Key takeaways
- The EU AI Act (Regulation (EU) 2024/1689) applies to every company that provides or uses AI systems in the EU, including internal use. If you give employees Copilot, ChatGPT, or Claude, you are a deployer within the meaning of Art. 3(4) AI Act.
- ISO/IEC 42001 is a voluntary, certifiable standard for an AI management system (AIMS) with 38 controls in nine areas in Annex A. It only becomes binding when customers or tenders require it.
- An ISO 42001 certification does not prove conformity with the AI Act, because ISO/IEC 42001 is not a harmonized standard. Since October 14, 2026, however, the reference of EN 18286 has been published in the Official Journal as a harmonized standard for the quality management system under Art. 17 AI Act.
- Prohibitions and AI literacy have applied since February 2, 2025, and transparency obligations since August 2, 2026. Under Regulation (EU) 2026/1744, the high-risk obligations apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I).
- With an existing ISMS under ISO/IEC 27001, ISO 42001 certification is realistic in as little as 1 to 3 months; without one, in as little as 4 to 6 months. These are lower bounds, not averages.
Does the EU AI Act, ISO 42001, or both apply to us?
The EU AI Act applies to almost every company, while ISO 42001 only applies if you choose it or your customers require it. The AI Act (Regulation (EU) 2024/1689) affects every company that provides or uses AI systems in the EU (Art. 2 AI Act), and that includes internal use. As soon as you make AI tools such as Copilot, ChatGPT, or Claude available to your employees, you are a deployer within the meaning of the AI Act (Art. 3(4) AI Act). You don't need to train your own AI models or sell AI products for that. Our guide to the EU AI Act gives an overview of all obligations and deadlines.
Even if you don't use high-risk AI (Art. 6 AI Act in conjunction with Annex III), the basic obligations of the AI Act apply to you. You must promote the AI literacy of your employees (Art. 4 AI Act) and must not use any prohibited practices under Art. 5 AI Act. If you use chatbots or AI-generated content, you are also subject to transparency obligations (Art. 50 AI Act).
If you use high-risk AI, additional obligations apply from December 2, 2027 (Art. 113 AI Act as amended by Regulation (EU) 2026/1744), such as human oversight, retention of logs, and informing affected workers (Art. 26 AI Act). High-risk systems include those that significantly influence important decisions about people, for example when evaluating job applicants or employees (Annex III point 4 AI Act). In this case, I recommend taking a close look at how your systems are classified. An additional ISO 42001 certification can then make sense to strengthen the trust of customers and employees. Which systems are affected is covered in our article on high-risk AI under the EU AI Act.
There is, however, no obligation to implement ISO/IEC 42001. Customers or tenders can still require the standard as a prerequisite. That makes it a good addition for companies that want or need to demonstrate their AI readiness and the secure use of AI systems to customers and partners.
ISO/IEC 42001 also brings sales advantages, because procurement departments increasingly ask for solid proof of responsible AI use in tenders and supplier assessments. A certificate saves you many supplier questionnaires and earns you a head start on trust, especially since few companies have been certified so far. ISO's annual survey recorded just under 300 valid ISO/IEC 42001 certificates worldwide at the end of 2025, compared with 125,622 valid ISO/IEC 27001 certificates in the same period, as ISO's survey shows.
How does the EU AI Act differ from ISO/IEC 42001?
The AI Act is an EU law. It specifies which AI applications are prohibited and which obligations a company has depending on its role and risk. ISO/IEC 42001, on the other hand, is a voluntary, certifiable standard that describes how a company manages its use of AI responsibly.
But the two frameworks differ in more than their legal status. The AI Act is structured like a product regulation. It asks which AI system is used for which use case and which role the company takes on: provider, deployer, importer, or distributor. That determines the obligations.
A common misconception: you don't have to develop your own model to be a provider. A SaaS company that integrates an existing model into its product via API and sells it under its own name becomes the provider of the AI system (Art. 3(3) AI Act). The model manufacturer remains responsible for the model itself (Art. 53 AI Act).
ISO/IEC 42001, in contrast, focuses on companies and processes. The main question is not whether a system or use case is permitted. What matters is whether the company has defined processes to identify, assess, and treat the risks from both developing and using AI. What gets audited is not an individual system but a complete, operational AIMS (Artificial Intelligence Management System), analogous to the ISMS in ISO/IEC 27001. The basic structure also mirrors ISO/IEC 27001: Clauses 4 to 10 set the requirements for the management system, and Annex A contains 38 controls in nine areas.
Unlike ISO/IEC 42001, the AI Act also sets rules for general-purpose AI models (Art. 51 et seq. AI Act), which mainly concern the model manufacturers. The following table shows the most important differences between the law and the standard.
| Aspect | EU AI Act (Regulation (EU) 2024/1689) | ISO/IEC 42001:2023 |
|---|---|---|
| Mandatory or good practice? | Mandatory for everyone within its scope | Voluntary good practice; binding only if customers require it contractually |
| Legal nature | EU regulation: applies directly in all Member States without transposition into national law; obligations apply in stages (Art. 113 AI Act), see "Timing" | International standard by ISO and IEC; German version DIN EN ISO/IEC 42001 |
| Approach | Product- and role-based: obligations depend on the individual AI system, its risk, and the company's role (provider, deployer, importer, distributor) | Organization-based: a management system for AI (AIMS) that governs AI activities within a scope the company defines itself (Clause 4.3), based on the role it determines for itself under Clause 4.1 (e.g. AI provider, AI producer, AI user) |
| Who does it affect? | Providers that place AI systems or general-purpose AI models on the EU market, wherever they are based; deployers based in the EU; providers and deployers outside the EU whose AI output is used in the EU; also importers, distributors, product manufacturers, and authorized representatives (Art. 2(1) AI Act) | Any company worldwide that develops, provides, or uses AI and chooses to adopt it; the company defines the scope itself |
| Approach to risk | Risk classes defined by law: prohibited (Art. 5), high-risk (Art. 6, Annexes I and III), transparency obligations (Art. 50), minimal risk | The company sets its own criteria and assesses AI risks and the impacts on affected persons itself (Clauses 6.1.2 to 6.1.4) |
| Content | Prohibitions (Art. 5), AI literacy (Art. 4), requirements for high-risk AI (Art. 8 to 27), transparency (Art. 50), general-purpose AI models (Art. 51 et seq.) | Management system requirements in Clauses 4 to 10 (context of the organization, leadership, planning, support, operation, performance evaluation, improvement) and 38 controls in Annex A |
| Documentation | Content partly fixed, e.g. technical documentation under Annex IV (Art. 11) and retention of logs by deployers for at least six months (Art. 26(6)) | Scope largely determined by the company; mandatory items include the AI policy, risk assessments, impact assessments, and the Statement of Applicability |
| Proof of conformity | Depending on the system: no formal proof, or conformity assessment (Art. 43) with EU declaration of conformity (Art. 47) and CE marking (Art. 48) | Certificate from an accredited certification body, valid for three years, with annual surveillance audits |
| Who audits? | Government market surveillance authorities, ad hoc or through spot checks (Art. 74); for certain high-risk systems, a notified body in advance (Art. 43) | Certification body: Stage 1 (documents) and Stage 2 (effectiveness), followed by annual surveillance audits and recertification after three years; plus the company's own internal audits (Clause 9.2) |
| Registration | Providers of high-risk AI under Annex III register themselves and their system in the EU database before placing it on the market (Art. 49(1), Art. 71). Providers that classify an Annex III system as not high-risk under Art. 6(3) must also register it, with fewer details since the Digital Omnibus on AI (Art. 49(2), Annex VIII). Deployers only register if they are public authorities or bodies (Art. 49(3)); private companies acting as deployers register nothing. | No registration obligation. Certificates are usually listed in the certification body's register, sometimes also voluntarily in international databases such as IAF CertSearch |
| Reporting obligations | Providers of high-risk AI report serious incidents to the market surveillance authority within 15 days at the latest, within 10 days in the event of death, and within 2 days for widespread infringements or serious disruption of critical infrastructure (Art. 73). Deployers inform the provider and the authority if they identify a risk or a serious incident (Art. 26(5)) | No obligation to report to authorities. The company must, however, define how it communicates incidents to users and other affected parties (Annex A.8.4) and how external parties can report issues (A.8.3) |
| Timing | In stages: prohibitions and AI literacy since February 2, 2025; general-purpose AI models since August 2, 2025; transparency since August 2, 2026 (grace period for marking under Art. 50(2) for systems already on the market until December 2, 2026); high-risk under Annex III from December 2, 2027 and under Annex I from August 2, 2028 (Regulation (EU) 2026/1744) | At any time; the company sets its own schedule |
| Consequences of infringements | Fines of up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for other obligations; for SMEs, the lower amount applies in each case (Art. 99) | No fine; nonconformities found in the audit must be corrected, and in the worst case the certificate is suspended or withdrawn |
Does an ISO 42001 certification prove conformity with the EU AI Act?
No, because ISO/IEC 42001 is not a harmonized standard. Harmonized standards are developed at the request of the European Commission, and their references are published in the Official Journal of the EU. Anyone who complies with them benefits from the presumption of conformity: the legal requirements covered by the standard are presumed to be met (Art. 40(1) AI Act).
That applies neither to ISO/IEC 42001 nor to its German version DIN EN ISO/IEC 42001:2026-08. For the quality management system that providers of high-risk AI systems must establish (Art. 17 AI Act), there is now a harmonized standard: EN 18286:2026. The European Commission requested it (Implementing Decision C(2025) 3871), and CEN and CENELEC developed it. After a revision, it was adopted in July 2026. Its reference was published in the Official Journal on October 14, 2026, as Implementing Decision (EU) 2026/2274 records.
Since then, EN 18286 has given rise to a presumption of conformity for the requirements it covers, mainly the quality management system under Art. 17 AI Act, but not for the AI Act as a whole. Further standards for specific requirements of the Act are still in progress as of October 21, 2026. EN 18286 is not a replacement for ISO/IEC 42001 either: it governs a provider's quality management system for a defined set of AI systems, mainly high-risk ones, whereas ISO/IEC 42001 governs the use of AI across the entire company (EN 18286, Clause 1; ISO/IEC 42001, Clause 1). The obligations under Art. 17 AI Act themselves only apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I).
ISO/IEC 42001 still covers a large share of the AI Act's organizational obligations. Many legal requirements presuppose processes the standard requires anyway: roles and responsibilities, risk assessments, documentation, training, monitoring, and supplier management. An auditor can audit and certify these processes. The AI inventory the standard requires is also a good basis for classifying your systems under the AI Act. All of this makes it easier to provide evidence, but it does not replace proof of conformity.
Note: Beware of providers who offer certificates for the AI Act. Such certificates do not exist, as no harmonized standard covers the Regulation as a whole. Audits or certificates against EN 18286 only concern the quality management system and replace neither the conformity assessment (Art. 43 AI Act) nor the CE marking (Art. 48 AI Act).
The following table shows which AI Act obligations ISO/IEC 42001 helps with and where it doesn't.
| AI Act obligation | Mainly affects | Does ISO 42001 help? | Why |
|---|---|---|---|
| AI literacy (Art. 4) | Providers and deployers | Largely | Competence and awareness are requirements of the standard (Clauses 7.2, 7.3) |
| Prohibited practices (Art. 5) | Providers and deployers | Hardly | The standard assesses impacts on individuals (A.5), but whether a practice is prohibited needs a legal check |
| Classification as high-risk (Art. 6, Annex III) | Providers and deployers | Partially | AI inventory and intended purpose (4.3, A.9.4) provide the basis; the classification follows the law |
| Responsibilities along the AI value chain (Art. 25) | Providers and deployers | Partially | The standard clarifies responsibilities with suppliers and customers (A.10); when you become a provider yourself is governed by the law |
| Obligations of deployers (Art. 26) | Deployers of high-risk AI | Largely | Intended purpose, human oversight, monitoring, and logs are covered (A.3.2, A.6.2.6, A.6.2.8, A.9.4); deadlines such as six months' retention must be added |
| Requirements for high-risk AI (Art. 9 to 15) | Providers of high-risk AI | Partially | Risk management, data, documentation, and testing are covered in the standard (6.1, A.6, A.7), but the law sets considerably more specific requirements |
| Quality management (Art. 17) | Providers of high-risk AI | Partially | The management system is in place, but product-related procedures are missing; EN 18286 covers these (presumption of conformity since October 14, 2026) |
| Conformity assessment, CE, registration (Art. 43, 48, 49) | Providers of high-risk AI | No | Purely regulatory steps; the certificate does not replace them |
| Transparency obligations (Art. 50) | Providers and deployers | Hardly | Specific labeling obligations for chatbots and AI-generated content come solely from the law |
Who is an ISO 42001 certification worth it for?
In my experience, ISO/IEC 42001 is worth it above all if you sell AI software or products with AI features. That applies especially to B2B SaaS companies that need to demonstrate trustworthiness in tenders and supplier assessments.
For deployers that use AI mainly internally rather than in their products, an AIMS of their own pays off when several teams use AI and there are no established processes for new use cases yet. Instead of assessing each AI use individually, the AIMS lets you define a clear process from the first idea to ongoing operation, which is independently audited and certified.
If you only use a single AI tool internally, you usually do not need a certificate. In that case, meeting the legal obligations is enough: an AI policy, training, and an AI inventory. How to go about it is covered in our guide How to prepare your business for the EU AI Act.
ISO/IEC 42001 is also relevant for companies that serve or want to expand into markets outside Europe. The AI Act only applies in the EU, whereas ISO certificates are recognized worldwide and are regarded by customers in Asia or the US as a seal of quality for a management system.
The following table helps with your self-assessment.
| Company profile | Typical role (AI Act) | Is ISO 42001 useful? |
|---|---|---|
| Software company or B2B SaaS provider with AI features in the product (e.g. based on a GPT model) | Provider of the AI system | Yes, especially for enterprise customers and tenders |
| Provider of high-risk AI (e.g. applicant selection, creditworthiness) | Provider | Yes, as a foundation for risk and quality management (Art. 9 and Art. 17 AI Act); for Art. 17, apply EN 18286 (harmonized since October 14, 2026) |
| Company with several AI use cases in different teams | Deployer | Worth checking, especially with an existing ISMS; often little extra effort and a sales argument |
| Deployer of high-risk AI (e.g. a provider's AI recruiting tool) | Deployer | Helpful for Art. 26, but not a must |
| Company that only uses a single AI tool internally (e.g. only Copilot or ChatGPT with no product link) | Deployer | Mostly no; an AI policy, training, and an AI inventory are enough |
We already have ISO 27001. How much are we missing for ISO 42001?
Less than many expect. Clauses 4 to 10 of both standards follow ISO's harmonized structure for management systems, share the same headings, and often have the same core text. You can therefore adopt the framework of your existing management system almost completely. The main additions are the AI-specific risk and impact assessment and the controls for data and the life cycle of AI systems.
ISO/IEC 27001 protects information mainly through the objectives of confidentiality, integrity, and availability. ISO/IEC 42001 also considers how an AI system affects people and society, for example through discrimination, lack of traceability, or wrong decisions. That is what the AI system impact assessment is for (ISO/IEC 42001, Clause 6.1.4; Annex A.5).
B2B SaaS providers mainly need the controls for development, data, and documentation (Annex A.6 and A.7). Deployers focus on responsible use and supplier management (Annex A.9 and A.10). Deployers can exclude controls that are only relevant to developing AI systems in the Statement of Applicability, with justification (Clause 6.1.3).
Many certification bodies offer combined audits for ISO/IEC 27001 and ISO/IEC 42001, provided they are accredited for both standards. That saves time in certification and the audit. How a certification audit with Stage 1 and Stage 2 works is explained in our article on ISMS certification under ISO 27001.
How long does an ISO 42001 certification take?
With an existing ISMS under ISO/IEC 27001, implementation through to certification is realistic in as little as 1 to 3 months; without an existing ISMS, in as little as 4 to 6 months. These figures assume full support within the company and are lower bounds, not averages.
| Phase | With ISMS under ISO/IEC 27001 | Without ISMS | Typical delay |
|---|---|---|---|
| 1 to 3: AI inventory and scope, gap analysis against Clauses 4 to 10 and Annex A, implementation (AI policy, risk assessment, AI system impact assessment, Statement of Applicability, training) | from under 1 to 2 months | from 3 to 4 months | Shadow AI, meaning AI tools in operational use that no one has recorded so far; uncertainty about which documents can be adopted from the existing management system; missing training and policy acknowledgments; alignment with product development and data protection |
| 4: Internal audit, management review (Clauses 9.2, 9.3), and certification audit Stage 1 and 2 | 1 month | 1 to 2 months | Availability of auditors |
| Total | from 1 to 3 months | from 4 to 6 months |
Shadow AI, adapting policies, and AI-specific training in particular often take longer than planned. The availability of certification bodies accredited for ISO/IEC 42001 can also delay the project plan. If you don't have a management system yet, our article on building an ISMS covers the basics.
How does Kertos help with ISO 42001 and the EU AI Act?
Kertos combines a compliance platform with support from experienced experts. On the Kertos platform, you manage ISO/IEC 42001 alongside ISO/IEC 27001, so shared requirements from Clauses 4 to 10 and existing evidence don't have to be maintained twice. Risk assessments, policies, training, and supplier management run in the same system.
Kertos is itself ISO/IEC 42001 certified and knows the standard's requirements from its own audit. How Kertos puts AI governance into practice internally is described in the article Kertos achieves ISO 42001 certification.
If you want to clarify whether ISO/IEC 42001 makes sense for your company and how to cover the AI Act's obligations along the way, book a Kertos demo and discuss your use case with our experienced experts.
Frequently asked questions
Is ISO 42001 mandatory?
No. ISO/IEC 42001 is a voluntary standard. It only becomes binding if a customer requires it contractually or a tender makes it a prerequisite. The EU AI Act, by contrast, applies regardless to every company that provides or uses AI systems in the EU.
Do we have to develop our own AI models to be a provider?
No. Anyone who integrates a third-party model, for example via an API, into their own product and offers it under their own name is also a provider (Art. 3(3) AI Act). The model manufacturer remains responsible for the model itself (Art. 53 AI Act).
Does ISO 42001 replace the conformity assessment for high-risk AI?
No (Art. 43 AI Act). EN 18286 does not replace it either, but it makes it easier to demonstrate that the quality management system meets the requirements of Art. 17 AI Act. The quality management system is examined as part of the conformity assessment (Art. 43, Annexes VI and VII AI Act).
Do we need ISO 42001 if we only use Copilot or ChatGPT?
Usually not. The AI Act's obligations still apply, in particular promoting AI literacy (Art. 4) and the prohibitions (Art. 5). For most companies in this position, an AI policy, training, and an AI inventory are enough.
Can we combine ISO 27001 and ISO 42001 in one audit?
Yes, as an integrated management system, if the certification body is accredited for both standards. Because both standards share the same structure in Clauses 4 to 10, you save time in preparation and in the audit.
What is the Digital Omnibus on AI and what does it change?
The Digital Omnibus is an amending regulation to the AI Act (Regulation (EU) 2026/1744), in force since July 27, 2026. It postpones the high-risk obligations (Annex III to December 2, 2027, Annex I to August 2, 2028), weakens the AI literacy obligation to a duty to promote it, and removes AI in machinery from the direct scope of the high-risk rules. Prohibitions, transparency obligations, and rules for AI models keep their known dates; for marking AI-generated content under Art. 50(2), systems already on the market have a grace period until December 2, 2026.
