper, better-understood certificate, it is what most buyers check before anything else, and it cuts the 42001 timeline to a third.
3. Defer it if you sell to SMBs and mid-market buyers who ask about governance but do not name a standard. Spend the same money on the evidence pack below, which you need regardless.

The proportionate evidence pack

The most useful finding from a year of watching these reviews is that specificity beats scale. What fails a security review is not the absence of a logo. It is vagueness: a vendor who cannot say which model processes which field, where the logs live, or what happens when the provider changes the model underneath them. A small seller who answers those questions precisely and in writing routinely clears reviews that a larger vendor with a certificate and evasive answers gets stuck in.

Build eight artefacts once, keep them versioned, and reuse them on every deal. Together they answer the overwhelming majority of what questionnaires actually ask:

• A system description. One page per automation: trigger, steps, every tool and model in the path, and what each one receives.
• A data flow diagram. The same thing visually, with jurisdictions marked. This single artefact deflects more follow-up questions than any other.
• A subprocessor register. Every third party including model providers, with purpose, location and a link to their own attestation.
• A retention and deletion matrix. What is stored, where, for how long, and how a deletion request propagates through the chain.
• An oversight map. Which steps run autonomously, which require human approval, who that human is, and how the kill switch works.
• A model change-control policy. How you detect a provider-side change, how you re-test, and how and when you notify the client.
• An incident and escalation procedure. Detection, containment, client notification timelines and who holds the phone.
• A disclosure statement. Where your automation tells a human it is an AI and how generated content is marked, mapped to Article 50 where relevant.

Two practical notes. First, write these for a risk reviewer, not for a prospect: short, factual, no marketing adjectives, dated and version-numbered. Second, attach them before they are requested. A seller who sends the pack with the proposal is reviewed as a known quantity; a seller who produces documents reluctantly, one at a time, is reviewed as a risk. The work is identical and the outcome is not.

Who pays for the evidence

One closing point that sellers get wrong in both directions. The reusable pack is your cost of doing business and should be amortised into your rates, not invoiced. But buyer-specific compliance work is a deliverable: a completed two-hundred-question questionnaire, a bespoke data protection impact assessment, an architecture review call with the client's risk committee, a negotiated AI addendum, annual re-attestation. That work is real, it is skilled, and it consumes days rather than hours.

Scope it explicitly as a compliance and onboarding line item with a stated number of review cycles included. Sellers who bury it in the build price discover that the regulated deal they fought for is the least profitable one on their books, and then conclude that enterprise buyers are not worth pursuing. The deal was fine. The scoping was not.

Frequently asked questions

Did the EU actually delay its AI rules, or is that a misreading?

It delayed part of them. EU lawmakers reached political agreement on 7 May 2026 to defer the obligations for standalone high-risk systems listed in Annex III from 2 August 2026 to 2 December 2027, and for AI embedded in products already covered by EU product-safety law to 2 August 2028. The stated reason was that the harmonised technical standards vendors were supposed to build against arrived late. The transparency duties in Article 50 were not deferred and have applied since 2 August 2026.

If the deadline moved, why are buyers asking for more evidence rather than less?

Because the delay removed the vendor's legal obligation without removing the buyer's exposure. A bank or hospital that deploys your automation is still accountable to its own regulator, its insurer, its board and its customers. When the statutory floor is postponed, the buyer's risk team writes its own floor into the contract instead. Deferring a regulation moves the requirement from public law into private procurement, where it is less uniform and often stricter.

What is ISO/IEC 42001 and why is it showing up in RFPs by name?

ISO/IEC 42001:2023 is the first international standard for an AI management system, meaning it certifies how you govern AI rather than testing any single model. It is showing up by name because it is currently the only broadly recognised certificate that speaks specifically to AI governance, so it is the cleanest way for a large buyer to push accountability down to its suppliers. Certification follows a two-stage audit, the certificate is valid for three years, and it is maintained through annual surveillance audits.

What does ISO 42001 certification cost a small automation seller?

Published 2026 guidance from compliance vendors puts audit fees for a small organisation at roughly 5,000 to 15,000 dollars for the combined Stage 1 and Stage 2 audits, with an all-in figure of about 15,000 to 40,000 dollars once implementation, gap remediation and internal staff time are counted. A common rule of thumb is that implementation costs two to three times the audit fee. Timelines run four to twelve months from a standing start, or three to four months if you already hold ISO 27001. These are vendor estimates rather than audited market data, so treat them as a planning range and get quotes.

I cannot afford certification. Am I locked out of enterprise deals?

Not yet, and not in most segments. ISO 42001 is hardening into a hard gate mainly in financial services, healthcare and government procurement. Elsewhere a specific, honest evidence pack still clears review: a system description naming every model and subprocessor, a data flow diagram, your retention and deletion rules, your human-in-the-loop boundaries, your logging and audit trail, a model change-control policy, and a penetration test summary. What fails review is vagueness, not the absence of a logo. Certification buys speed and reach, not permission.

Why does my SOC 2 report not answer the AI questions?

Because SOC 2 was not built for this. As of spring 2026 the AICPA had not released a dedicated AI module, so auditors test AI systems against the existing Trust Services Criteria for risk, access and vendor management. The sharper problem is structural: most reports use the carve-out method for subservice organisations, which places your model provider explicitly outside the auditor's testing. A buyer reading carefully will notice that the part of your stack that generates the output was never examined, and will ask you to cover that gap directly.

How much does a weak evidence pack actually cost in sales cycle time?

More than most sellers budget for. Benchmarking circulated in 2026 puts legal review for AI-specific contracts at around 14.7 weeks against roughly 4.2 weeks for conventional software, with security review alone adding two to six weeks in enterprise deals and two to four in mid-market. Vendors arriving with no governance story at all are reported to face delays measured in quarters rather than weeks. Even discounted as directional, the pattern is consistent: the evidence pack is a sales asset with a measurable payback.

Does Article 50 apply to me if I only build internal workflows for clients?

Possibly, and the answer depends on function rather than on whether the tool is public. Article 50 requires disclosure when a person is interacting with an AI system, machine-readable marking of AI-generated images, audio, video and text, and clear labelling of deepfakes and AI-generated text on matters of public interest. An internal helpdesk agent that talks to employees, or a flow that drafts customer-facing copy, can fall inside that scope. Penalties reach 15 million euros or 3 percent of worldwide annual turnover, and a limited grace period ran only to 2 December 2026 for the marking duty on systems already on the market before 2 August 2026.