ISO 42001 and the EU AI Act for US Companies

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

What you get. A clear, defensible answer for your European customers, and an ISO/IEC 42001 management system that supports it, built for you by Sterling and audited by an accredited certification body.

Regulation (EU) 2024/1689, the AI Act, is written to apply beyond the Union. It covers providers placing AI systems on the EU market or putting them into service there "irrespective of whether those providers are established or located within the Union or in a third country"^[2]. It also reaches providers and deployers located in a third country where the output produced by the AI system is used in the Union^[2].

For a US company that means three common triggers:

• European customers or users of your AI product.
• US customers who pass your AI output to people in Europe.
• A European buyer's contract clause asking you to warrant AI Act compliance.

This guide separates what the Regulation says from what ISO/IEC 42001 does, so you never promise a European customer more than your evidence supports. It is not legal advice and states no application dates; confirm those in the Official Journal or with EU counsel.

The short version you can repeat to a customer: one is a voluntary standard you can be certified to, the other is law. Holding one never equals satisfying the other.

What you get. A plain map of the parts of the Regulation your counsel and your engineers will talk about.

• Roles. A provider develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark; a deployer uses an AI system under its authority, outside personal non-professional activity^[2]. Many US AI companies are providers of their own product and deployers of someone else's model, so roles are settled system by system.
• Risk tiers. The Regulation lists prohibited AI practices^[2]. Some systems are high-risk, through listed EU product legislation or use cases in an annex, with a derogation where a system does not pose a significant risk of harm^[2]. Certain systems carry transparency duties, such as telling people they are interacting with an AI system unless that is obvious, and providers of general-purpose AI models have their own obligations^[2].
• AI literacy. Providers and deployers must take measures, to their best extent, to ensure a sufficient level of AI literacy among staff and others operating AI systems on their behalf^[2].
• EU representative. Providers of high-risk systems established outside the Union must appoint, by written mandate, an authorized representative in the Union before making those systems available there^[2].

What you get. Groundwork your counsel can build on, instead of a separate compliance project.

Article 17 requires providers of high-risk AI systems to put a quality management system in place, documented as written policies, procedures and instructions^[2]. Its minimum list includes a regulatory compliance strategy, design and development controls, testing and validation, data management, risk management, post-market monitoring, serious incident reporting, record-keeping, resource management and an accountability framework^[2]. The Article adds that these elements are to be applied in proportion to the size of the provider's organization^[2].

An AI management system produces much of that material: policies, risk assessments, test records, monitoring and incident routines. Two limits apply:

1. Classification comes first. The Article 17 duty attaches to providers of high-risk systems, and whether your system is high-risk is a legal question, not a management system question. 2. No assumed presumption. The Regulation presumes conformity for high-risk systems that meet harmonized standards whose references are published in the Official Journal, to the extent those standards cover the requirements^[2]. Do not assume ISO/IEC 42001 is one of them until you have checked the Journal.

Contract clauses can turn a casual sentence into a warranty, so use statements you can prove.

Safe, when true:

• "We operate an AI management system aligned to ISO/IEC 42001."
• "Our AI management system is certified by [named accredited body] for [stated scope]."
• "With counsel, we have assessed our systems against the AI Act's role and classification rules; here is the outcome."

Avoid:

• "We are AI Act compliant because we are ISO 42001 certified."
• "Our certificate means you need not assess your own duties as a deployer."
• Any date or deadline you have not checked against the current Official Journal text.

What you get. Done-for-you consulting with Sterling's 100% success and on-time completion record across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. The people who consult never audit you, and Sterling gives no legal advice.

1. Inventory. We list your AI systems, users, where they are and where outputs land. Counsel and the management system both use it. 2. Roles and classification, with counsel. Provider, deployer or both; prohibited, high-risk, transparency-only or general-purpose^[2]. Your EU counsel decides; we work from their conclusions. 3. Build the management system. Policy, risk method, testing and monitoring routines scoped to the products Europeans use, with records held in Effivity, Sterling's GRC automation platform. 4. Internal audit and certification audit. We close findings first, then coordinate with the accredited certification body you choose. 5. One customer statement. A single description of what the certificate covers and what it does not.

The EU AI Act hub gives more background; ISO 42001 explained for US AI companies and ISO 42001 vs NIST AI RMF cover the US side.

This is Sterling's recommendation, not legal advice and not a statement from ISO or the EU.

1. Get a one-time EU legal read on roles and classification before telling any customer what you comply with. 2. Build an ISO/IEC 42001 management system when buyers want independent proof, scoped to the products European users touch. 3. Describe the certificate as evidence of an audited management system, never as AI Act compliance. 4. Record when you last checked the Official Journal for dates and amendments. 5. Keep SOC 2 or ISO/IEC 27001 on its own track for security questions.

Selling into Europe this year? Get started and a Sterling expert will map your first steps.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• EU AI Act: standard overviewStandard overview
• ISO/IEC 42001: standard overviewStandard overview
• NIST AI RMF: standard overviewStandard overview
• ISO/IEC 27001: standard overviewStandard overview
• SOC 2: standard overviewStandard overview
• Win Buyers Abroad: Compliance for US Companies ExpandingUnited States
• ISO 42001 Explained for US AI CompaniesUnited States
• ISO 42001 vs NIST AI RMF: Which Do US AI Companies Need?United States
• ISO/IEC 42001 for US AI Companies: What Buyers and Rules RequireUnited States
• Sterling in the United StatesUnited States

1. ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system (title as listed). ISO. accessed October 23, 2026.

2. Regulation (EU) 2024/1689 (Artificial Intelligence Act), as published in the Official Journal. EUR-Lex. accessed October 23, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.