ISO 42001 and EU AI Act Compliance: What Actually Overlaps
This page answers one question: if your organisation holds or is pursuing ISO/IEC 42001 certification, how much of the EU AI Act does that cover, and what is still missing. The short answer is that 42001 gives you most of the scaffolding for Article 17 and very little of the system level evidence the Act demands everywhere else.
What ISO/IEC 42001 is
ISO/IEC 42001 is a management system standard for artificial intelligence, published in December 2023. It follows the same harmonised clause structure as ISO 27001: context, leadership, planning, support, operation, performance evaluation, improvement. Annex A sets out a list of controls covering AI policy, internal organisation, resources for AI systems, impact assessment, the AI system lifecycle, data for AI systems, information for interested parties, use of AI systems, and third party relationships. It is certifiable by an accredited certification body on a three year cycle with annual surveillance audits.
Two structural facts matter more than the control list. First, 42001 certifies an organisation, not a product. Second, it is an international standard, not a harmonised European standard. Nothing in it is written against the text of Regulation (EU) 2024/1689.
Where it maps onto the Act
The strongest overlap is Article 17, which requires providers of high-risk AI systems to operate a quality management system and lists what it must contain: a regulatory compliance strategy, design and development control, examination and testing procedures, technical specifications, data management systems, the risk management system under Article 9, post-market monitoring under Article 72, incident reporting under Article 73, communication with authorities, record keeping, resource management and an accountability framework. Article 17(2) says implementation must be proportionate to the size of the provider's organisation. A working 42001 system already produces documented procedures, assigned roles, internal audit, management review and corrective action, which is roughly two thirds of that list in structural terms.
| Act obligation | Provision | 42001 coverage |
|---|---|---|
| Quality management system | Article 17 | High. Clause 4 to 10 plus Annex A map closely. |
| Risk management system | Article 9 | Partial. Process exists, object of protection differs. |
| Data and data governance | Article 10 | Partial. Annex A data controls are generic. |
| Technical documentation | Article 11 and Annex IV | Low. No prescribed content set. |
| Logging | Articles 12 and 19 | Low. No retention rule. |
| Instructions for use | Article 13 | Low. |
| Human oversight design | Article 14 | Low. Oversight is a product property. |
| Post-market monitoring | Article 72 | Partial. No monitoring plan template. |
| Serious incident reporting | Article 73 | Low. No statutory clocks. |
| Conformity assessment, CE marking, registration | Articles 43, 47, 48, 49 | None. |
Provider or deployer
ISO 42001 is role blind. The Act is not. If you develop an AI system and place it on the EU market or put it into service under your own name or trade mark, you are a provider and Chapter III Section 2 applies to you in full. If you use an AI system under your own authority in the course of a professional activity, you are a deployer and your duties sit in Article 26: use the system per the instructions, assign human oversight to competent people, ensure input data is relevant and sufficiently representative where you control it, monitor operation, and keep the automatically generated logs you control for at least six months unless another rule says otherwise.
Most product companies are both, for different systems. A 42001 certificate covering the organisation says nothing about which of your systems fall under Annex III and which role you hold for each one. Article 25 can also turn a deployer into a provider, for example if you put your own name on a third party system or make a substantial modification to a high-risk system. That reclassification is a per system legal event that no certificate addresses.
The gaps certification does not close
- No presumption of conformity. Article 40 grants presumption of conformity only to high-risk systems in conformity with harmonised standards whose references have been published in the Official Journal of the European Union. ISO/IEC 42001 is not such a standard. An auditor's certificate is persuasive evidence of organisational maturity and nothing more.
- Article 9 protects different interests. The Act's risk management system targets risks to health, safety and fundamental rights arising from the intended purpose and from reasonably foreseeable misuse, assessed iteratively across the lifecycle, with residual risk judged acceptable and testing against prior defined metrics. A 42001 risk assessment routinely includes risk to the organisation. You need the narrower, person facing analysis documented separately. See Article 9.
- Article 10 is far more prescriptive than any Annex A control. Training, validation and testing data sets must be relevant, sufficiently representative and, as far as possible, free of errors and complete for the intended purpose. You must document collection processes, data origin, preparation operations, the assumptions the data encodes, availability and quantity, and examination for possible biases, plus measures to detect and correct them.
- Annex IV technical documentation is a fixed content list. General description, development process, design specifications, architecture, computational resources, data requirements, human oversight measures, performance metrics, the risk management system and the post-market monitoring plan. Management system documents do not substitute.
- Logging retention is a hard number. Providers keep logs automatically generated by their high-risk systems for a period appropriate to the intended purpose and at minimum six months, under Article 19.
- Incident clocks are statutory. Article 73 requires reporting a serious incident no later than 15 days after awareness, not later than 2 days for a widespread infringement or serious and irreversible disruption of critical infrastructure, and not later than 10 days in the case of a death.
- Nothing in 42001 touches Article 5, Article 50 or Article 53. Prohibited practices are absolute. Transparency duties for chatbots, synthetic content marking and deepfake disclosure apply regardless of management system maturity. GPAI model providers owe technical documentation, downstream information, a copyright policy and a training content summary.
- Conformity assessment is a separate legal act. Article 43 routes, the EU declaration of conformity under Article 47, CE marking under Article 48 and registration under Article 49 are performed against the Act, by you or a notified body designated under the Act. Your 42001 certification body cannot perform them.
The dates that bind
Article 5 prohibitions have applied since 2 February 2025. Enforcement powers have been live since 2 August 2026, and the Article 53 GPAI duties and Article 50 transparency duties have been enforceable since that date. Standalone Annex III high-risk obligations apply from 2 December 2027, 417 days away, following the Digital Omnibus provisional agreement of May 2026, which is still pending formal adoption. Annex I embedded high-risk obligations apply from 2 August 2028. A 42001 implementation typically runs nine to fifteen months to certification, so a programme started now lands close to the December 2027 line with no margin for the Act specific work layered on top.
What to do
- Produce a system inventory before you produce another management system document. For each AI system, record intended purpose, your role, whether it falls under Annex III or Annex I, and the Member State market it is placed on.
- Run a clause to article crosswalk and treat it as a gap register, not a compliance claim. Map each Annex A control to the specific article it partially evidences, then log what is missing in Act terms, most often Annex IV content, Article 10 data documentation, Article 14 oversight design and Article 12 logging.
- Write the Article 9 risk file as a per system document distinct from your organisational risk register, scoped to health, safety and fundamental rights, with residual risk decisions signed off and test results attached.
- Build the incident pipeline against the 15, 10 and 2 day clocks now, including who declares an incident, who notifies which market surveillance authority, and where the evidence is held. See conformity assessment for the surrounding route.
- Decide your conformity assessment path for each high-risk system and, where a notified body is required, start the conversation this quarter rather than in 2027.
If you are not yet sure which of your systems are high-risk or which role you hold for each, the free screener at https://www.getactcomply.com/check walks through classification and tells you which articles apply before you commit budget to a certification programme.