ISO 42001 vs EU AI Act: How the Standard and the Law Fit Together
Group COO & CISO
Operational excellence, governance, and information security. Aligns technology, risk, and business outcomes in complex IT environments
ISO 42001 and the EU AI Act fit together as a management system and a law. ISO/IEC 42001 is a voluntary, certifiable standard for governing AI across an organisation. The AI Act, Regulation (EU) 2024/1689, is binding law with obligations by role and risk tier. Certification does not prove AI Act compliance, but builds much of what compliance needs.
Key takeaways
- ISO 42001 asks "is your AI governed well?"; the AI Act asks "does this AI system, in this role, meet these legal requirements?". Both questions matter.
- Certification against ISO 42001 does not give a legal presumption of conformity with the AI Act. That presumption comes only from harmonised standards cited in the Official Journal under Article 40.
- As of October 2026 the harmonised standards requested from CEN-CENELEC are still in development; the quality management standard prEN 18286 was the first to reach public enquiry.
- ISO 42001 maps well to AI Act governance duties such as risk management, AI literacy, oversight and supplier control, and poorly to product-specific duties such as technical documentation, CE marking and registration.
- A combined roadmap avoids building two parallel programmes.
The two side by side
| Dimension | ISO/IEC 42001:2023 | EU AI Act (Reg. 2024/1689) |
|---|---|---|
| Nature | Voluntary international standard | Binding EU regulation, directly applicable in all Member States |
| Scope | An organisation's AI management system, for any AI it develops, provides or uses | Specific AI systems and general-purpose AI models placed on the EU market, put into service or whose output is used in the EU |
| Unit of assessment | The organisation (within a defined scope) | The AI system or model, and each operator's role |
| Who | Any organisation, worldwide | Providers, deployers, importers, distributors, product manufacturers, authorised representatives |
| Risk approach | You define risk criteria and appetite; impact assessment on individuals and society | Fixed tiers set by law: prohibited, high-risk, transparency, minimal |
| Proof | Third-party certification by a certification body | Conformity assessment for high-risk systems (internal control or notified body), EU declaration of conformity, CE marking, EU database registration |
| Outputs | AI policy, risk and impact assessments, statement of applicability, audit records, certificate | Technical documentation, instructions for use, logs, QMS, post-market monitoring, incident reports, transparency notices |
| Consequence of failure | Nonconformity, possible loss of certificate | Fines up to €35 million or 7% of worldwide turnover for prohibited practices, up to €15 million or 3% for most other breaches |
For a refresher on the law itself, see our EU AI Act guide. For the standard, read what ISO 42001 is and how certification works.
Need expert help with iso 42001 vs eu ai act?
Our cloud architects can help you with iso 42001 vs eu ai act — from strategy to implementation. Book a free 30-minute advisory call with no obligation.
Does ISO 42001 certification mean AI Act compliance?
No. There are three reasons.
- Different object. ISO 42001 certifies a management system. The AI Act regulates products and uses. An organisation can have an excellent AIMS and still place a high-risk system on the market without the required technical documentation or conformity assessment.
- No presumption of conformity. Under Article 40, high-risk systems and GPAI models that conform to harmonised standards whose references are published in the Official Journal are presumed to meet the requirements those standards cover. ISO/IEC 42001 is not such a harmonised standard.
- Specific legal duties are outside its scope. Registration in the EU database, CE marking, Article 50 disclosures, serious-incident reporting to authorities and the prohibitions in Article 5 are legal acts or bans, not management practices.
That said, a certified AIMS is strong evidence of good governance. It helps with AI Act duties that are process-shaped, such as risk management, data governance, human oversight, AI literacy and supplier control, and it gives auditors and authorities a structured record. To see which of those processes you already have, take the free EU AI Act readiness assessment; it scores ten governance areas and writes your AI Governance Framework and AI Risk Assessment Template.
Where harmonised standards stand (October 2026)
The Commission asked CEN and CENELEC to develop European standards supporting the AI Act's high-risk requirements: risk management, data governance and quality, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. The work sits with the joint technical committee CEN-CENELEC JTC 21. According to the Commission's AI Act standardisation page, prEN 18286, the quality management system standard for AI Act regulatory purposes, entered public enquiry on 30 October 2025 as the first of the set. Other drafts cover risk management, cybersecurity and dataset quality.
The process has two steps after a standard is adopted: CEN-CENELEC publishes it, then the Commission assesses it and cites its reference in the Official Journal. Only the citation triggers the presumption of conformity. Check the Commission page and the Official Journal for the current position before relying on any standard. The extra time from the Digital Omnibus, which moved Annex III high-risk obligations to 2 December 2027 and Annex I product-embedded systems to 2 August 2028, partly reflects the slow arrival of these standards.
Under the "international first" principle, European standardisers reuse international work where it fits EU requirements. Several JTC 21 deliverables draw on SC 42 standards, so ISO 42001 practices are likely to remain relevant. Treat ISO 42001 as a sound base, not a substitute for the harmonised standards.
Mapping AI Act requirements to ISO 42001 (indicative)
The table below is an indicative mapping to help planning. It is not an official correspondence table, coverage is partial in most rows, and you should validate it against the full text of both documents. "Annex A" refers to the ISO 42001 control objectives A.2 to A.10.
| AI Act requirement | Who | Closest ISO 42001 element | Coverage |
|---|---|---|---|
| Art. 4 AI literacy (as amended: take measures to promote it) | Providers and deployers | Clause 7.2 competence, 7.3 awareness; A.4 resources (human resources) | Good |
| Art. 5 prohibited practices | All operators | Clause 6.1 risk assessment; A.2 AI policy; A.5 impact assessment | Partial; screening against the legal list must be explicit |
| Art. 9 risk management system | High-risk providers | Clauses 6.1.2, 6.1.3, 8.2, 8.3; A.6 life cycle | Good on process; AI Act adds testing and foreseeable-misuse specifics |
| Art. 10 data and data governance | High-risk providers | A.7 data for AI systems | Partial; Act sets specific quality and bias criteria |
| Art. 11 and Annex IV technical documentation | High-risk providers | Clause 7.5 documented information; A.6 life cycle documentation | Weak; Annex IV content is prescribed |
| Art. 12 record keeping (logging) | High-risk providers | A.6 life cycle (event logs) | Partial |
| Art. 13 transparency and instructions for use | High-risk providers | A.8 information for interested parties | Partial; content is prescribed |
| Art. 14 human oversight | High-risk providers (design), deployers (Art. 26) | A.9 use of AI systems; A.6 life cycle | Partial |
| Art. 15 accuracy, robustness, cybersecurity | High-risk providers | A.6 verification and validation; ISO 27001 controls | Partial |
| Art. 17 quality management system | High-risk providers | Clauses 4–10 as a whole | Good structurally; prEN 18286 targets this article specifically |
| Art. 26 deployer obligations | Deployers of high-risk | A.9 use of AI systems; A.10 third-party relationships; clause 9.1 monitoring | Good on process |
| Art. 27 fundamental rights impact assessment | Certain deployers | Clause 6.1.4 AI system impact assessment; A.5 | Good foundation; FRIA content and notification are prescribed |
| Arts. 43, 47–49 conformity assessment, declaration, CE marking, registration | High-risk providers | None | Not covered |
| Art. 50 transparency for chatbots, deepfakes, generated content | Providers and deployers | A.8 information for interested parties | Partial; legal duties are specific |
| Art. 72 post-market monitoring; Art. 73 serious incidents | High-risk providers | Clause 9.1 monitoring; clause 10 improvement; A.8 incident communication | Partial; reporting deadlines to authorities are legal |
| Arts. 53–55 GPAI model obligations | GPAI providers | A.6, A.7, A.8 in part | Weak; copyright policy, training-data summary and systemic-risk duties are specific |
The pattern is clear: ISO 42001 is strongest where the AI Act asks for processes, and weakest where the Act prescribes documents, legal acts or reporting to authorities. For the high-risk requirements in more depth, see high-risk AI systems under the AI Act. The literacy duty is often the easiest win for an ISO-minded organisation; AI literacy under Article 4 explains how the amended text frames it.
A roadmap for doing both
Most organisations should not choose between them. Build one programme with two outputs. A sensible sequence:
- Inventory and classify. List every AI system and use case, your role for each, and the AI Act tier. This drives everything else and is required by neither framework in exactly this form, yet both depend on it.
- Gap analysis against both. Assess current practice against AI Act obligations for your roles and against ISO 42001 clauses 4–10 and Annex A. An EU AI Act gap analysis can include the ISO columns from day one.
- Governance core. AI policy, roles, acceptable use rules, a risk and impact assessment method, and supplier due diligence. These satisfy ISO 42001 clauses 5 and 6 and give you the backbone for Articles 4, 9, 26 and 27.
- Legal must-haves first. Anything already in force takes priority over certification: Article 5 prohibitions (since 2 February 2025, with new bans from 2 December 2026), Article 4 literacy measures, Article 50 transparency (from 2 August 2026) and GPAI obligations if you are a model provider.
- High-risk workstream. If you provide or deploy Annex III systems, plan for 2 December 2027: technical documentation, logging, oversight, conformity assessment and registration for providers; oversight, monitoring, log retention and FRIA where required for deployers.
- Operate and evidence. Run internal audits and management reviews that cover both the AIMS and AI Act controls. Keep one evidence repository.
- Certify if it pays. Pursue ISO 42001 certification when customers ask for it or when an external audit will help discipline. Watch for harmonised standards being cited and align with them as they arrive.
Which comes first?
If you are in scope of AI Act obligations that already apply, start there; legal deadlines do not wait for certification. If you are a vendor whose enterprise customers demand certification, run ISO 42001 as the frame and build AI Act controls inside it. If you are mainly a deployer of third-party AI with no high-risk use, implement the core governance practices and decide on certification later. In every case, the work overlaps substantially, so design it once.
Frequently asked questions
Is ISO 42001 required by the EU AI Act?
No. The AI Act does not require any ISO certification. It sets its own legal obligations and allows a presumption of conformity for high-risk systems that follow harmonised European standards cited in the Official Journal. ISO/IEC 42001 is voluntary, although it supports many of the processes the Act expects.
Will ISO 42001 become a harmonised standard under the AI Act?
Not as it stands. The Commission has asked CEN-CENELEC to develop European standards tailored to the AI Act's requirements, and those are being drafted in JTC 21. Some reuse international SC 42 work, but the AI Act quality management standard is a separate document, prEN 18286. Check the Commission's standardisation page for the latest status.
What is the difference between ISO 42001 certification and AI Act conformity assessment?
Certification is a voluntary audit of your organisation's AI management system by a certification body. Conformity assessment is a legal procedure for a specific high-risk AI system before it is placed on the market, done by internal control or by a notified body, and followed by an EU declaration of conformity, CE marking and registration.
Should a deployer pursue ISO 42001?
It can, because ISO 42001 applies to organisations that use AI, not only developers. For deployers, the most valuable parts are the AI policy, risk and impact assessment, supplier controls and monitoring. Whether formal certification is worth the audit cost depends on customer demand and the scale of your AI use.
Does ISO 42001 cover general-purpose AI obligations?
Only partly. GPAI providers have specific duties under Articles 53 to 55, such as technical documentation for the AI Office and downstream providers, a copyright policy and a public summary of training content, plus extra duties for models with systemic risk. An AIMS helps manage them but does not replace them.
Build the governance base for both
Whether you head for certification, AI Act compliance or both, the first deliverables are the same. Opsio's free AI governance and EU AI Act readiness assessment takes about 40 minutes over 14 steps, scores your maturity across ten governance areas and, when you submit, writes four editable Word documents from your answers: AI Governance Framework, AI Acceptable Use Policy, AI Vendor Due Diligence Checklist and AI Risk Assessment Template. Free, no card, no obligation. For support with the wider programme, see AI security and compliance.
This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (EUR-Lex). Standards status is as of October 2026.
About the Author
Group COO & CISO
Fredrik is the Group Chief Operating Officer and Chief Information Security Officer at Opsio. He focuses on operational excellence, governance, and information security, working closely with delivery and leadership teams to align technology, risk, and business outcomes in complex IT environments. He leads Opsio's security practice including SOC services, penetration testing, and compliance frameworks.
Editorial standards: This article was written by a certified practitioner and reviewed by our engineering team. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.