Last updated: 28 October 2026
Quick answer: ISO 42001 is a voluntary, certifiable management system standard for governing AI across an organisation. The EU AI Act is binding law that regulates specific AI systems and models by risk level, with fines up to 7% of global turnover. ISO 42001 gives you much of the governance machinery the AI Act expects, but certification does not equal legal compliance.
When teams weigh ISO 42001 vs EU AI Act, it is easy to assume the two are interchangeable. They are not. One is a framework you choose to adopt; the other is a regulation that applies whether you are ready or not.
The timing also changed in 2026. The Digital Omnibus on AI, in force since 27 July 2026, moved the main high-risk deadlines to December 2027 and August 2028. This guide compares ISO 42001 and the EU AI Act side by side, maps where they overlap, lists the gaps certification will not close and suggests a practical sequence for doing both.
ISO 42001 vs EU AI Act: what is the difference?
The core difference is legal force and unit of regulation. ISO/IEC 42001:2023, published in December 2023, specifies requirements for an AI management system (AIMS) covering the whole organisation. The EU AI Act, Regulation (EU) 2024/1689, sets legal obligations for particular AI systems and general-purpose AI models depending on their risk and on your role.
| Dimension | ISO/IEC 42001 | EU AI Act |
|---|---|---|
| Nature | Voluntary international standard | Binding EU regulation |
| Focus | Organisation-wide management system | Individual AI systems and GPAI models, as products placed on the EU market |
| Who it covers | Any organisation that develops, provides or uses AI | Providers, deployers, importers, distributors and authorised representatives, with duties varying by role |
| Approach | Risk-based; you set scope, objectives and controls | Risk tiers fixed in law: prohibited, high-risk, transparency, minimal |
| Proof | Third-party certification by an accredited body | Conformity assessment, technical documentation, CE marking and EU database registration for high-risk systems |
| Consequence of failure | Nonconformity, loss of certificate | Fines up to EUR 35 million or 7% of worldwide turnover for prohibited practices |
| Geography | Global | EU market, including non-EU providers whose systems or outputs are used in the EU |
Common mistake: Treating an ISO 42001 certificate as evidence that a high-risk AI system complies with the AI Act. A certificate shows your management system works. It does not replace the conformity assessment and technical documentation each high-risk system needs.
What does the EU AI Act require, and when?
The AI Act applies in stages. After the Digital Omnibus, the key dates are those below, as confirmed on the European Commission’s AI Act page.
| Date | What applies |
|---|---|
| 1 August 2024 | AI Act entered into force |
| 2 February 2025 | Prohibited practices and AI literacy provisions |
| 2 August 2025 | Governance rules and obligations for general-purpose AI models |
| 2 August 2026 | General date of application, including Article 50 transparency obligations |
| 2 December 2027 | High-risk systems in Annex III areas, such as employment, education, biometrics and critical infrastructure |
| 2 August 2028 | High-risk AI in products covered by Annex I safety legislation, such as lifts or toys |
The deferral comes from Regulation (EU) 2026/1744, the Digital Omnibus on AI, adopted on 8 July 2026. It also softened the AI literacy duty so that organisations must take measures to support staff AI literacy rather than guarantee a sufficient level.
Penalties
Under Article 99, fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for most other operator obligations, and EUR 7.5 million or 1% for supplying incorrect information. For SMEs the lower of the two amounts applies.
What does ISO 42001 require?
ISO 42001 follows the same harmonised structure as ISO 27001: clauses 4 to 10 set management system requirements, and Annex A lists reference controls you select through risk treatment and justify in a statement of applicability.
- Context and scope (clause 4): your role in relation to AI, interested parties and the AI systems in scope.
- Leadership (clause 5): AI policy, roles and top management commitment.
- Planning (clause 6): AI risk assessment, AI risk treatment and AI system impact assessment.
- Support and operation (clauses 7 and 8): resources, competence, documentation and operational control of AI processes.
- Performance and improvement (clauses 9 and 10): monitoring, internal audit, management review and corrective action.
Annex A control areas cover AI policies, internal organisation, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party and customer relationships. Our ISO 42001 certification roadmap walks through the certification steps.
Where do ISO 42001 and the EU AI Act overlap?
The overlap is strongest in governance, risk management, data governance, documentation and monitoring. Organisations with a working AIMS usually find that a large part of the organisational groundwork for the AI Act already exists.
| AI Act requirement | ISO 42001 support | Remaining gap |
|---|---|---|
| Article 4 AI literacy | Clause 7.2 competence and 7.3 awareness | Small: tailor to staff operating or using AI systems |
| Article 9 risk management system | Clauses 6.1 and 8, AI risk assessment and treatment | Medium: per-system, life cycle risk management focused on health, safety and fundamental rights |
| Article 10 data and data governance | Annex A data controls | Medium: specific quality criteria for training, validation and testing data, including bias examination |
| Article 11 technical documentation | Clause 7.5 documented information | Large: Annex IV content per high-risk system |
| Article 12 record-keeping | Life cycle and monitoring controls | Medium: automatic logging capability built into the system |
| Article 14 human oversight | Controls on responsible use of AI systems | Medium: oversight measures designed into the system and instructions for use |
| Article 17 quality management system | Clauses 4 to 10 as a whole | Medium: AI Act-specific elements such as post-market monitoring and serious incident reporting |
| Article 27 fundamental rights impact assessment | Clause 6.1.4 AI system impact assessment | Medium: prescribed content, for certain deployers only |
| Articles 43 to 49 conformity assessment, CE marking, registration | None directly | Large: product-level legal steps |
In practice: Run one AI inventory that feeds both regimes. For each system, record your AI Act role and risk category next to the ISO 42001 scope, risks and controls. That single register is what lets you reuse evidence rather than duplicate it.
If you want to see that inventory and control mapping working across ISO 42001, the AI Act and your existing ISO 27001 controls, you can start your 14-day free trial of Enactia’s AI-powered GRC platform.
What gaps will ISO 42001 certification not close?
Certification will not cover the product-level legal obligations that attach to each high-risk AI system, nor role-specific duties such as those of deployers and GPAI model providers.
- Risk classification. Deciding whether a system is prohibited, high-risk under Annex I or III, subject to transparency duties or minimal risk is a legal analysis that ISO 42001 does not perform for you.
- Annex IV technical documentation. The AI Act prescribes content that goes well beyond a management system’s documented information.
- Conformity assessment and CE marking. High-risk systems need a conformity assessment, an EU declaration of conformity and, where applicable, registration in the EU database.
- Post-market monitoring and serious incident reporting. Articles 72 and 73 set specific obligations and timelines.
- Transparency duties. Article 50 obligations, such as telling people they are interacting with an AI system, apply per system.
- GPAI model obligations. Documentation, copyright policy and training content summaries for general-purpose AI model providers sit outside ISO 42001.
Will ISO 42001 give a presumption of conformity?
No, not on its own. Under Article 40 of the AI Act, a presumption of conformity comes from harmonised European standards whose references are published in the Official Journal. ISO 42001 is an international management system standard and has not been cited for that purpose.
The European standard designed for the AI Act quality management system is EN 18286. CEN and CENELEC describe it as the first harmonised European standard for AI Act regulatory purposes, covering a quality management system for providers of AI systems. At the time of writing, its reference had not yet been published in the Official Journal, so check the Commission’s list before relying on it. EN 18286 is designed to sit alongside ISO 42001 rather than replace it, so an existing AIMS remains a sound foundation.
Which should you do first?
Most organisations should start with the AI Act obligations that already apply, while using ISO 42001 as the operating model to meet them. The right order depends on your role and risk profile.
| Your situation | Suggested priority |
|---|---|
| Provider of Annex III high-risk AI systems for the EU | AI Act classification and conformity programme first, built on an ISO 42001-style management system; certify when the AIMS is mature |
| Deployer using third-party AI in HR, credit or similar areas | AI inventory, AI literacy, deployer duties and supplier assurance; ISO 42001 useful but not urgent |
| AI vendor selling globally, mostly low-risk use cases | ISO 42001 certification for customer assurance, plus Article 50 transparency checks |
| Organisation already certified to ISO 27001 | Extend the ISMS into an integrated AIMS and map both to the AI Act |
A five-step integrated approach
- Build an AI system inventory with AI Act role and risk category for each system.
- Close obligations already in force: prohibited practices, AI literacy measures, GPAI duties where relevant and Article 50 transparency.
- Stand up the ISO 42001 management system: policy, roles, AI risk and impact assessment, and policy management.
- For each high-risk system, add Annex IV documentation, logging, human oversight design and a conformity assessment plan targeting December 2027 or August 2028.
- Integrate AI risks into your enterprise risk register and review them through management review.
Where the AI Act meets other EU rules, such as GDPR impact assessments or DORA ICT risk, our article on DORA, NIS2 and EU AI Act overlap shows how to avoid parallel programmes. Cross-mapping through the Compliance Universe and the ISO 42001 framework page can help you reuse controls across all of them.
Key takeaways
- ISO 42001 is a voluntary, organisation-wide management system; the EU AI Act is binding, system-level law.
- The Digital Omnibus moved Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028; Article 50 transparency applies from 2 August 2026.
- ISO 42001 covers much of the governance, risk, data and competence groundwork the AI Act expects.
- Certification does not replace classification, Annex IV documentation, conformity assessment or post-market duties.
- Presumption of conformity comes from harmonised standards cited in the Official Journal, such as EN 18286 once cited, not from ISO 42001 alone.
Frequently asked questions
Does ISO 42001 certification make you compliant with the EU AI Act?
No. ISO 42001 certification shows that your AI management system meets the standard, which supports many AI Act obligations such as risk management, competence and documentation. It does not classify your systems, produce Annex IV technical documentation, complete conformity assessments or meet transparency and post-market duties. Treat it as a foundation for AI Act compliance, not a substitute.
Is ISO 42001 mandatory under the EU AI Act?
No. The AI Act does not require any organisation to adopt or certify to ISO 42001. Providers of high-risk AI systems must have a quality management system under Article 17, and ISO 42001 is one practical way to build it. Harmonised European standards, rather than ISO 42001 itself, are what give a legal presumption of conformity.
When do the high-risk AI Act obligations apply now?
After the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, obligations for high-risk systems in Annex III areas apply from 2 December 2027. High-risk AI embedded in products covered by Annex I safety legislation follows from 2 August 2028. Prohibitions, GPAI duties and Article 50 transparency already apply.
What is EN 18286 and how does it relate to ISO 42001?
EN 18286 is a European standard from CEN and CENELEC for a quality management system for providers of AI systems, written for AI Act regulatory purposes. It is designed to complement ISO 42001, so organisations with an existing AI management system can extend it. Once its reference is published in the Official Journal, it can support a presumption of conformity.
Should a company outside the EU care about the AI Act?
Yes, if it places AI systems on the EU market or if the output of its AI systems is used in the EU. The AI Act has extraterritorial reach similar to GDPR. Non-EU companies often pursue ISO 42001 for global customer assurance and then add AI Act-specific steps for systems that reach the EU.
Conclusion: use the standard to meet the law
The ISO 42001 vs EU AI Act question is not either-or. The AI Act tells you what outcomes the law requires for each AI system; ISO 42001 gives you a repeatable way to govern AI across the organisation so those outcomes can be delivered and evidenced. With the high-risk deadlines now set for December 2027 and August 2028, the time between now and then is best spent building one inventory, one management system and one control set that serves both.
If you would like help mapping ISO 42001 and the EU AI Act to a single control set, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
