Operationalization has moved from high-level principles toward a mix of binding obligations and implementation infrastructure: EU AI Act obligations and timelines; the voluntary but Commission/AI Board-endorsed GPAI Code; NIST AI RMF and GenAI Profile resources; NIST critical-infrastructure profile and consortium work; the OECD Hiroshima AI Process reporting framework; and CEN/CENELEC harmonised-standard development. But the core technical problem is not solved. Many AI Act standards are still in development. The Commission’s 2026 AI Act implementation page states that, following the political agreement on simplification, high-risk AI rules would apply on 2 December 2027 for Annex III systems and 2 August 2028 for product-integrated systems, so companies have support tools such as standards available. Across the source paper, AI Act materials, OECD reporting, and NIST resources, risk operationalization still uses multiple context-dependent proxies and structures—such as compute or capability thresholds, widespread use, risk categories, evaluations, and reporting fields—rather than a single validated universal risk indicator. Objective conformity testing remains uneven: the source paper highlights unresolved fairness metrics and lack of technical specificity in standards, while NIST’s GenAI Profile describes immature AI measurement and safety science and identifies difficult-to-scope risks including CBRN, bias, information security, and environmental impacts. I did not verify a finalized 2026 ISO AI management-system update beyond public EU references to ISO/IEC SC 42 work, so ISO claims are limited to publicly accessible references.