ISO 42001 vs the EU AI Act: what the standard covers and what it does not
ISO/IEC 42001:2023 is a voluntary standard for managing artificial intelligence in an organization; Regulation (EU) 2024/1689 (the AI Act) is binding EU law with duties that depend on your role and on the risk level of each system. They are not equivalent: ISO 42001 certification does not by itself demonstrate conformity with the AI Act. But they fit together well: the ISO 42001 management system (inventory, risk, impact assessment, life cycle, human oversight, incidents) is an orderly way to organize and keep evidence for the AI Act obligations that apply to you.
Core differences between ISO 42001 and the AI Act
| Aspect | ISO/IEC 42001:2023 | Regulation (EU) 2024/1689 |
|---|---|---|
| Nature | Voluntary international standard | European Union law, mandatory |
| Subject | The organization's AI management system (clauses 4 to 10 and Annex A) | Each AI system or model by risk: prohibited, high-risk, transparency, general-purpose |
| Who it applies to | Anyone who chooses to adopt it, in any country | Providers, deployers, importers and distributors active on the EU market, even if based outside the EU |
| How it is shown | Audit by an accredited certification body | Technical documentation, conformity assessment, CE marking and registration (for high-risk), supervision by authorities |
| Consequence of non-compliance | Not obtaining or losing the certificate | Fines and measures by market surveillance authorities |
So the useful question is not «ISO 42001 or the AI Act?» but «which parts of what the AI Act asks of me can the management system support?». The answer depends on your role (a provider that develops, or a deployer that uses) and on whether any of your systems is high-risk.
AI Act dates in force (October 2026)
Regulation (EU) 2026/1744 (the Digital Omnibus on AI), in force since 27 July 2026, postponed the high-risk obligations. According to the European Commission's official AI Act page (updated 19 October 2026), the timeline is now:
| From | What applies |
|---|---|
| 2 February 2025 | Prohibited practices (Art. 5) and AI literacy (Art. 4, with the 2026 wording: take measures to promote it) |
| 2 August 2025 | Governance and obligations for general-purpose AI models |
| August 2026 | The rest of the Regulation, including transparency for certain systems (Art. 50), except high-risk |
| 2 December 2027 | Annex III high-risk systems (for example employment, education, migration) |
| 2 August 2028 | High-risk systems embedded in regulated products under Annex I |
The delay buys time; it does not remove obligations. An AI management system takes several months to implement, so an organization with Annex III systems that starts now reaches December 2027 with room to spare. Always check the current text on EUR-Lex and the Commission's guidelines: this guide is not legal advice.
ISO 42001 Toolkit: documentation for your AI management system
30 Word documents · 31 Excel tools · 38 Annex A controls
See the ISO 42001 documentation toolkitMapping table: 17 AI Act obligations and their ISO 42001 support
This is the simplified mapping from the NexoDocs toolkit (AIMS-REF-02). Obligations are summarized in our own words and the standard is cited by clause and control number. It is guidance: what actually applies depends on your role and on how each system is classified.
| AI Act article | Who | Related ISO/IEC 42001 |
|---|---|---|
| Art. 4 · AI literacy | Providers and deployers | 7.2, 7.3 |
| Art. 5 · Prohibited practices | Everyone | 4.1, 6.1, A.9.4 |
| Art. 6 and Annex III · High-risk classification | Providers (and deployers) | 4.1, 6.1.4 |
| Art. 9 · Risk management system | Providers | 6.1, 8.2, 8.3 |
| Art. 10 · Data and data governance | Providers | A.7.2 to A.7.6 |
| Art. 11 · Technical documentation | Providers | A.6.2.7 |
| Art. 12 · Record-keeping (logs) | Providers | A.6.2.8 |
| Art. 13 · Transparency and instructions for use | Providers | A.8.2 |
| Art. 14 · Human oversight | Providers | A.9, A.6.2.6 |
| Art. 15 · Accuracy, robustness and cybersecurity | Providers | A.6.2.4, A.6.2.6 |
| Art. 17 · Quality management system | Providers | Clauses 4 to 10 |
| Art. 26 · Obligations of deployers | Deployers | A.9, A.6.2.6, A.8 |
| Art. 27 · Fundamental rights impact assessment | Certain deployers | 6.1.4, A.5 |
| Art. 50 · Transparency for certain systems | Providers and deployers | A.8.2, A.8.5 |
| Art. 53 · General-purpose AI models | Providers of those models | A.6, A.8 |
| Art. 72 · Post-market monitoring | Providers | 9.1, A.6.2.6 |
| Art. 73 · Reporting of serious incidents | Providers (and deployers) | A.8.4 |
In the toolkit's Excel file each row also has the summarized obligation, the toolkit documents that serve as supporting evidence (for example the AI system inventory AIMS-INV-01, the impact assessment AIMS-AIA-02, the human oversight policy AIMS-POL-09, the incident log AIMS-INC-01) and an «Applies to us?» column with notes.
Where ISO 42001 helps most
- Inventory and classification: clause 4.1 and the AI system inventory force you to know which systems you have, who supplies them and what they are used for; that is the first step to find out whether any is high-risk.
- Continuous risk management: clauses 6.1, 8.2 and 8.3 provide the assess-treat-review cycle that Article 9 requires for high-risk systems.
- Impact assessment: 6.1.4 and the A.5 controls cover affected individuals and groups, a useful basis for the Article 27 fundamental rights impact assessment.
- Human oversight, logs and incidents: controls A.9, A.6.2.8 and A.8.4 leave evidence of responsible use, logging and incident communication.
- Literacy: clauses 7.2 and 7.3 (competence and awareness) connect directly with Article 4.
What ISO 42001 does not cover
- Conformity assessment, CE marking, the EU declaration of conformity and registration of high-risk systems in the EU database.
- The detailed technical requirements of the harmonised standards to be published for the AI Act; ISO 42001 is a management system, not a product specification.
- The specific deadlines and channels for reporting serious incidents to authorities.
- The legal call on whether a practice is prohibited or a system is high-risk: that requires reading the official text and, when in doubt, legal advice.
- Obligations under other laws that intersect with AI, such as the GDPR when the system processes personal data.
Using your AI management system to prepare for the AI Act, step by step
- Build the AI system inventory and record your role for each one (provider, deployer, importer or distributor).
- Classify each system: prohibited, high-risk (Annex I or III), Article 50 transparency or minimal risk. Record the rationale.
- Go through the mapping table and mark which rows apply. For a deployer without high-risk systems, usually only a few remain: Articles 4, 5, 26 where relevant, and 50.
- For each applicable row, decide which AIMS document or record will be the evidence and who maintains it.
- Add the AI Act obligations to your legal requirements register and to the internal audit (9.2) so they are reviewed every year.
- Check the timeline and the Commission's guidelines at least every quarter: the Regulation already changed once in 2026.
Template: the AI Act mapping in the ISO 42001 toolkit
The NexoDocs ISO 42001 toolkit includes the AI Act mapping (AIMS-REF-02) in Excel, with the 17 obligations preloaded, the related ISO 42001 clause or control and the toolkit documents that support each one, plus the legal requirements register (AIMS-CTX-04) and the AI system inventory (AIMS-INV-01). Both reflect the Article 4 wording introduced by Regulation (EU) 2026/1744. If you want to start with the part closest to Article 27, you can download the AI system impact assessment template for free.
Next step
Try it free or go straight to the complete solution.
ISO 42001 Toolkit: documentation for your AI management system
30 Word documents · 31 Excel tools · 38 Annex A controls
See the ISO 42001 documentation toolkit
Free sample
Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.
Get the free sampleFrequently asked questions
Is ISO 42001 certification the same as complying with the AI Act?
No. They are different things: certification assesses the management system, while the AI Act sets legal obligations per system and per role. The AIMS helps organize the evidence but does not replace conformity assessment or the Regulation's other obligations.
Will ISO 42001 become a harmonised standard under the AI Act?
As of October 2026, ISO/IEC 42001 is not listed as a harmonised standard giving a presumption of conformity. The European standardisation bodies are preparing their own standards for the AI Act; check the status on the Commission's page.
When do the high-risk obligations apply?
According to the European Commission, after Regulation (EU) 2026/1744: from 2 December 2027 for Annex III systems and from 2 August 2028 for systems embedded in regulated products under Annex I.
If my company only uses third-party AI tools, is ISO 42001 useful?
Yes, to the extent you need to organize that use: inventory, acceptable use policy, staff AI literacy (Art. 4), transparency (Art. 50) and, if any tool is high-risk, the deployer obligations in Article 26.
Does a company outside the EU have to comply with the AI Act?
It may: the AI Act applies to providers placing systems on the EU market and to providers and deployers whose AI output is used in the EU, even if they are established elsewhere. Confirm with legal counsel for your case.
Related guides
What is ISO/IEC 42001? The artificial intelligence management system
What ISO/IEC 42001:2023 is, who it is for, clauses 4 to 10, the 38 Annex A controls and how it relates to ISO 27001 and the EU AI Act.
Read the guide →AI literacy: what Article 4 of the EU AI Act requires and how to comply
What Article 4 of the EU AI Act requires on staff AI literacy, who it applies to, what training to cover by role and what evidence to keep.
Read the guide →ISO 42001 AI system impact assessment template: free Excel with automatic scoring
Free ISO 42001 AI system impact assessment template in Excel: screening, impacts with automatic scoring, residual impact and approval. No email needed.
Read the guide →Updated: 2026-10-29