ISO 42001 vs EU AI Act

By Jorge García Aibar Updated 2026-09-27 First published 2026-09-25

The EU AI Act is binding law, directly applicable in every Member State; it reaches providers, deployers, importers and distributors whose AI systems are placed on the EU market or whose output is used there. ISO/IEC 42001 is a voluntary, certifiable AI management-system standard for any organisation; its certificate confers no presumption of conformity with the Act.

In short

ISO/IEC 42001 and the EU AI Act work on many of the same topics but are different kinds of instrument. The EU AI Act is binding law: prohibitions and AI literacy apply since 2 February 2025, GPAI obligations since 2 August 2025 and Annex III high-risk duties from 2 December 2027, and fines for prohibited practices reach EUR 35 million or 7% of worldwide annual turnover. ISO/IEC 42001 is a voluntary AI management-system standard; certification bodies audit organisations against it, under ISO/IEC 42006. A 42001 certificate evidences a management system and confers no presumption of conformity with the Act: only harmonised standards cited in the Official Journal and the Commission's common specifications do. In the crosswalk, both file clauses under 20 of 25 topics, 13 of them strongly. The AIMS still earns its place: its risk assessment, impact assessment and documentation processes produce evidence the Act's duties ask for.

At a glance

The two instruments side by side, as the Body of Knowledge states them. Each cell names the primary source it rests on; the last row links the chapter sections each line comes from.

ISO/IEC 42001 and EU AI Act (post-Omnibus) compared, attribute by attribute
Attribute	ISO/IEC 42001	EU AI Act (post-Omnibus)
Type	Standard: ISO/IEC 42001:2023, the AI management-system (AIMS) standard Source: ISO/IEC 42001:2023	Law: Regulation (EU) 2024/1689, as amended by the Digital Omnibus, Regulation (EU) 2026/1744 Sources: Regulation (EU) 2024/1689, consolidated text, Regulation (EU) 2026/1744 (Digital Omnibus)
Issuer	ISO/IEC (JTC 1/SC 42) Source: ISO/IEC 42001:2023	European Union Source: Regulation (EU) 2024/1689, consolidated text
Legal force	Voluntary. It is a management-system standard, not the Article 17 QMS, and its European adoption confers no presumption of conformity with the AI Act. Sources: ISO/IEC 42001:2023, AI Act Art. 17, AI Act Art. 40	Binding and directly applicable in every Member State. Fines reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices, and EUR 15 million or 3% for operator obligations. Sources: Art. 99, Art. 113
Scope and reach	Any organisation that develops, provides or uses AI. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. Source: ISO/IEC 42001:2023	Risk-tiered: prohibited practices, high-risk systems (Annex I products, Annex III uses), transparency cases and GPAI models. It reaches providers placing AI systems or GPAI models on the EU market wherever they are established, deployers in the Union, third-country providers and deployers whose output is used in the Union, importers and distributors. Sources: Art. 2, Art. 5, Art. 6, Art. 50, Art. 51
Certifiable	Yes. Certification bodies audit organisations against it; ISO/IEC 42006:2025 sets their additional requirements on top of ISO/IEC 17021-1. The certificate evidences a management system; it does not make a system compliant. Source: ISO/IEC 42006:2025	No certificate of the Act as a whole. A high-risk system passes a conformity assessment (internal control, or a notified body where required), then the provider draws up an EU declaration of conformity, affixes the CE marking and registers the system in the EU database. Sources: Art. 43, Art. 47, Art. 48, Art. 49
Key artefacts	Clauses 4 to 10 in the Harmonized Structure: AI policy, roles, AI risk assessment (6.1.2), risk treatment (6.1.3) and system impact assessment (6.1.4), internal audit, management review. Annex A control objectives in nine areas (A.2 to A.10), justified in a Statement of Applicability. Source: ISO/IEC 42001:2023	Risk classification, risk management system, technical documentation, quality management system, logs, human oversight, fundamental rights impact assessment, serious-incident reports. Sources: Art. 6, Art. 9, Art. 11, Art. 12, Art. 14, Art. 17, Art. 27, Art. 73
Dates	Published 2023. No application date: it applies to an organisation from the day it adopts the standard. Source: ISO/IEC 42001:2023	In force 2024-08-01. Prohibitions and AI literacy from 2025-02-02; GPAI obligations from 2025-08-02; Omnibus in force 2026-07-27; high-risk Annex III from 2027-12-02 and Annex I from 2028-08-02. Sources: Art. 113, Regulation (EU) 2026/1744 (Digital Omnibus)
In the Body of Knowledge	22. The ISO/IEC management-system trio 13. ISO 31000, ISO/IEC 23894 and ISO/IEC 42001	18. The EU AI Act in one pass 08. The regulatory map: EU AI Act

Where they overlap, topic by topic

The crosswalk maps 25 AI governance topics. Both instruments file clauses under 20 of them, 13 strongly (a core clause on each side). 0 topics have a core clause only in ISO 42001 and 4 only in the EU AI Act; 1 more is touched by one side only in passing (a related clause, not a core one); 0 are reached by neither. A shared topic means the two deal with the same thing, not that meeting one meets the other.

Strong: both file a core clause. Partial: both file a clause, at least one only in passing. Only, in passing: one side files a related clause and the other none. Clause ids link to their page in the obligation register where one exists. The last column names a pattern only where it serves a core clause on both sides: the crosswalk row's register entry lists it and the pattern's own "Maps to" line names that clause. Otherwise the cell is empty.

Per-topic overlap of ISO/IEC 42001 and EU AI Act (post-Omnibus), from the crosswalk, core clauses first
Topic	What ISO 42001 asks for	What EU AI Act asks for	Overlap	Patterns for both
Risk management	6.1.2 AI risk assessment 6.1.3 AI risk treatment 8.2 AI risk assessment (operation) 3 more in the crosswalk	Art. 9 Risk management system Art. 3 Definitions	Strong
Governance and accountability	5.1 Leadership and commitment 5.2 AI policy 5.3 Roles, responsibilities and authorities 6 more in the crosswalk	Art. 17 Quality management system Art. 4 AI literacy Art. 87 Reporting of infringements and protection of reporting persons	Strong
Impact assessment	6.1.4 AI system impact assessment 8.4 AI system impact assessment (operation) A.5 Assessing impacts of AI systems	Art. 27 Fundamental rights impact assessment for high-risk AI systems Art. 9 Risk management system	Strong
Data governance	A.7 Data for AI systems A.7.3 Acquisition of data (not yet verified against the source) A.4 Resources for AI systems	Art. 10 Data and data governance Art. 10(2)(f)–(g) Examination for possible biases; measures to detect, prevent and mitigate them Art. 4a Special-category data for bias detection 3 more in the crosswalk	Strong	Training-Data Rights Ledger
Documentation and transparency	7.5 Documented information A.6 AI system life cycle A.8 Information for interested parties	Art. 11 Technical documentation Art. 13 Transparency and provision of information to deployers Art. 53 Obligations for providers of general-purpose AI models 6 more in the crosswalk	Strong
Inventory and registration	A.4 Resources for AI systems	Art. 49 Registration Art. 71 EU database for high-risk AI systems Art. 6 Classification rules for high-risk AI systems 2 more in the crosswalk	Strong
Logging and traceability	A.6 AI system life cycle A.6.2.8 AI system recording of event logs (not yet verified against the source)	Art. 12 Record-keeping Art. 26(6) Deployers keep the automatically generated logs Art. 26 Obligations of deployers of high-risk AI systems 1 more in the crosswalk	Strong
Human oversight	A.9 Use of AI systems	Art. 14 Human oversight Art. 26 Obligations of deployers of high-risk AI systems Art. 14(4)(b) Awareness of automation bias	Strong
Runtime guardrails	A.9 Use of AI systems A.6 AI system life cycle	Art. 5 Prohibited AI practices Art. 15 Accuracy, robustness and cybersecurity Art. 5(1)(a)–(b) Manipulative techniques; exploitation of vulnerabilities	Partial
Robustness, security and evaluations	A.6 AI system life cycle 9.1 Monitoring, measurement, analysis and evaluation	Art. 15 Accuracy, robustness and cybersecurity Art. 55 Obligations for providers of general-purpose AI models with systemic risk Art. 60 Testing of high-risk AI systems in real-world conditions outside AI regulatory sandboxes 3 more in the crosswalk	Strong
Incident response and monitoring	A.8 Information for interested parties 10.2 Nonconformity and corrective action	Art. 72 Post-market monitoring by providers and post-market monitoring plan Art. 73 Reporting of serious incidents Art. 26(5) Deployer monitoring, informing the provider and suspending use 3 more in the crosswalk	Strong
Supply chain and third parties	A.10 Third-party and customer relationships	Art. 25 Responsibilities along the AI value chain Art. 25(4) Written agreement with third-party suppliers Art. 26 Obligations of deployers of high-risk AI systems 4 more in the crosswalk	Strong	Vendor / Model Due-Diligence Gate
Prohibited practices	A.9.4 Intended use of the AI system (not yet verified against the source)	Art. 5 Prohibited AI practices	Partial
Fairness and non-discrimination	A.5.4 Assessing AI system impact on individuals or groups of individuals (not yet verified against the source)	Art. 10(2)(f)–(g) Examination for possible biases; measures to detect, prevent and mitigate them Art. 4a Special-category data for bias detection	Partial
Privacy and data protection	A.7 Data for AI systems	Art. 59 Further processing of personal data in the AI regulatory sandbox Art. 4a Special-category data for bias detection	Partial
Explainability and right to explanation	A.8.2 System documentation and information for users (not yet verified against the source)	Art. 86 Right to explanation of individual decision-making Art. 13(3)(b)(iv)–(v) Information relevant to explain output; performance for specific persons or groups	Partial
AI literacy and competence	7.2 Competence (not yet verified against the source) 7.3 Awareness (not yet verified against the source)	Art. 4 AI literacy Art. 26(2) Oversight by people with the competence, training and authority it needs Art. 95(2)(c) Codes of conduct: promoting AI literacy	Strong
Conformity assessment and certification	9.2 Internal audit (not yet verified against the source)	Art. 43 Conformity assessment Art. 47 EU declaration of conformity Art. 48 CE marking 1 more in the crosswalk	Partial
GPAI and foundation models	Not mapped	Art. 53 Obligations for providers of general-purpose AI models Art. 55 Obligations of providers of general-purpose AI models with systemic risk Art. 51 Classification of general-purpose AI models as general-purpose AI models with systemic risk 1 more in the crosswalk	EU AI Act only
IP and copyright	Not mapped	Art. 53(1)(c) Copyright policy, including rights reservations Art. 53(1)(d) Public summary of the content used for training	EU AI Act only
Agent identity and autonomy	Not mapped	Art. 14 Human oversight	EU AI Act only, in passing
Content provenance and deepfakes	Not mapped	Art. 50(2) Machine-readable marking of synthetic content Art. 50(4) Disclosure of deep fakes Art. 3(60) Definition of deep fake	EU AI Act only
Sandboxes and real-world testing	A.6.2.4 AI system verification and validation (not yet verified against the source)	Art. 57 AI regulatory sandboxes Art. 60 Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes Art. 58 Detailed arrangements for, and functioning of, AI regulatory sandboxes 2 more in the crosswalk	Partial
Environmental impact	Not mapped	Annex XI 1(2)(e) Known or estimated energy consumption of the GPAI model Art. 40(2) Standardisation deliverables on energy and resource performance Art. 95(2)(b) Codes of conduct: environmental sustainability	EU AI Act only
Deployment, change and decommissioning	A.6.2.5 AI system deployment (not yet verified against the source) A.6.2.6 AI system operation and monitoring (not yet verified against the source) A.9 Use of AI systems	Art. 26 Obligations of deployers of high-risk AI systems Art. 25 Responsibilities along the AI value chain Art. 43(4) New conformity assessment on substantial modification 3 more in the crosswalk	Strong	Staged Rollout with Rollback Criteria Drift & Fairness Monitor Deactivation, Localisation & Retirement Runbook

Can you use ISO 42001 to comply with the EU AI Act?

Not on its own. A 42001 certificate evidences a management system; it is not a harmonised standard and confers no presumption of conformity with the Act. As of 2026-09-24 no harmonised standard is cited in the Official Journal. The AIMS still helps: its risk, impact-assessment and documentation processes produce evidence the Act's duties ask for.

Which should you start with?

If your AI systems reach the EU market or their output is used there, start with the Act: its duties apply in stages, prohibitions and AI literacy since 2 February 2025 and Annex III high-risk duties from 2 December 2027. Add ISO/IEC 42001 for a certifiable management system around that work; it shares its clause structure with ISO/IEC 27001.

Next step

Put the comparison to work on your own systems, in the browser.

Check where your system falls under the EU AI Act
The EU AI Act risk classification checker: indicative roles and risk classes, each with its article, and a decision record to file.
List the EU AI Act obligations and deadlines that bind you
The obligations planner: the register rows for your roles, the artefact that evidences each and the date it applies.
Build the AI register both instruments start from
The AI register entry builder: entries that validate against the published schemas, each field mapped to the EU database and an ISO/IEC 42001 Statement of Applicability.

Indicative, not legal advice and not a conformity claim. Nothing you enter leaves your browser.

Frequently asked questions

Does ISO 42001 certification give a presumption of conformity with the EU AI Act?

No. Only harmonised European standards whose references are published in the Official Journal (Article 40) and common specifications the Commission adopts by implementing act (Article 41) give a presumption of conformity, to the extent they cover the requirements. ISO/IEC 42001 is neither. As of 2026-09-24 no harmonised standard had been cited at all.

Sources: Art. 40, Art. 41, European Commission: Standardisation of the AI Act

Is ISO 42001 the quality management system of Article 17?

No. ISO/IEC 42001 is an AI management-system standard, not the Article 17 quality management system the Act asks of high-risk providers. The standard written for Article 17 is EN 18286:2026, published by CEN-CENELEC in July 2026. Its reference is not yet published in the Official Journal (checked 2026-09-24), so it gives no presumption of conformity yet.

Sources: Art. 17, CEN-CENELEC: EN 18286 in the spotlight, European Commission: Standardisation of the AI Act

When do the EU AI Act high-risk duties apply?

Since the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026), the Annex III high-risk duties apply from 2 December 2027 and the Annex I duties from 2 August 2028. ISO/IEC 42001 has no application date: an organisation adopts it when it chooses.

Sources: Regulation (EU) 2026/1744 (Digital Omnibus), Art. 113

What does the EU AI Act cover that ISO 42001 does not?

In this crosswalk, 4 of the 25 topics have a core EU AI Act clause and no ISO 42001 clause mapped: GPAI and foundation models; IP and copyright; Content provenance and deepfakes; Environmental impact. Agent identity and autonomy is touched only in passing: the EU AI Act files a related clause there, not a core one, and ISO 42001 none. A topic with no ISO 42001 clause here is one this mapping does not reach, not one ISO 42001 is shown to leave out. The overlap table on this page lists the clauses; mappings are illustrative, not a claim of conformity.

Both instruments sit inside a wider field: AI governance, explained, from the laws and standards to the engineering practice.

Sources

ISO/IEC 42001: https://www.iso.org/standard/42001
EU AI Act (post-Omnibus): https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng
ISO/IEC 42006:2025: https://www.iso.org/standard/44546.html
Regulation (EU) 2026/1744 (Digital Omnibus): https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
European Commission: Standardisation of the AI Act: https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation
CEN-CENELEC: EN 18286 in the spotlight: https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-07-30-ai-quality-management/

Every clause on this page, with its note and verification status, is in the topic × framework crosswalk and its JSON download.

Other comparisons: NIST AI RMF vs ISO 42001 · NIST AI RMF vs EU AI Act