How do ISO/IEC 42001 and the EU AI Act fit together?

ISO/IEC 42001 is a voluntary standard for an AI management system, and a certification body can certify you against it; the EU AI Act is law. A certificate brings no presumption of conformity: Article 40(1) reserves that for harmonised standards whose references are published in the Official Journal, and our sources hold none for ISO/IEC 42001. The management system can still be where several of the Act's duties are carried out.

Written 1 November 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI). Neither act names ISO/IEC 42001. We have not pinned the standard's text and do not quote it.

Is ISO/IEC 42001 part of the EU AI Act?

No. A search of both pinned acts for "42001" returns nothing. The Act's word for a standard with legal effect is "harmonised standard", which Article 3, point (27) defines by reference to Regulation (EU) No 1025/2012.

Article 40(1) sets the effect: systems and models in conformity with harmonised standards "the references of which have been published in the Official Journal of the European Union in accordance with Regulation (EU) No 1025/2012 shall be presumed to be in conformity with the requirements set out in Section 2 of this Chapter". It adds, as applicable, the obligations in Chapter V, Sections 2 and 3 and ends "to the extent that those standards cover those requirements or obligations".

A certificate against ISO/IEC 42001 is evidence about your organisation from a certification body. It is not a reference published in the Official Journal.

Which standards will carry the presumption?

That depends on Commission acts that are not in our sources, and we do not guess. Our guide to EN 18286:2026, the European quality management system standard for EU AI Act regulatory purposes, records that its reference was not in the Official Journal on the sources that page read.

The text leaves a second point open. Regulation (EU) 2026/1744 added a subparagraph to Article 40(2): the Commission is to request standardisation deliverables, including, as appropriate, harmonised standards, "to facilitate the joint compliance and presumption of conformity with the requirements or obligations set out in Chapter III, Sections 2 and 3 of this Regulation", and with the relevant Annex I legislation. Article 40(1), which it did not amend, still presumes conformity with Section 2 only, and Article 17 sits in Section 3. How a cited standard would give a presumption for Article 17, the text does not say; we leave that open.

Where does a management system meet the Act?

The four provisions below ask for written processes that run continuously, which is what a management system is for. This maps the Act's duties (not the standard's clauses) and does not claim that any clause of ISO/IEC 42001 meets them.

Article 17, the quality management system. Providers of high-risk AI systems "shall put a quality management system in place that ensures compliance with this Regulation", documented "in the form of written policies, procedures and instructions" and covering at least the thirteen aspects of Article 17(1). A voluntary standard belongs in point (e): "technical specifications, including standards, to be applied and, where the relevant harmonised standards are not applied in full or do not cover all of the relevant requirements set out in Section 2, the means to be used to ensure that the high-risk AI system complies with those requirements".

Implementation is proportionate to the size of the provider's organisation, in particular for an SME, including a start-up, or an SMC, while every provider keeps the degree of rigour and the level of protection the Act requires (Article 17(2), as replaced). Financial institutions under Article 17(4) have the duty deemed fulfilled through their internal governance rules, except points (g), (h) and (i), and there "any harmonised standards referred to in Article 40 shall be taken into account". The quality management system guide goes through all thirteen aspects.

Article 9, risk management. A risk management system "shall be established, implemented, documented and maintained in relation to high-risk AI systems" (Article 9(1)), as "a continuous iterative process planned and run throughout the entire lifecycle" in the four steps of Article 9(2). Write it to the Act's terms; three are easy to miss.

The risks are those to health, safety or fundamental rights and only those that can reasonably be mitigated or eliminated through development or design, or through adequate technical information (Article 9(2), point (a) and Article 9(3)). Testing runs, as appropriate, throughout development and in any event before placing on the market or putting into service, "against prior defined metrics and probabilistic thresholds that are appropriate to the intended purpose of the high-risk AI system" (Article 9(8)). The provider considers, in view of the intended purpose, any likely adverse impact on persons under 18 and, as appropriate, other vulnerable groups (Article 9(9)). The risk management guide has the rest.

Article 4, AI literacy. Article 4, as replaced by Regulation (EU) 2026/1744, has providers and deployers of AI systems "take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf", taking into account their technical knowledge, experience, education and training, the context of use and the persons or groups of persons on whom the systems are used. It "does not require providers or deployers to guarantee any specific level of AI literacy of any individual", and carries no risk qualifier. Chapter I, where it sits, applies from 2 February 2025 (Article 113, third paragraph, point (a), as replaced). A management system's record of who was briefed on what, and when, can carry it.

Article 72, post-market monitoring. Providers "shall establish and document a post-market monitoring system in a manner that is proportionate to the nature of the AI technologies and the risks of the high-risk AI system" (Article 72(1)); Article 72(2) sets what it collects and why. It rests on a plan that is part of the Annex IV technical documentation, and the Commission is to adopt guidance, including a template, by 2 September 2027 (Article 72(3), as replaced); check whether it exists.

The routes this page cites for folding an Act duty into a system you already keep are Article 9(10), Article 17(3) and (4) and Article 72(4). Each names Union law: "other relevant provisions of Union law", "relevant sectoral Union law", "Union financial services law" and the Union harmonisation legislation listed in Section A of Annex I. None names a voluntary standard. Nothing stops you writing the Act's aspects into a 42001 system, but none of these routes, and no presumption in Articles 40 to 42, covers it.

When do Articles 9 and 17 apply?

Article 9 sits in Chapter III, Section 2 and Article 17 in Section 3. Both apply from 2 December 2027 for AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and from 2 August 2028 for those classified as high-risk pursuant to Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744). Neither applies to systems related to products under Section B of Annex I (Article 2(2), as replaced). For systems placed on the market or put into service before then, Article 111(2), as replaced, governs.

What does ISO/IEC 42001 not give you?

A classification. Article 6 decides whether a system is high-risk: paragraph 1 for products and safety components under the Annex I legislation that need a third-party conformity assessment, read with Article 6(1a), (1b) and (1c), as inserted; paragraph 2 for the uses in Annex III. Paragraph 3 takes an Annex III system out where it does not pose a significant risk of harm and one of the four conditions in its second subparagraph is fulfilled, with the assessment documented under Article 6(4), but never one that performs profiling of natural persons. How to classify a system walks it through.

A conformity assessment. Article 3, point (20) defines it as "the process of demonstrating whether the requirements set out in Chapter III, Section 2 relating to a high-risk AI system have been fulfilled", and Article 43 sets the procedures. Under internal control, the provider "verifies that the established quality management system is in compliance with the requirements of Article 17" (point 2 of Annex VI). Under Annex VII, "The quality management system shall be assessed by the notified body, which shall determine whether it satisfies the requirements referred to in Article 17" (point 3.2 of Annex VII).

A 42001 certification audit is neither: its measure is the standard, not Article 17. For a biometric system under point 1 of Annex III, Annex VI is open only where the provider applied "harmonised standards referred to in Article 40" or common specifications under Article 41; otherwise Annex VII applies (Article 43(1)). Our sources hold nothing that makes ISO/IEC 42001 such a standard. The conformity assessment guide has every route.

A CE marking. Article 3, point (24) defines it as "a marking by which a provider indicates that an AI system is in conformity with the requirements set out in Chapter III, Section 2 and other applicable Union harmonisation legislation providing for its affixing". The provider affixes it in accordance with Article 48 and draws up the EU declaration of conformity under Article 47 (Article 16, points (g) and (h)). A certificate is neither.

What this means for you

If you're a provider of a high-risk AI system: classify each system under Article 6 first. If you follow 42001, name it under Article 17(1), point (e) and write down the means for every Section 2 requirement it does not reach. Check the quality management system against all thirteen aspects of Article 17(1), not against the certificate. The conformity assessment under Article 43 is still a separate step.

If you're a deployer: Articles 9, 17 and 72 are provider duties, though Article 26(5) has you inform providers where relevant. Article 4 is yours at any risk level. A supplier's 42001 certificate tells you about its management system; for a high-risk system, the Act's own statements of conformity are the EU declaration of conformity (Article 47) and the CE marking (Article 48). Article 25(1) makes you the provider in the three cases it lists.

Complipath classifies each system by fixed rules with the article behind the answer, and a person confirms each result. On Growth and up it shows how far your AI management is from ISO/IEC 42001, with a draft statement of applicability, readiness only and never a certificate, and the risk map exports the register for ISO/IEC 42001. It does not map 42001's controls to the Act (every live feature).

FAQ

Does ISO/IEC 42001 certification make us compliant with the EU AI Act? No. A certificate is evidence that your AI management system meets a voluntary standard. The Act's duties are owed system by system: classification under Article 6 and, for a provider of a high-risk system, a quality management system that meets Article 17, a conformity assessment under Article 43 and a CE marking under Article 48.

Does ISO/IEC 42001 give presumption of conformity under the Act? Not on our sources. Article 40(1) presumes conformity only for harmonised standards whose references are published in the Official Journal, and only with Section 2 of Chapter III or, as applicable, Chapter V, Sections 2 and 3, to the extent they cover them. Neither pinned act names ISO/IEC 42001, and we hold no Official Journal reference for it.

Can our ISO/IEC 42001 management system be our Article 17 quality management system? It can hold it, if it covers all thirteen aspects of Article 17(1) in written policies, procedures and instructions. Name 42001 under point (e) and write how each Section 2 requirement it does not reach is met. Article 17(3) is no shortcut here: it covers quality management systems kept under sectoral Union law, not voluntary standards.

Does ISO/IEC 42001 tell us whether a system is high-risk? No. Article 6 decides that: paragraph 1 for safety components and products under Annex I legislation that need a third-party conformity assessment, paragraph 2 for the uses in Annex III, subject to the Article 6(3) derogation, which never covers profiling of natural persons. Classify each system against the Act's text, whatever certificate you hold.

Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 2(2), Article 3, points (20), (24) and (27), Article 4, Article 6, Article 9, Article 16, Article 17, Article 25(1), Article 26(5), Article 40, Article 41, Article 42, Article 43, Article 47, Article 48, Article 72, Article 111(2), Article 113, Annex I, Annex III, Annex VI and Annex VII; as amended by Regulation (EU) 2026/1744 (EUR-Lex), which replaced Article 2(2), Article 4, Article 17(2), Article 72(3), Article 111(2) and Article 113, third paragraph, points (a) and (c); inserted Article 6(1a), (1b) and (1c); and added a subparagraph to Article 40(2) and Article 42(3). Article 9, Article 17(1), (3) and (4), Article 40(1), Article 41 and Article 43(1) were not amended.

Articles of Regulation (EU) 2024/1689 named above, on EUR-Lex: Article 42.

Where this question meets the product: EU AI Act compliance software for SMEs. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire. The feature that does this in the app: every live Complipath feature. Tools ranked on it: EU AI Act compliance software compared.