ISO/IEC 42001 guide
ISO 42001 vs EU AI Act: what the ISO/IEC 42001 certificate gives you, and what it does not
Clause by clause: ISO/IEC 42001:2023 requirements: every clause explained →
ISO/IEC 42001 is a certifiable management system standard; the EU AI Act is law. This guide compares them side by side, sets out what the certificate does not cover under the Act, where an AIMS genuinely helps, and when you need one, the other or both.
Key points
- ISO/IEC 42001 is a voluntary, certifiable management system standard; the EU AI Act, Regulation (EU) 2024/1689, is law. One can support the other, but neither replaces the other.
- An ISO/IEC 42001 certificate gives no presumption of conformity with the Act: it is not a harmonised standard, and the European Commission has said its goals and definitions differ from the quality system the Act requires.
- The certificate does not classify your systems, sign a declaration of conformity, produce an Annex IV technical file or start the Article 73 incident clocks. Those remain your legal duties.
- Where the Act applies, classify first, then let an AIMS keep the obligations running.
ISO 42001 vs EU AI Act: the short answer
The two answer different questions. ISO/IEC 42001:2023 examines whether your organisation governs the AI it develops, provides or uses through a working management system. An accredited certification body tests that system and, if satisfied, issues a certificate valid for three years.
The AI Act examines whether each AI system you place on the EU market or use meets the rules for its tier: prohibited, high-risk, subject to transparency duties, or a general-purpose AI model. Its obligations attach to your role for each system, chiefly provider or deployer, and apply whether or not you hold any certificate.
ISO/IEC 42001 and the EU AI Act side by side
| What is compared | ISO/IEC 42001 | EU AI Act |
|---|---|---|
| Nature | International standard, first edition December 2023; voluntary | EU Regulation 2024/1689, in force since 1 August 2024 and applying in stages; amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI |
| Scope | The AI management system: the systems, roles, sites and functions you choose to put in scope | Every AI system on the EU market or whose output is used in the EU, by tier and by role |
| Who assesses | An independent certification body accredited to ISO/IEC 17021-1 with the additional requirements of ISO/IEC 42006:2025 | For most Annex III high-risk systems, the provider itself through internal control (Annex VI); a notified body only for certain biometric systems and, for AI in Annex I products, through the product's own route |
| Output | A certificate naming the scope | The provider's EU declaration of conformity, the CE mark and, for most Annex III systems, registration in the EU database |
| Cycle | Stage 1 and Stage 2, annual surveillance, recertification in the third year | Continuous: post-market monitoring, incident reporting, and a new assessment after any substantial modification |
| What drives cost | AI systems in scope, existing systems, sites, audit days | Systems, tiers and roles, design changes, testing, legal review, any notified body |
| Typical buyers | Customers, tenders and boards asking for independent evidence of AI governance | Nobody asks; it binds you if you fall within it |
What the certificate does not give
The certificate shows that governance exists and operates. It is silent on five things the Act demands.
- A classification. The standard requires you to define scope and assess risk; it never asks whether a system is prohibited under Article 5, high-risk under Article 6 and Annex III, or caught by Article 50. A certified AIMS can contain a system the Act bans.
- A conformity route. No certification body issues an EU declaration of conformity or authorises a CE mark. The provider signs the declaration.
- The Article 17 quality management system. High-risk providers need a documented quality system covering thirteen aspects set by the Act. The Commission's own guidance says ISO/IEC 42001 helps set up an AI management system but is not aligned with that quality system.
- The prescribed files and clocks. Annex IV technical documentation kept for ten years, automatic event logging, instructions for use, and serious-incident reports within 15 days, 10 days after a death, or 2 days in the gravest cases, are the Act's own formats and deadlines.
- Deployer-specific duties. Logs kept for at least six months, workers and affected people informed, and a fundamental rights impact assessment before first use for public bodies, providers of public services and deployers of credit-scoring or life and health insurance pricing systems.
A certificate also covers only its scope; a system outside it is still covered by the Act.
Where an ISO/IEC 42001 system genuinely helps
The overlap lies in the machinery rather than the paperwork. The table below is a working map, not a legal equivalence.
| AI Act obligation | What an ISO/IEC 42001 AIMS already provides | What still has to be added |
|---|---|---|
| Art. 9 risk management | AI risk assessment and treatment (6.1.2, 6.1.3, 8.2, 8.3), repeated on change | Risks to health, safety and fundamental rights per system, foreseeable misuse, testing against predefined metrics |
| Art. 10 data governance | Annex A group A.7: acquisition, quality, provenance and preparation of data | Bias examination and mitigation, and representativeness of training, validation and test data |
| Art. 11 and 12 documentation and logs | A.6 life-cycle records, technical documentation and event logs | The Annex IV content and a logging specification over the system's lifetime |
| Art. 13 and 14 information and oversight | A.8 information for users and interested parties; A.9 intended use | Instructions for use in the Act's terms; override and stop functions designed and tested |
| Art. 26 and 27 deployer duties | A.9 responsible use; A.10 supplier and customer responsibilities; the impact assessment (6.1.4) | Log retention, notices to workers and affected people, and the fundamental rights impact assessment where required |
The detail of each assessment belongs to other guides: see AI system impact assessment, with ISO/IEC 42005 and ISO/IEC 42001 AI risk assessment and treatment, with ISO/IEC 23894.
Harmonised standards and EN 18286
Under the Act, a presumption of conformity comes only from harmonised standards whose reference is published in the Official Journal of the EU. ISO/IEC 42001 is not one of them. CEN and CENELEC are writing the European standards requested for the Act.
The first to appear is EN 18286:2026, a quality management system standard written for Article 17 and aimed at providers of high-risk systems. Publication by CEN and CENELEC and citation in the Official Journal are separate steps; check the current Official Journal status before relying on any presumption. The other European AI standards were still in development at the time of writing.
Neither changes who signs the declaration. The three-way comparison from the regulation's side is in EU AI Act vs ISO/IEC 42001 and EN 18286.
Which one, or both? A decision table
| Your situation | Recommendation | Why |
|---|---|---|
| You provide a high-risk system on the EU market | AI Act conformity first; an AIMS as the operating frame | The dates are fixed by law: 2 December 2027 for Annex III systems, 2 August 2028 for AI in Annex I products |
| You deploy AI in hiring, credit or insurance pricing in the EU | Deployer duties and any impact assessment first; ISO/IEC 42001 if customers or the board want independent evidence | The duties bind you; the certificate is optional |
| Your AI is minimal-risk, but customers ask for AI governance evidence | ISO/IEC 42001, plus the Act's literacy measures and any Article 50 transparency duty | Little in the Act beyond those; the certificate answers the customer |
| You sell AI services from outside the EU to EU clients | Establish whether you are a provider and whether your output is used in the EU; then both | The Act reaches providers abroad; EU clients will ask for both answers |
| You provide a general-purpose AI model | Articles 51 to 55 first | An AIMS does not address the model duties owed to the AI Office |
Where both apply, run them as one programme: one AI inventory recording each system's tier and role alongside its place in the AIMS scope, one risk method, one evidence store and one audit cycle. For the certification side, see ISO/IEC 42001 timeline: how long certification takes, stage by stage and ISO/IEC 42001 certification cost: what moves the price.
How Sterling runs AI governance and AI Act work together
One inventory, one evidence base, and a certificate that means something.
Sterling's expert and experienced consultants, working in 60+ countries since 2003, start with a gap analysis that tests your AI systems against ISO/IEC 42001 and against the Act's obligations for each system's tier and your role. Under Sterling OS™ you choose Design™, with your team building under Sterling's coaching, or Drive™, with Sterling consultants taking on the agreed work. Everything lives in Effivity, included with the engagement at no additional cost, and Sustain™ keeps it current. We ensure successful certification for our clients. Sterling does not certify, is not a notified body and does not act as an authorised representative: an accredited certification body decides on the certificate, and conformity under the Act follows the Act's own procedures.
Book a free discovery callISO/IEC 42001 and the EU AI Act: questions buyers ask
Does an authority have to accept our ISO/IEC 42001 certificate as evidence?
No, the Act gives the certificate no formal status. Authorities check each system's obligations; AIMS records can help you answer them.
Can the ISO/IEC 42001 audit and the AI Act conformity assessment be done together?
No, they are different procedures run by different parties. The certification body audits the management system; the conformity assessment is the provider's internal control or, where required, a notified body's. The same evidence can feed both.
Should we wait for the harmonised standards before starting?
No, because several obligations already apply. The prohibitions and AI literacy have applied since 2 February 2025, and most transparency duties since 2 August 2026; the high-risk dates are fixed, and files built now can be adjusted to the standards later.
Does EN 18286 replace ISO/IEC 42001?
No, they serve different purposes. EN 18286:2026 addresses the Article 17 quality system for high-risk providers; ISO/IEC 42001 is a certifiable AI management system for any organisation, and many providers will use both.
We only deploy AI that others build. What does ISO/IEC 42001 add for the Act?
It adds structure for the deployer duties you already have. Its controls on responsible use and supplier responsibilities give you a place to record intended use, oversight and what each supplier owes you.
Which should come first, the AI Act inventory or the AIMS scope?
The inventory, because the Act's tiers decide your legal duties and deadlines. Set the AIMS scope from the same list.
More ISO/IEC 42001 guides
Every guide in the ISO/IEC 42001 series is written for one question and links back to the hub for the whole picture.
- AI system impact assessment, with ISO/IEC 42005
- AI impact assessment
- ISO/IEC 42001 Annex A: the 38 controls explained
- ISO/IEC 42001 certification process, step by step
- ISO/IEC 42001 certification cost: what moves the price
- Effivity for ISO/IEC 42001: the guide
- ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS
- ISO/IEC 42001 requirements explained, clause by clause
- ISO 42001 timeline
- ISO/IEC 42001 training: who needs what, and the competence evidence
- How to verify an ISO/IEC 42001 certificate, and spot a fake or misleading one
- ISO/IEC 42001 and the EU AI Act: what the certificate does not give
- ISO 42001 vs ISO 27001
Keep exploring
Explore more about ISO/IEC 42001
Watch a video on how to implement ISO 42001 here.
Watch a video on ISO 42001 requirements here.
ISO/IEC 42001 resources
Services for ISO/IEC 42001
Talk to a consultant
Build AI governance that answers both the auditor and the Act.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice