EU AI Act vs ISO/IEC 42001: Does Certification Help You Comply

Many organisations assume that an ISO/IEC 42001 certificate will carry them through the EU AI Act, but one is a law with product obligations and penalties and the other is a voluntary management system standard. Regulation (EU) 2024/1689, the EU AI Act, sets legal duties that depend on your role (provider, deployer, importer, distributor) and on the risk category of each AI system. ISO/IEC 42001:2023 specifies requirements for an AI management system (AIMS) that any organisation can implement and have certified. This guide compares the two side by side, shows where 42001 gives you a head start, where it leaves gaps, and how to run them as one programme. It is written for AI governance, compliance and security leads. Legal status was checked on 13 November 2026 against the European Commission's AI Act Service Desk and EUR-Lex.

Key takeaways

• Short answer: certification helps, it does not comply for you. ISO/IEC 42001 builds the governance machinery (policy, roles, risk and impact assessment, lifecycle controls, internal audit) that AI Act compliance needs, but it gives no presumption of conformity and does not replace the Act's product requirements.
• The law is about systems, the standard is about the organisation. The AI Act asks whether each AI system meets Articles 9 to 15 and whether each operator meets its role duties; ISO/IEC 42001 asks whether your management system is designed, run and improved properly.
• Presumption of conformity comes only from harmonised standards. Under Article 40, only standards cited in the Official Journal create a presumption. The first, EN 18286:2026 on quality management, was cited by Commission Implementing Decision (EU) 2026/2274; ISO/IEC 42001 is not cited.
• Dates have moved. Following the Digital Omnibus on AI (Regulation (EU) 2026/1744), high-risk duties apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product systems; prohibitions, AI literacy and general-purpose AI rules already apply.
• Use 42001 as the operating system, the Act as the requirements list. Map each Article 17 quality management element and each role duty to an AIMS process, then close the gaps the standard does not cover: conformity assessment, CE marking, registration, serious incident reporting and transparency notices.

What each one is

The EU AI Act is a regulation that applies directly in every Member State. It entered into force on 1 August 2024 and applies in stages under Article 113. It bans certain practices (Article 5), sets requirements for high-risk AI systems (Chapter III), transparency duties for certain systems such as chatbots and generative content (Article 50), and obligations for providers of general-purpose AI models (Chapter V). Enforcement sits with national market surveillance authorities and, for general-purpose AI models, the Commission's AI Office. Fines under Article 99 reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most other operator obligations, whichever is higher (for SMEs, whichever is lower). For the full obligations, see the EU AI Act Compliance Guide.

ISO/IEC 42001:2023, published on 18 December 2023 (edition 1), specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. It applies to any organisation that provides or uses AI-based products or services, whatever its size. It follows the harmonised management system structure shared with ISO/IEC 27001: clauses 4 (Context of the organization) to 10 (Improvement), with AI system impact assessment in clauses 6.1.4 and 8.4. Annex A lists reference control objectives and controls, Annex B gives implementation guidance, and Annexes C and D are informative. Certification is carried out by third-party certification bodies against clauses 4 to 10 and the controls the organisation selects in its Statement of Applicability. For the standard itself, see the ISO/IEC 42001 Guide.

Side-by-side comparison

Where ISO/IEC 42001 helps with the AI Act

The overlap is real, but it is mostly at the level of process. The table maps AI Act duties to the parts of ISO/IEC 42001 that give you a running process for them, and states what the Act still requires on top.

For the risk management method that sits under both, see the ISO/IEC 23894 AI Risk Management Guide and the EU AI Act Article 9 Risk Management System Guide.

Where certification does not help

• Classification: 42001 never tells you whether a system is prohibited, high-risk or general-purpose AI. That is a legal analysis against Article 5, Article 6 and Annexes I and III. See the EU AI Act High-Risk AI Systems Guide.
• Conformity assessment and market access: a 42001 certificate is not an Article 43 conformity assessment, a declaration of conformity or a CE marking. See the EU AI Act Conformity Assessment and Harmonised Standards Guide.
• Presumption of conformity: Article 40 grants it only for harmonised standards published in the Official Journal. Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 cites EN 18286:2026, "Artificial intelligence: Quality management system for EU AI Act regulatory purposes", for quality management. It does not cite ISO/IEC 42001. If you are a provider of high-risk systems, EN 18286 is the standard to build your Article 17 QMS against; an existing 42001 AIMS is a sensible base for it.
• Transparency to people: Article 50 duties (telling people they are dealing with an AI system, marking synthetic content) are specific legal outcomes, not management system controls.
• Scope choices: a 42001 certificate covers the scope the organisation declares. A narrow scope can leave out the very systems that are high-risk under the Act. Read the certificate scope before relying on a supplier's certificate.
• General-purpose AI model duties: Chapter V obligations such as technical documentation for downstream providers and a copyright policy are not covered by the AIMS clauses.

When to lead with which

Small vs large organisations: Article 17(2) lets providers scale the QMS to their size, especially SMEs and start-ups, and Article 99(6) caps SME fines at the lower of the amount or the percentage. A small provider can reasonably skip certification and build a lean QMS to the Act and EN 18286. A large group with many AI products usually gets more value from a single certified AIMS that each product team plugs into.

How they work together: a phased approach

1. Inventory and role: build an AI register that records every system, model, supplier and use, and your role for each. Use the AI Register and AI Inventory Template.
2. Classify under the Act: mark each system prohibited, high-risk (with the Annex), Article 50, general-purpose AI or minimal, and record the legal reasoning.
3. Set the AIMS scope to cover the high-risk set: if you pursue 42001, make sure the scope includes every system classified high-risk, not only the easy ones.
4. Build one requirements matrix: rows are Act articles and Article 17(1) elements; columns are the AIMS clause, the Annex A control, the owner and the evidence. Gaps are the rows with no AIMS process.
5. Close Act-only gaps: conformity assessment route, technical documentation to Annex IV, logging built into products, post-market monitoring, serious incident reporting, registration and Article 50 notices.
6. Test before audit: run an internal audit (clause 9.2) against the matrix, sample two or three high-risk systems end to end, and fix nonconformities before the certification audit or the conformity assessment.
7. Keep the dates under review: track the EU AI Act Implementation Timeline Tracker and newly cited harmonised standards; re-map the matrix when a standard is cited.

Rollback and change: if a system's classification changes (for example a repurposed chatbot now used for hiring decisions), Article 25 can make you its provider. Treat reclassification as an AIMS change (clause 6.3) that triggers a new impact assessment and a check against the high-risk requirements.

Where identity fits

Both regimes ask for controlled access to AI systems, their data and their logs. Article 15 cybersecurity and the Article 12 logs depend on knowing which identities, human and non-human, can change a model, its training data or its configuration. AI agents and pipelines run under service accounts, API keys and tokens that rarely appear in AI governance registers. Record the machine identities behind each high-risk system in the AI register and govern them like other privileged credentials. See the EU AI Act for AI Agents.

Detection and measurement

• Coverage: percentage of AI systems in the register with an Act classification and a named owner (target 100%).
• Scope fit: percentage of high-risk systems inside the AIMS scope.
• Matrix closure: open gaps in the requirements matrix, by article, trending down each quarter.
• Evidence age: high-risk systems whose technical documentation or risk assessment is older than the last substantial change.
• Incident readiness: time from detection of a potential serious incident to the decision whether Article 73 reporting applies, tested in exercises.
• Audit findings: major and minor nonconformities from internal audits and certification audits, and time to close them.

Common failure patterns

• Treating the certificate as compliance: leadership reports "AI Act ready" on the strength of a 42001 certificate while no system has been classified or assessed.
• Narrow certification scope: the AIMS covers an internal chatbot, while the CV screening tool, which is high-risk under Annex III, sits outside it.
• Relying on a supplier's certificate: a deployer accepts a vendor's 42001 certificate in place of checking the instructions for use, CE marking and registration that the Act requires of the provider.
• Working to old dates: plans still built on the original 2 August 2026 high-risk deadline, or the opposite mistake of pausing work because the dates moved.
• Policy without engineering: documented controls for logging, oversight and robustness with no logging, override or adversarial testing in the product itself.

Framework mapping

Practitioner checklist

• Record every AI system and model in one register with your Act role for each.
• Classify each system under Article 5, Article 6 with Annexes I and III, Article 50 and Chapter V, with written reasoning.
• Check the current application dates in Article 113 before setting deadlines.
• If you certify to ISO/IEC 42001, put every high-risk system inside the AIMS scope.
• Build an article-by-article requirements matrix linking Act duties to AIMS clauses, controls, owners and evidence.
• Providers of high-risk systems: build the Article 17 QMS against EN 18286:2026 and use the AIMS as its base.
• Add Act-only processes: conformity assessment, Annex IV documentation, registration, post-market monitoring, serious incident reporting.
• Read the scope of any supplier's 42001 certificate and still collect the Act's provider evidence.
• Record the service accounts and API credentials behind each high-risk system and review their access.

Standards and references

• EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act)
• EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI)
• EUR-Lex: Commission Implementing Decision (EU) 2026/2274 on harmonised standards for high-risk AI systems
• European Commission AI Act Service Desk: Article 113 Entry into force and application
• European Commission AI Act Service Desk: Article 17 Quality management system
• European Commission AI Act Service Desk: Article 40 Harmonised standards
• European Commission: Standardisation of the AI Act
• IEC Webstore: ISO/IEC 42001:2023 Artificial intelligence management system

Status checked on 13 November 2026 against the European Commission AI Act Service Desk (Article 113, as amended by the Digital Omnibus on AI) and EUR-Lex. This guide summarises the EU AI Act and ISO/IEC 42001 and is not legal advice. Related NHI Mgmt Group resources: EU AI Act Compliance Guide · ISO/IEC 42001 Guide · ISO 42001 Readiness Checklist · EU AI Act Provider vs Deployer Obligations Guide · AI Governance Guide