ISO 42001 vs the EU AI Act: What Organisations Need
ISO 42001 is a voluntary, certifiable AI management system standard; the EU AI Act is binding legislation for organisations and activities within its scope. Certification can support a structured approach to AI compliance preparation, but it doesn't establish legal compliance.
For UK organisations supplying or using AI across European markets, the practical challenge is connecting AI governance processes with system-specific legal duties. Start by separating what each framework assesses, then identify where evidence can support both.
Key takeaways
The EU AI Act sets legal obligations according to your role, AI system and applicable deadlines.
ISO 42001 provides an auditable management framework, rather than approval for individual AI products.
Shared risk assessments and records can reduce duplication, but legal classification and conformity assessment remain separate work.
ISO 42001 vs the EU AI Act: the core differences
ISO's description of ISO/IEC 42001 explains its requirements for establishing, implementing, maintaining and improving an artificial intelligence management system (AIMS).
The distinction is straightforward.
Comparison | ISO/IEC 42001 | EU AI Act |
|---|---|---|
Status | Voluntary international standard | Binding EU legislation |
Focus | Management of AI-related activities within a defined scope | Obligations for particular actors, models and systems |
Applicability | Organisations developing, providing or using AI worldwide | Organisations and activities within the Act's territorial scope |
Assessment | Independent management-system certification | Regulatory conformity assessment where required |
Outcome | Certificate covering the stated AIMS scope | Evidence of meeting applicable legal requirements |
Enforcement | Certification findings and potential certificate withdrawal | Regulatory action and financial penalties |
An organisation can implement the standard without seeking certification. However, customers may make certification a contractual procurement requirement.
Who the Act covers and how risk changes obligations
UK organisations can fall within scope
The Act covers providers, deployers, importers, distributors, product manufacturers and authorised representatives, with different duties for each role.
Its reach extends beyond EU-established organisations. A UK business can fall within scope when supplying AI into the EU, or where the output of its AI system is used in the Union.
Therefore, classify your role for each activity. Buying a model doesn't settle your responsibilities, particularly if you substantially modify a system or change its intended purpose.
Four risk categories require different responses
Practices that present an unacceptable risk are prohibited under Article 5. Prohibited AI practices include qualifying harmful subliminal or manipulative techniques, exploitation of age-related or disability-related vulnerabilities, social scoring, and certain real-time remote biometric identification for law enforcement in public spaces.
High-risk AI systems face detailed controls. These include risk management, Annex IV technical documentation, human oversight, conformity assessment and CE marking, plus EU database registration where required.
Limited risk uses attract transparency duties. Chatbots require interaction disclosures; emotion recognition and biometric categorisation also carry notification requirements. These duties don't override prohibitions or high-risk requirements. Evidently artistic, creative or satirical deepfake content benefits from adapted disclosure requirements.
Minimal-risk systems generally face no category-specific obligations, although cross-cutting duties and other laws can still apply.
Maximum fines reach €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for specified non-compliance, including high-risk requirements, and €7.5 million or 1% for incorrect information to authorities. Different calculation rules protect SMEs.
Where requirements overlap, and where gaps remain
Map controls to obligations, not entire frameworks
Both frameworks address accountability, risk management, documentation and monitoring. However, a control mapping shows supporting evidence, rather than legal equivalence.
These are practical connections between selected requirements.
EU AI Act requirement | Relevant ISO 42001 provisions | Evidence that can support both |
|---|---|---|
Article 9: risk management | Clauses 6.1.2, 8.2 and 8.3 | Risk assessments, treatment decisions and review records |
Article 10: data governance | Annex A.7 | Data provenance, quality criteria and preparation records |
Articles 11 and 12: documentation and records | Clause 7.5 and Annex A.6 | Controlled development documents and lifecycle records |
Article 14: human oversight | Clauses 5.3 and 7.2 | Assigned responsibilities and competence records |
Articles 72 and 73: monitoring and incidents | Clauses 9.1 and 10.2 | Monitoring results, investigations and corrective actions |
Personal-data handling must also meet GDPR requirements. AI Act evidence doesn't replace privacy compliance.
The final column needs legal review against each applicable duty. ISO evidence may lack the required detail, format or reporting deadline.
Assemble a system-specific technical file
Annex IV documentation must describe intended purpose, design specifications, training and testing data, risk management measures and human oversight mechanisms.
Existing development records can supply much of this material. The provider must organise them as audit-ready documentation in a coherent technical file and maintain it as the system changes.
Likewise, an AIMS risk register can support Article 9 only when its AI risk assessment covers the relevant system, foreseeable misuse and risks to affected people.
Certification doesn't itself create a presumption of conformity. That mechanism depends on relevant harmonised standards cited in the EU Official Journal and the requirements they cover.
Certification and conformity assessment are different
ISO 42001 audits assess the management system
The certification audit normally involves two stages: Stage 1 reviews scope, documentation and readiness; Stage 2 tests implementation and effectiveness.
Certificates normally follow a three-year cycle, with annual surveillance audits and recertification before renewal. Budget for continued governance, internal audits and corrective actions, alongside external assessment.
BSI's AI management system overview describes certification against the standard. The resulting certificate covers its defined scope, not every model or output.
AI Act assessment addresses applicable system requirements
The Act's conformity-assessment route depends on the system's classification and relevant legislation.
For many Annex III high-risk systems, providers use internal control without a notified body. Certain biometric systems and regulated-product routes can require third-party involvement, subject to the applicable conditions.
Providers must still demonstrate conformity, prepare the required declaration and apply CE marking where required. A certification body's AIMS audit doesn't replace this process.
Our guide to ISO 42001 certification considerations explains when independent management-system assurance warrants the ongoing commitment.
EU AI Act dates for your implementation plan
The Act applies in stages. As of November 2026, the timetable distinguishes general application from amended high-risk application dates.
These milestones affect different obligations and groups of organisations.
Date | Milestone |
|---|---|
1 August 2024 | Act entered into force |
2 February 2025 | Prohibited-practice rules and AI-literacy duties began applying |
2 August 2025 | General-purpose AI model obligations began applying |
2 August 2026 | General application, subject to exceptions; Commission GPAI enforcement powers began |
2 August 2027 | Compliance deadline for GPAI models placed on the market before 2 August 2025 |
2 December 2027 | Amended application date for Annex III high-risk requirements |
2 August 2028 | Amended application date for Annex I product-related high-risk requirements |
The later high-risk dates don't suspend obligations already applicable. For example, prohibited practices and AI-literacy duties require attention independently of a high-risk implementation programme.
Assign deadlines to individual systems and obligations rather than treating one date as an organisation-wide deadline.
How the GPAI Code and NIST framework fit
The GPAI Code supports defined legal duties
Published on 10 July 2025, the voluntary GPAI Code of Practice provides a route for demonstrating compliance with particular GPAI obligations.
Its Transparency and Copyright chapters address Article 53 transparency obligations. The Safety and Security chapter supports Article 55 duties for models with systemic risk, including systemic-risk mitigation and cybersecurity.
The Code has a different purpose from ISO 42001. GPAI model documentation under Annex XI also differs from high-risk system documentation under Annex IV.
NIST provides another risk-management reference
The NIST AI RMF (NIST AI Risk Management Framework) is voluntary and has no formal certification scheme. It organises guidance around Govern, Map, Measure and Manage.
Organisations can use these functions to inform assessment methods within an AIMS. However, neither NIST alignment nor ISO certification substitutes for identifying applicable AI Act obligations.
Choose supporting frameworks for their specific contribution, rather than treating them as interchangeable forms of assurance.
A practical readiness plan for both frameworks
ISO's explanation of AI management systems supports a structured organisational approach. Start with your AI activities and responsibilities before committing to an audit date.
Create an AI inventory of systems, models and third-party services. Record intended purpose, users, suppliers, affected people and accountable owners.
Determine territorial scope, organisational role and risk classification for each activity. Record applicable duties and deadlines separately from certification requirements.
Define the AIMS scope and assess gaps. Reuse suitable ISO 27001 processes for document control, internal audits and management reviews, whilst adding AI-specific impact assessment.
Link obligations to controls and evidence. Identify outstanding technical documentation, transparency notices, registration and conformity-assessment work.
Test implementation and maintain oversight. Review incidents, complaints, overrides, supplier changes and performance before management review and external assessment.
Existing TISAX or CMMC work may provide useful security evidence, but neither establishes AI Act compliance. Similarly, a vCISO can coordinate security oversight whilst product owners and legal specialists retain their responsibilities.
Our ISO 42001 consultancy services support gap assessment, risk and impact assessment, documentation and certification readiness.
Maintain reassessment triggers after launch. Changes to data, suppliers, models or intended use can affect both governance controls and legal obligations.
Frequently asked questions
Is ISO 42001 certification mandatory in the UK?
There's no general UK requirement for every organisation using AI to obtain certification. However, contracts may require it, and applicable regulatory duties remain separate.
Do we need ISO 27001 certification first?
No. ISO 27001 isn't a prerequisite. Its information security management processes can provide useful foundations, but AI governance requires dedicated assessment of impacts, oversight and acceptable use.
Can we adopt ISO 42001 without certification?
Yes. You can implement its requirements to strengthen governance before seeking external assurance. Certification becomes a separate decision based on customer requirements, risk and business priorities.
Build governance around your actual legal duties
ISO 42001 provides a repeatable management structure. The EU AI Act establishes obligations that depend on your activities, role and systems.
The strongest approach connects both through traceable evidence, whilst preserving separate legal assessments. Start with scope and classification, then build controls that remain effective after certification.
If you would like to find out more information or require any of our services please Contact Us and complete the contact form.
Comments