ISO 42001 & the EU AI Act:
How the Controls Map

Not automatically. The EU AI Act is law and ISO 42001 is a voluntary management-system standard. Certification demonstrates that you run a systematic, audited AI governance program and satisfies much of what the Act expects — risk management, data governance, technical documentation, logging, transparency, human oversight, and a quality management system. But conformity with the Act is assessed against the Act itself (and, in time, against harmonized standards), so certification is strong supporting evidence rather than a legal guarantee of compliance.

As of 2026, no. Harmonized standards that grant a presumption of conformity are being developed by the European standards bodies CEN and CENELEC (technical committee JTC 21) at the request of the European Commission. ISO/IEC 42001 is an influential international standard and overlaps heavily with the Act, but it is separate from the EU harmonized standards. Confirm the current status before relying on any standard for a presumption of conformity, as this area is evolving.

The Act entered into force on 1 August 2024 and phases in: prohibitions and AI-literacy duties from 2 February 2025; GPAI model obligations (Articles 51–56) from 2 August 2025; Article 50 transparency obligations and the Commission’s GPAI enforcement powers from 2 August 2026. The high-risk deadlines were deferred by the May 2026 digital-omnibus agreement: Annex III use cases now apply from 2 December 2027, and AI embedded in regulated products (Annex I) from 2 August 2028. Watermarking of AI-generated content under Article 50(2) applies to pre-August-2026 systems from 2 December 2026.

Partially. On 6 May 2026 the Council and Parliament reached a provisional political agreement (the "digital omnibus") deferring the high-risk application dates — Annex III to 2 December 2027 and Annex I embedded AI to 2 August 2028 — with formal adoption expected before August 2026. What was NOT delayed: 2 August 2026 still brings Article 50 transparency obligations (telling people they are interacting with AI, labelling synthetic media) and the start of the Commission’s enforcement powers over general-purpose AI models, whose substantive obligations have applied since August 2025. Treat the extra time on high-risk as build time for governance, not a reprieve.

Yes, it can. The Act has extraterritorial reach: it applies to providers placing AI systems on the EU market regardless of where they are established, and to providers and deployers outside the EU where the output of the AI system is used in the EU. A company established outside the EU that serves EU customers can therefore fall in scope — which is why early AI governance, evidenced through ISO 42001, is a practical hedge.

Two routes. First, AI used as a safety component of, or itself a, product covered by EU product-safety legislation listed in Annex I. Second, AI used in the sensitive areas listed in Annex III — including employment and worker management, access to education, creditworthiness and essential services, biometric identification, critical infrastructure, and law enforcement. High-risk systems carry the full obligations of Articles 9–15 and a conformity assessment before going to market.