Skip to content
Why now • Policy pull + procurement timing

# Evidence expectations land before “full enforcement.”

Procurement is shifting from narratives to replayable proof. The window is open — and buyers want artifacts they can score: receipts, acceptance tests, and fail‑closed behavior.

Procurement kit Contact security

Not legal advice. Non‑exhaustive anchors for planning and vendor questionnaires.

## Timeline anchors

Dates that drive evidence expectations (often before full applicability).

China (CAC) 01 Mar 2022 Already in force

### Algorithmic recommendation rules apply

Algorithm transparency, governance, and filing/oversight expectations become enforceable for covered services.

Singapore 25 May 2022 Already in force

### AI Verify launches (international pilot)

AI assurance artifacts become normalized: “show me the test report” starts appearing in reviews.

US (NIST)26 Jan 2023 Assurance update

### AI Risk Management Framework (AI RMF 1.0) released

Assurance artifacts normalize fast: buyers start expecting risk decisions, tests, and governance records.

China (CAC) 15 Aug 2023 Already in force

### Generative AI service measures apply

Public-facing GenAI services operate under binding administrative requirements and oversight.

US Federal (EO)30 Oct 2023 Government policy

### Executive Order sets federal AI governance direction

Federal guidance accelerates into procurement language: written governance, measurable controls, audit‑ready documentation.

Japan (METI) 19 Apr 2024 Government policy

### AI Guidelines for Business (Ver 1.0) compiled

Soft-law governance becomes operational guidance; buyers start referencing documented processes and evidence.

Australia 01 Sep 2024 Government policy

### AI in government policy (v1.1) effective

Public sector adoption shifts toward mandatory governance expectations and use‑case accountability.

EU DORA 17 Jan 2025 Legal enforcement

### Digital operational resilience applies

ICT risk evidence and third‑party assurance become scoreable at scale.

EU AI Act 02 Feb 2025 Legal enforcement

### Phase 1: prohibited practices + AI literacy

Evidence expectations begin early — buyers ask for reproducible artifacts and non‑bypassable controls.

Singapore 11 Feb 2025 Assurance update

### Global AI Assurance Pilot launches

Technical testing norms for GenAI begin to codify; “assurance artifacts” become procurement‑friendly.

Japan (METI) 28 Mar 2025 Government policy

### AI Guidelines for Business (v1.1) published

Guidance updates reinforce operational governance expectations and documentation.

US Federal (OMB) 03 Apr 2025 Government policy

### AI use + acquisition policy lands (M‑25‑21 / M‑25‑22)

Federal use and procurement shifts toward written governance, measurable practices, and audit‑ready documentation.

Singapore 29 May 2025 Assurance update

### AI Verify testing framework updated for GenAI

Assurance reports and crosswalks align testing with international risk frameworks.

EU AI Act 02 Aug 2025 Legal enforcement

### Phase 2: GPAI governance obligations begin

Governance moves from policy to operational evidence: pinned policies, technical documentation, and reviewable records.

Australia 15 Dec 2025 Government policy

### AI in government policy (v2.0) effective

Government adoption requires designated accountability, risk‑based actions, and use‑case governance.

Korea 22 Jan 2026 Legal enforcement

### AI Basic Act takes effect

Accountability expectations become operational; traceable governance and reviewable records move toward baseline.

EU AI Act 02 Aug 2026 Legal enforcement

### Phase 3: general applicability

Procurement shifts to “show me the receipts” — artifacts must survive third‑party replay and audit.

EU CRA 11 Sep 2026 Legal enforcement

### Reporting obligations start

Actively exploited vulnerabilities and severe incidents trigger reporting; evidence workflows must be ready.

EU AI Act 02 Aug 2027 Legal enforcement

### Phase 4: regulated‑product high‑risk systems catch up

High‑risk AI in regulated products hits extended transition; evidence must propagate across supply chains.

EU CRA 11 Dec 2027 Legal enforcement

### Main obligations apply

Secure‑lifecycle evidence becomes mandatory at scale; procurement expects continuous proof.

### Procurement reality

As deadlines approach, buyers stop accepting “trust us” controls. They ask for receipts: replayable artifacts, stable reason codes, and fail‑closed enforcement at control points.

Procurement kit →

## Sources (minimal)

Public links used for anchor dates above.

- China algorithmic recommendation provisions effective 1 Mar 2022 (DigiChina)
- China GenAI interim measures effective 15 Aug 2023 (Law Library of Congress)
- Singapore AI Verify key dates (AI Verify Foundation)
- Singapore Global AI Assurance Pilot (AI Verify Foundation news)
- Japan AI Guidelines for Business Ver1.0 compiled (METI)
- Australia AI in government policy effective dates (digital.gov.au)
- NIST AI Risk Management Framework (AI RMF)
- US Executive Order on AI (White House)