ISO/IEC 42001 vs EU AI Act is a comparison between a voluntary standard and a law. ISO/IEC 42001 tells an organization how to run an AI management system. The EU AI Act sets legal duties for AI systems placed on or used in the EU market. This guide explains how they differ, where they overlap, and what changed when the EU moved the high-risk deadlines in July 2026.
Key points
- ISO/IEC 42001 is voluntary and certifiable. The EU AI Act is binding law with fines.
- ISO/IEC 42001 applies to the organization and its management system. The EU AI Act applies to each AI system, according to its risk category and your role.
- Certification to ISO/IEC 42001 does not prove compliance with the EU AI Act.
- Since July 2026, the high-risk obligations apply from 2 December 2027 for stand-alone systems and 2 August 2028 for AI built into regulated products.
- An AI management system is still the most practical way to organize the evidence the Act will ask for.
ISO/IEC 42001 vs EU AI Act at a glance
| ISO/IEC 42001 | EU AI Act | |
|---|---|---|
| What it is | International management system standard, published December 2023 | Regulation (EU) 2024/1689, in force since 1 August 2024 |
| Binding? | No, unless a customer or contract requires it | Yes, for organizations in scope |
| Applies to | Any organization that develops, provides or uses AI | Providers, deployers, importers and distributors of AI systems in the EU market |
| Unit of assessment | The management system | The individual AI system or model |
| Outcome | Certificate from an accredited certification body | Legal compliance, and conformity assessment for high-risk systems |
| Consequence of failure | Loss of the certificate | Fines of up to EUR 35 million or 7% of worldwide turnover for prohibited practices |
What the EU AI Act requires
The Act sorts AI into risk categories. Some practices are prohibited outright. High-risk systems, such as AI used in recruitment, credit scoring or critical infrastructure, carry the heaviest duties. Systems that interact with people or generate content have transparency duties. Everything else has few or no obligations.
For a provider of a high-risk system, the Act asks for a risk management system, data governance, technical documentation, logging, information for deployers, human oversight, accuracy, robustness and cybersecurity, a quality management system and post-market monitoring. Deployers have their own duties, including using the system as instructed and keeping human oversight in place.
The dates after the July 2026 change
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk deadlines. The dates that matter now:
- 2 February 2025: prohibited practices and AI literacy duties apply.
- 2 August 2025: obligations for providers of general-purpose AI models apply.
- 2 August 2026: transparency duties apply.
- 2 December 2027: high-risk obligations apply to stand-alone systems listed in Annex III (previously 2 August 2026).
- 2 August 2028: high-risk obligations apply to AI embedded in products covered by EU product safety law (previously 2 August 2027).
The delay gives more time. It does not remove any obligation. Read the consolidated text for your own case, because some transitional rules differ by system type.
Where the two overlap
ISO/IEC 42001 asks for much of what the Act expects, at the level of the organization:
- Risk management. The standard requires AI risk assessment and treatment. The Act requires a risk management system for each high-risk system.
- Impact assessment. The standard requires an AI system impact assessment. The Act requires a fundamental rights impact assessment from certain deployers.
- Data. Annex A has controls on data quality, provenance and preparation. The Act has data governance rules for training, validation and testing data.
- Documentation and records. Both expect documented information on design, testing and operation.
- Human oversight and transparency. Both ask you to define who oversees a system and what users are told.
- Suppliers. The standard has controls for third parties and customers. The Act splits duties along the supply chain.
Where they do not overlap
ISO/IEC 42001 does not classify your systems under the Act, list prohibited practices, require CE marking or registration in the EU database, or set duties for general-purpose AI models. Those come only from the law. ISO/IEC 42001 is also not, by itself, a harmonised standard that gives a presumption of conformity. European standards bodies are writing those separately.
In the other direction, the Act says little about how to run governance day to day: roles, objectives, internal audit, management review and continual improvement. That is what a management system provides.
Which one first?
If you sell or use AI in the EU, start with an inventory of your AI systems and classify each one under the Act. That tells you which legal duties apply and when. Then use ISO/IEC 42001 as the structure that keeps those duties under control: one risk method, one set of records, one audit programme.
If you have no EU exposure, ISO/IEC 42001 still answers the questions customers now put in security and procurement questionnaires about AI governance.
Training for the people who will do the work
The person who builds the management system usually takes ISO/IEC 42001 Lead Implementer. The person who audits it takes ISO/IEC 42001 Lead Auditor. Managers and control owners who need the basics take ISO/IEC 42001 Foundation. For background on the standard itself, read our ISO/IEC 42001 certification guide.
Sources: Regulation (EU) 2024/1689, the EU AI Act (EUR-Lex) and ISO/IEC 42001:2023 (ISO).
Frequently asked questions
Does ISO/IEC 42001 certification make us compliant with the EU AI Act?
No. Certification shows that you run an AI management system that meets the standard. Compliance with the EU AI Act depends on the legal duties attached to each AI system and your role. The management system helps you organize and evidence that work.
When do the high-risk rules of the EU AI Act apply now?
After the July 2026 amendment, they apply from 2 December 2027 for stand-alone high-risk systems listed in Annex III, and from 2 August 2028 for AI embedded in products covered by EU product safety law.
Is ISO/IEC 42001 a harmonised standard under the EU AI Act?
Not by itself. Harmonised standards that give a presumption of conformity are being developed by the European standards bodies. ISO/IEC 42001 remains useful as the governance framework around them.
Does the EU AI Act apply to companies outside the EU?
It can. The Act applies to providers that place AI systems on the EU market and to cases where the output of a system is used in the EU, wherever the provider is established.
