ISO 42001 vs
the EU AI Act

No. The Act never names ISO 42001 and does not require any certification. It requires compliance with its own obligations — risk management, data governance, documentation, transparency, human oversight, conformity assessment for high-risk systems. ISO 42001 is the most direct management-system route to building and evidencing those capabilities, which is why the two are constantly discussed together — but adopting it is a choice, not a legal duty.

No. Conformity with the Act is assessed against the Act — and, in time, against harmonized standards developed by CEN/CENELEC JTC 21 at the Commission’s request. ISO 42001 is not a harmonized standard as of 2026, so certification grants no presumption of conformity. What it does provide: audited evidence covering most of the high-risk obligations in Articles 9–15 and 17, which materially shortens the distance to Act conformity.

Per the May 2026 provisional agreement: prohibitions and AI literacy have applied since 2 February 2025; GPAI model obligations since 2 August 2025; Article 50 transparency obligations and the Commission’s GPAI enforcement powers arrive 2 August 2026; watermarking under Article 50(2) covers pre-August-2026 systems from 2 December 2026; Annex III high-risk obligations were deferred to 2 December 2027; and Annex I embedded high-risk AI to 2 August 2028. Formal adoption of the omnibus was expected before August 2026 — verify the Official Journal status before relying on the deferred dates in legal positions.

The legal steps outside a management system: the conformity assessment procedure itself for high-risk systems, registration in the EU database, CE marking, appointing an authorized representative where required, and role-specific duties for importers and distributors. An AIMS produces much of the underlying evidence those steps consume, but performing them is separate legal work.

Slow the panic, not the program. The deferral moved the deadline, not the difficulty: high-risk conformity still demands a risk management system, data governance, technical documentation, logging, and oversight — capabilities that take quarters to build well. And 2 August 2026 still brings transparency obligations and GPAI enforcement. The rational play is to use the extra runway to build the AIMS properly and certify — arriving at December 2027 with the evidence already audited.

Open question. CEN/CENELEC JTC 21 is developing the harmonized standards, drawing on international work including ISO/IEC 42001 — but a European adoption with a presumption of conformity had not been granted to 42001 as of mid-2026. Watch the Commission’s harmonized-standards citations in the Official Journal; until then, treat 42001 as strong evidence, not a legal shortcut.