AI Act Guide
  1. Home
  2. AI Act and other laws
  3. ISO/IEC 42001 and the EU AI Act

AI Act and other laws

ISO/IEC 42001 and the EU AI Act: Why Certification Gives No Presumption of Conformity

ISO/IEC 42001 certification gives no presumption of conformity under the EU AI Act. How EN 18286:2026 bridges to Article 17, and what applies from 2027.

Last updated 4 November 2026 · By the AIActGuide.net Editorial Team · How we fact-check · Print this page

ISO/IEC 42001 certification gives no presumption of conformity under the EU AI Act, because ISO/IEC 42001 is a voluntary management-system standard whose reference is not published in the Official Journal, and the only standard cited so far is EN 18286:2026 (Implementing Decision (EU) 2026/2274 of 12 October 2026).

The AI Act is Regulation (EU) 2024/1689 (OJ L, 2024/1689, 12.7.2024), in force since 1 August 2024 and amended by Regulation (EU) 2026/1744 (OJ L, 2026/1744, 24.7.2026), in force since 27 July 2026. The EU AI Act sets binding rules for AI systems, and a voluntary standard gives a presumption of conformity under it only once cited as a harmonised standard under Article 40(1).

This page compares the two, maps the standard to Articles 9 to 17, 27, 43, 47 and 48, and shows how EN 18286:2026 bridges it to the Article 17 presumption.

Does an ISO/IEC 42001 Certificate Create a Presumption of Conformity?

No: an ISO/IEC 42001 certificate shows that an organisation runs an audited AI management system, but the AI Act attaches the presumption of conformity only to harmonised standards whose references are published in the Official Journal of the European Union (Article 40(1)). A certified provider still has to demonstrate by other means that each high-risk AI system meets the act.

The Commission adds that the standard's goals and definitions are not aligned with the act's quality management system. The overview of the AI Act compared with ISO/IEC 42001 sets the standard beside the GDPR and three other frameworks.

What Article 40(1) Requires: A Reference Published in the Official Journal

Article 40(1) presumes high-risk AI systems and GPAI models to conform with the requirements of Chapter III, Section 2, or, as applicable, Chapter V, Sections 2 and 3, to the extent that they comply with harmonised standards whose references are published in the Official Journal. The presumption reaches only as far as those standards cover the requirements concerned.

Article 3(27) defines a harmonised standard by reference to Article 2(1), point (c), of Regulation (EU) No 1025/2012: a European standard adopted on the basis of a request made by the Commission for the application of Union harmonisation legislation.

The Commission's request is Implementing Decision C(2025) 3871 of 23 June 2025 (mandate M/613) to CEN and Cenelec, covering ten areas, such as risk management, human oversight and cybersecurity; point 9 asks for quality management systems including post-market monitoring. A standard delivered under M/613 becomes one of the harmonised standards only once its reference is published in the Official Journal.

Harmonised standards stay voluntary: providers may comply by other means but must then demonstrate compliance, while a cited standard shifts the burden of proof to the authorities (Commission Q&A of 10 March 2026; recital 6 of Decision (EU) 2026/2274). Common specifications under Article 41 are an exceptional fall-back, and none had been adopted as of 23 October 2026.

The Commission's Position on ISO/IEC 42001 (Q&A Updated 10 March 2026)

The Commission states in its Q&A "Understanding the standardisation of the AI Act" (last updated 10 March 2026) that "although ISO/IEC 42001:2023 helps to set up an AI management system, its goals and definitions are not aligned with the quality management system that is required under the AI Act".

In our reading, "not aligned" means that a provider has to extend an ISO/IEC 42001 system before it meets the act's quality management duties. The Article 17 quality management system adds content of its own, such as serious-incident reporting under Article 73.

EN ISO/IEC 42001:2026: The European Adoption without Annex ZA

EN ISO/IEC 42001:2026 is the European adoption of ISO/IEC 42001:2023 by CEN and CENELEC, approved without any modification, so its content is identical to the international standard. The CEN record assigns it to CEN/CLC/JTC 21, working group 2 (Operational aspects). The European edition runs to 62 pages.

The adoption carries no Annex ZA, the annex in which a European standard states its relationship with an EU act, and its reference is not cited in the Official Journal. Being a European standard alone therefore creates no presumption.

The EU AI Act and ISO/IEC 42001 differ on all eight points that decide what a company must do: legal nature, scope, roles, assessment, presumption, authorities, fines and dates. The act's scope follows its four risk categories, while the standard's scope is an organisation's own management system:

Point EU AI Act (Regulation (EU) 2024/1689 as amended) ISO/IEC 42001:2023
Legal nature Binding regulation, directly applicable; in force 1 August 2024 Voluntary international standard
Scope AI systems and general-purpose AI models: prohibited practices (Art. 5), high-risk systems, transparency (Art. 50), GPAI models (Chapter V) An organisation's AI management system
Roles Six operator roles (Art. 3(8)): provider, product manufacturer, deployer, authorised representative, importer, distributor The organisation running the management system
Assessment Art. 43 routes: internal control (Annex VI), notified body (Annex VII) or the sector procedure for Annex I Section A products; no notified body listed under the AI Act in NANDO as of 24 October 2026 Third-party certification by bodies working under ISO/IEC 42006:2025
Presumption of conformity Harmonised standards cited in the OJ (Art. 40(1)); EN 18286:2026 since 14 October 2026 for the Art. 17 requirements it covers, as the Commission states it None (not cited in the OJ)
Authorities Notifying authority, market surveillance authority and single point of contact per Member State (Art. 70, by 2 August 2025); AI Office, a Commission function, for GPAI models and AI systems under its exclusive competence (Art. 75(1)) None (private certification)
Fines Up to EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher (Art. 99(3)); EUR 15 000 000 or 3 % of total worldwide annual turnover, whichever is higher, for Art. 16 provider duties (Art. 99(4)); SMEs and start-ups the lower amount (Art. 99(6)), SMCs in Art. 99(4) and (5) (Art. 99(6a)); GPAI providers up to 3 % or EUR 15 000 000, whichever is higher (Art. 101) None
Dates Art. 5 points (a), (b) and (c) to (h) since 2 February 2025, points (ba) and (bb) from 2 December 2026; Chapter V since 2 August 2025; general application 2 August 2026; Chapter III Sections 1 to 3 from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) No dates of application

The AI Act is directly applicable in every Member State. The conformity assessment under the AI Act follows the Article 43 routes and ends in an EU declaration of conformity and CE marking.

National competent authorities enforce the act against the operators in the six AI Act roles, and the AI Office, a Commission function under Article 3(47), supervises general-purpose AI models and the AI systems under its exclusive competence (Article 75(1)). ISO/IEC 42001 has no public enforcer.

Article 99(3) to (5) set the maximum fines that national penalty rules must provide for (Article 99(1)), including EUR 15 million or 3 % for breaches of the Article 16 provider duties (Article 99(4)). EU AI Act penalties reach an operator whether or not it holds a certificate.

Regulation (EU) 2026/1744 moved Chapter III Sections 1 to 3 to 2027 and 2028 and left 2 August 2026 as the general date of application. Before 27 July 2026, those rules were set to apply from 2 August 2026 (Annex III) and 2 August 2027 (Annex I).

ISO/IEC 42001 in Brief: A Management System Standard in Clauses 4 to 10 and Annexes A to D

ISO/IEC 42001:2023 is the international standard for an AI management system, prepared by ISO/IEC JTC 1/SC 42 and structured in requirement clauses 4 to 10 plus four annexes. It is the first edition. The four annexes are two normative and two informative ones:

  • Annex A (normative): controls.
  • Annex B (normative): implementation guidance for the controls.
  • Annex C (informative): AI-related organisational objectives and risk sources.
  • Annex D (informative): use of the management system across domains and sectors.

In our analysis, ISO/IEC 42001 describes a management system for an organisation, not requirements for a product, while the AI Act's high-risk requirements attach to each system.

ISO/IEC 42006:2025: Requirements for Bodies That Certify AI Management Systems

ISO/IEC 42006:2025 sets the requirements for bodies that audit and certify AI management systems, the bodies that issue ISO/IEC 42001 certificates. Its title is "Requirements for bodies providing audit and certification of artificial intelligence management systems", edition 1.0, 31 pages.

The European adoption, prEN ISO/IEC 42006, entered the CEN enquiry stage on 6 August 2026, with publication planned for 4 July 2027. Certification under ISO/IEC 42006 does not make a body one of the notified bodies that Articles 28 to 39 of the AI Act govern, and a management-system audit is not an Article 43 conformity assessment.

Where ISO/IEC 42001 Overlaps with Articles 9 to 17, 27, 43, 47 and 48: A Mapping

ISO/IEC 42001 overlaps with the AI Act mainly at the level of the organisation, through the Article 17 quality management system, while Articles 9 to 15, 43, 47 and 48 require evidence for each high-risk AI system. The mapping is our analysis, not an official correspondence:

AI Act provision What the act requires ISO/IEC 42001 element Gap (our analysis)
Art. 17 Quality management system, points (a) to (m), as written policies, procedures and instructions Management system, clauses 4 to 10 Goals and definitions "not aligned" (Commission Q&A)
Art. 9 Risk management system for each high-risk AI system Annex C (objectives and risk sources) Risk management per system across its lifecycle
Art. 10 Data and data governance Annex A controls Data evidence per system; Art. 42(1) presumption for Art. 10(4) where data reflect the specific setting
Arts 12 to 15 Record-keeping, transparency and information to deployers, human oversight, accuracy, robustness and cybersecurity Annex A controls Technical properties shown for each system
Art. 27 Fundamental rights impact assessment by the deployers it names None Assessment of the specific deployment
Arts 43, 47, 48 Conformity assessment, EU declaration of conformity, CE marking Certification under ISO/IEC 42006:2025 Certification is not a conformity assessment
Chapter V Duties of providers of general-purpose AI models (Art. 53) None Model-level duties

The overlap sits in processes, while the act's duties attach to the system: one management system can serve a whole portfolio, but each high-risk AI system needs its own technical documentation, logs and conformity assessment.

Article 17's 13 Aspects against an ISO/IEC 42001 Management System

Article 17(1) requires providers of high-risk AI systems to document a quality management system covering 13 aspects, points (a) to (m), "in a systematic and orderly manner in the form of written policies, procedures and instructions". Article 16, point (c), makes that system a provider duty. The 13 aspects are:

  • (a) Regulatory compliance strategy, including conformity assessment and modifications.
  • (b) Design, design control and design verification.
  • (c) Development, quality control and quality assurance.
  • (d) Examination, test and validation procedures.
  • (e) Technical specifications, including standards.
  • (f) Data management.
  • (g) Risk management (Article 9).
  • (h) Post-market monitoring (Article 72).
  • (i) Serious-incident reporting (Article 73).
  • (j) Communication with authorities, notified bodies, operators and customers.
  • (k) Record-keeping.
  • (l) Resource management, including security of supply.
  • (m) Accountability framework for management and staff.

Point (e) asks for the standards applied and, where harmonised standards are not applied in full or do not cover all Section 2 requirements, the means used. Since 27 July 2026, Article 17(2) makes the system proportionate to the size of the provider's organisation, in particular for an SME, including a start-up, or a small mid-cap.

Providers under sectoral quality management rules may include these aspects in that system (Article 17(3)), and financial institutions meet the duty through Union governance rules, except points (g), (h) and (i) (Article 17(4)). Article 18(1)(b) requires the documentation to be kept for 10 years after placing on the market or putting into service.

Per-System Duties That ISO/IEC 42001 Does Not Cover: Articles 8 to 15, 43 and 47 to 49

Five duties attach to each high-risk AI system rather than to the organisation: the Section 2 requirements of Articles 8 to 15, the Article 43 conformity assessment, the Article 47 EU declaration of conformity, the Article 48 CE marking and the Article 49(1) registration (Article 16, points (a) and (f) to (i)). The requirements for high-risk AI systems apply to each system separately, so an organisation-wide certificate cannot meet them.

The Section 2 requirements and the provider duties of Article 16 apply from 2 December 2027 for Annex III systems (Article 113, third paragraph, point (c)(i)) and from 2 August 2028 for Annex I systems (point (c)(ii)). The classification of high-risk AI systems under Article 6 decides which date applies.

Every Article 43 route assesses the system itself, not the management system alone. Where a route requires a notified body, NANDO listed none under the AI Act as of 24 October 2026.

The Bridge to the Article 17 Presumption: Annex C of the First Cited Standard

EN 18286:2026 "Artificial intelligence - Quality management system for EU AI Act regulatory purposes" is the first and, as of 24 October 2026, only harmonised standard cited under the AI Act, by Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 (OJ L, 2026/2274, 14.10.2026). The decision entered into force on the day of its publication.

As the Commission states it, EN 18286:2026 gives a presumption of conformity for the Article 17 requirements it covers since 14 October 2026. The standard addresses organisations providing AI systems, primarily providers of high-risk AI systems, and is not sector-specific. EN 18286:2026 is designed to sit on an existing ISO/IEC 42001, ISO 9001 or sector system such as ISO 13485.

Annex C of EN 18286:2026 sets out its correspondence with EN ISO/IEC 42001:2026, and Annex B its correspondence with EN ISO 9001:2015. A provider running ISO/IEC 42001 can use Annex C to trace which Article 17 points its system already covers and which it must add.

How One Programme Can Serve Both: Building AI Act Duties on an ISO/IEC 42001 System

One programme can serve both when the ISO/IEC 42001 management system is extended to the 13 Article 17 aspects and fed with the per-system evidence the AI Act requires. The six steps are our synthesis:

  1. Inventory every AI system and fix the AI Act role for each one (Article 3(8)).
  2. Classify each system against Article 5 (points (a), (b) and (c) to (h) since 2 February 2025; points (ba) and (bb) from 2 December 2026), Article 6 with Annex III, Article 50 and Chapter V.
  3. Extend the management system to Article 17(1), points (a) to (m), using the Annex C correspondence, with the point (m) accountability framework in an AI governance framework.
  4. Build per-system evidence for Articles 9 to 15.
  5. Plan the Article 43 route, declaration, CE marking and registration that Article 16, points (f) to (i), require of providers.
  6. Run post-market monitoring (Article 72) and serious-incident reporting (Article 73) through the management-system cycle.

Article 17 binds providers of high-risk AI systems, not deployers. The step-by-step programme for providers and deployers adds the remaining duties, such as Article 4 AI literacy measures.

Article 63 lets SMEs, including start-ups, set up a simplified quality management system, but it grants no exemption from Articles 9 to 15, 72 and 73.

The steps give an orientation on what the act and the standard require; they do not decide whether a specific system is high-risk or whether a given management system meets Article 17.

ISO/IEC 42001 is one of five frameworks the AI Act is compared with on this site, next to the GDPR, the Product Liability Directive, the NIST AI RMF and US AI laws. The overview of ISO/IEC 42001 compared with other frameworks sets all five side by side.

The NIST AI RMF 1.0 (NIST AI 100-1) of 26 January 2023 is a US framework that NIST describes as "intended for voluntary use"; it has no legal effect in the EU.

EN ISO/IEC 23894:2024: Risk Management Guidance That Is Not Harmonised

EN ISO/IEC 23894:2024, published by CEN on 20 February 2024, gives guidance on AI risk management and is not a harmonised standard under the AI Act. It therefore creates no presumption for Article 9.

The risk management standard requested under M/613 is a separate draft, prEN 18228.

GDPR and Product Liability: Separate EU Instruments

The GDPR applies next to the AI Act, which since 27 July 2026 is "without prejudice to Articles 4a and 59" on personal data (Article 2(7)), and an ISO/IEC 42001 certificate changes neither instrument. The comparison AI Act vs GDPR sets out where the two regulations overlap.

Directive (EU) 2024/2853 governs liability for defective products placed on the market or put into service after 9 December 2026; the AI Act has no liability rule.

Articles 4, 17(2), 26, 27, 43 and 63(1) of the AI Act settle how far ISO/IEC 42001 reaches for providers, deployers and SMEs.

Frequently Asked Questions

Is ISO/IEC 42001 mandatory under the EU AI Act?

No: ISO/IEC 42001 is a voluntary standard, and the AI Act requires no management-system certificate. Providers of high-risk AI systems need an Article 17 quality management system, built with or without the standard.

Does an ISO/IEC 42001 certificate replace the Article 43 procedure?

No: Article 43 sets the conformity assessment routes (internal control under Annex VI or a notified body under Annex VII, or the sector procedure for Annex I Section A products), and a certificate from a body working under ISO/IEC 42006 is neither. Conformity assessment under the AI Act examines each high-risk AI system.

Can deployers rely on ISO/IEC 42001 for their Article 26 duties?

Partly: in our reading, an ISO/IEC 42001 system can organise a deployer's measures, but the duties are those of Article 26 (use in line with the instructions, human oversight by competent staff, logs kept for at least six months unless Union or national law provides otherwise), the Article 27 fundamental rights impact assessment for the deployers it names from 2 December 2027, and Article 4 AI literacy measures.

Does ISO/IEC 42001 give SMEs a simpler route under Article 63?

No: the simpler route is the Article 63(1) simplified quality management system for SMEs, including start-ups, without partner or linked enterprises, together with Article 17(2) proportionality. The Commission's guidelines overview (last updated 31 July 2026) lists guidelines on a "Simplified quality management system for SMEs and SMCs" as forthcoming.

Compiled by the AIActGuide.net Editorial Team from the Official Journal texts and the Commission's standardisation Q&A; how we check every statement: methodology.

Sources