The EU AI Act and ISO 42001 are often mentioned in the same breath, as if one replaces the other. They do not. The AI Act is a regulation with obligations that depend on your role and on the risk category of the system. ISO 42001 is a certifiable management system standard and obliges nobody to do anything. They share a subject, which creates real overlap. But there are also places where a certificate gets you nothing.
What already applies and what has moved
The obligations arrive in stages. The prohibition of certain AI practices and the duty to ensure AI literacy (Article 4) have applied since 2 February 2025. The rules for general-purpose AI models and the governance structure followed on 2 August 2025. The transparency obligations of Article 50 apply from 2 August 2026. For high-risk AI the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) has moved the dates: 2 December 2027 for the stand-alone systems in Annex III and 2 August 2028 for AI built into products under Annex I. The details are in the article on the Digital Omnibus deadlines. What matters here is that the delay only touches the high-risk requirements. Taking inventory, classifying and building awareness do not have to wait.
What ISO 42001 is and is not
ISO/IEC 42001:2023 describes an AI management system (AIMS). The standard follows the familiar ISO structure with clauses 4 to 10 and has an Annex A with 38 controls, grouped into nine areas. You record which controls apply to you in the Statement of Applicability. An accredited certification body tests whether your management system meets the standard and works in practice. That says something about your organisation and the scope of the system. It says nothing about whether one specific AI system complies with the regulation. ISO 42001 also has no legal status: it has not been designated as a harmonised standard under the AI Act.
Where they overlap
The overlap is mostly in the foundations. Both start from an inventory of your AI systems and a defined role for each system. Both ask for risk management: the AI Act for high-risk systems in Article 9, ISO 42001 through the AI risk assessment in clause 6.1.2 and the impact assessment in clause 6.1.4 and Annex A.5. The data governance of Article 10 maps roughly to Annex A.7. The documentation and logging of Articles 11 and 12 belong with the life cycle controls of A.6. The information to deployers in Article 13 returns in A.8, and the oversight of Article 14 touches the design controls of A.6 and the use rules of A.9. Annex A.10 on third parties lines up with the split of responsibilities between provider, importer and deployer.
Article 17 adds to this: providers of high-risk AI must have a quality management system. A well-built AIMS supplies much of that structure, with policy, roles, procedures, internal audit, management review and corrective action. Note that this is a mapping of substance and not a one-to-one replacement. A requirement in Article 10 on the representativeness and bias examination of datasets is more detailed than the corresponding control in ISO 42001.
Where a certificate is not enough
For high-risk systems the regulation asks for things a management system cannot handle for you. You complete a conformity assessment (with a notified body for some categories), draw up an EU declaration of conformity, affix the CE marking, register the system in the EU database and keep technical documentation that meets Annex IV. Providers of general-purpose AI models have their own duties on documentation, copyright and a summary of training data; these are covered in the article on GPAI. The transparency rules of Article 50 carry concrete disclosure and marking duties, for example for chatbots and synthetic content, that ISO 42001 does not spell out in that way. An auditor testing an AIMS looks at how the system works. A regulator looks at the product and at your role in it.
The European standard for the quality management system
CEN and CENELEC are developing their own standards for the AI Act to close that gap. The first, EN 18286 (Artificial Intelligence: Quality Management System for EU AI Act Regulatory Purposes), was approved in 2026 and addresses the quality management system of Article 17. Once the European Commission publishes the reference in the Official Journal, compliance will give a presumption of conformity with that part. CEN and CENELEC expect this later in 2026, so check where it stands before you build on it. ISO 42001 does not get that presumption. The two standards share their clause structure, which makes an existing AIMS a good base. Do not take the overlap for granted, though: EN 18286 follows the legal requirements, while ISO 42001 follows the governance of the whole organisation.
What is at stake
The fines are tiered. Breaching the prohibition of certain AI practices can cost up to 35 million euros or 7% of worldwide annual turnover, and most other obligations up to 15 million euros or 3%. For SMEs the lower of the two amounts applies in each case. An ISO 42001 certificate is one way to show that you keep AI under control, but it is not legal proof of compliance and a regulator is not bound by it.
How to approach it
Start with an inventory of all AI systems, including what staff use on their own (shadow AI). Record your role for each system (provider, deployer, importer or distributor) and its risk category, as described in the risk classification under the AI Act. Then set the scope of the AIMS. An organisation that only buys and uses AI has fewer obligations than a provider and can manage with a lighter system. Build out the AIMS using the implementation roadmap, with the impact assessment following ISO 42005. Then list the AI Act requirements your AIMS does not cover. That list is your work queue for the legal side. What auditors run into during a certification project is described in certification in practice.
The certification audit itself is carried out by an accredited certification body such as DigiTrust (www.digitrust.nl). For support with the set-up, see our compliance services.
Frequently asked questions
Is an ISO 42001 certificate enough to comply with the EU AI Act?+
No. The certificate shows that your management system meets the standard and covers part of what the regulation asks for, such as risk management, data governance, documentation and governance. It does not replace the conformity assessment, CE marking, registration in the EU database or the technical documentation of high-risk systems. ISO 42001 is also not a harmonised standard, so it gives no presumption of conformity with the regulation.
Do I need ISO 42001 if I only use AI?+
It is not mandatory. As a deployer you have your own duties, such as supporting AI literacy, the transparency obligations and, for high-risk systems, use in line with the instructions and human oversight. An AIMS gives structure to these, even in a light form. Whether you have it certified is a business choice, for instance because customers ask for it.
What does the Digital Omnibus change for the link with ISO 42001?+
Mostly the dates. High-risk AI under Annex III must comply from 2 December 2027 and AI in products under Annex I from 2 August 2028. Article 4 has been softened: you must support AI literacy rather than guarantee a level. The prohibition, the GPAI rules and Article 50 continue to apply. The AIMS therefore stays worthwhile, and you gain time for the technical high-risk requirements.
Which parts of ISO 42001 help most with a high-risk system?+
The risk and impact assessment in clauses 6.1.2 and 6.1.4, the life cycle controls in A.6 (with documentation and logging), data governance in A.7, information for interested parties in A.8, use rules in A.9 and supplier management in A.10. The technical requirements of the regulation come on top of these.
Need help with compliance?
Need to comply with ISO 27001, ISO 42001, NEN 7510, NIS2 or DORA, or do you need a SOC 2 report? We guide you through the entire process: from gap analysis to implementation.
Explore Compliance ServicesAbout the author
Partner | IT Auditor