sets requirements for an organisation's AI management system: its policies, responsibilities, risk processes and improvement work. The EU AI Act sets binding duties for covered AI systems and general-purpose AI (GPAI) models. A management-system certificate can support your evidence; each system and model still needs its own legal classification and applicable compliance steps.
Side-by-side comparison
EU AI Act and ISO/IEC 42001 compared
Compare legal scope, management responsibilities and evidence before reusing a record.
Covers systems and GPAI models placed on the EU market, put into service or used in the EU, and covered overseas activity whose outputs are used in the EU. Check exclusions.
Explains that legal presumption of conformity is tied to European harmonised standards published in the Official Journal, not to any management-system standard by default.
High-risk providers need risk and data management, technical records, logs, user information, oversight, accuracy, robustness, security, quality management and applicable conformity, registration, monitoring and incident steps.
Commission FAQ distinguishing ISO management-system assurance from AI Act provider duties and explaining harmonised-standard presumption of conformity; the later decision controls EN 18286 citation status.
System/model records include role and risk classification, annex basis or exception, prohibition checks, technical files, logs, instructions, FRIA where applicable, registration, declarations, notices, monitoring, incidents and GPAI documentation.
Commission source for high-risk provider evidence steps such as documentation, conformity assessment, database registration, declaration, CE marking, and post-market monitoring.
Explains system risk through prohibited, high-risk, transparency and minimal/no-risk uses. Annex I and III determine high-risk status. GPAI model duties are separate; transparency can overlap high-risk duties.
Primary legal source for AI Act enforcement and penalties.
Penalties
Uses internal audits, management reviews, corrective action, customer checks, contracts and optional external assessment. It creates no AI Act penalty.
Use it to check prohibited uses, high-risk classification, operator roles, GPAI duties, notices, assessment routes and evidence required by authorities.
Commission source for the practical AI Act questions around risk tiers, high-risk steps, transparency, and GPAI.
risk-based rules
Use it to check whether scope, policy, roles, risk criteria, controls, monitoring, audits, reviews and improvement processes are defined and maintained.
Official ISO source supporting the separate management-system evidence boundary.
Artificial intelligence — Management system
Scope
EU AI Act
Covers systems and GPAI models placed on the EU market, put into service or used in the EU, and covered overseas activity whose outputs are used in the EU. Check exclusions.
Explains that legal presumption of conformity is tied to European harmonised standards published in the Official Journal, not to any management-system standard by default.
legal presumption of conformity
Core work
EU AI Act
High-risk providers need risk and data management, technical records, logs, user information, oversight, accuracy, robustness, security, quality management and applicable conformity, registration, monitoring and incident steps.
Commission FAQ distinguishing ISO management-system assurance from AI Act provider duties and explaining harmonised-standard presumption of conformity; the later decision controls EN 18286 citation status.
Supports a separate Article 17 gap assessment rather than treating ISO/IEC 42001 assurance as AI Act conformity.
Evidence
EU AI Act
System/model records include role and risk classification, annex basis or exception, prohibition checks, technical files, logs, instructions, FRIA where applicable, registration, declarations, notices, monitoring, incidents and GPAI documentation.
Commission source for high-risk provider evidence steps such as documentation, conformity assessment, database registration, declaration, CE marking, and post-market monitoring.
detailed documentation
Risk classification
EU AI Act
Explains system risk through prohibited, high-risk, transparency and minimal/no-risk uses. Annex I and III determine high-risk status. GPAI model duties are separate; transparency can overlap high-risk duties.
Primary legal source for AI Act enforcement and penalties.
Penalties
ISO/IEC 42001
Uses internal audits, management reviews, corrective action, customer checks, contracts and optional external assessment. It creates no AI Act penalty.
Source for treating AI Act standards and international AI standards as related but not interchangeable.
not captured in any of these activities
When to use each
EU AI Act
Use it to check prohibited uses, high-risk classification, operator roles, GPAI duties, notices, assessment routes and evidence required by authorities.
Commission source for the practical AI Act questions around risk tiers, high-risk steps, transparency, and GPAI.
risk-based rules
ISO/IEC 42001
Use it to check whether scope, policy, roles, risk criteria, controls, monitoring, audits, reviews and improvement processes are defined and maintained.
Official ISO source supporting the separate management-system evidence boundary.
Artificial intelligence — Management system
Practical decision rule
How to use both
Run policy, scope, objectives, roles, risk reviews, impact assessments, operations, suppliers, monitoring, audits, management reviews and corrective action through the ISO management system.
Decide legal classification, duties, conformity, registration, disclosures, incidents and enforcement using the AI Act.
For a high-risk provider, compare Article 17 and EN 18286 with existing ISO processes. Record coverage conditions and gaps.
For each system or model, link existing ISO evidence to the exact legal duty and identify missing records.
Limit certificate and audit claims to the management-system scope they actually assess.
Commission FAQ distinguishing ISO management-system assurance from AI Act provider duties and explaining harmonised-standard presumption of conformity; the later decision controls EN 18286 citation status.
1
Section 1
Start with two separate scope decisions
For the AI Act, identify the system or GPAI model, EU activity, legal role and applicable duties. Screen prohibited practices, high-risk status and Article 50 transparency separately. GPAI models have their own rules; they are not another system risk category.
For ISO/IEC 42001, define the organisation, business units, products, services, systems, roles, interested parties and processes inside the management-system scope. Interested parties are people or organisations with relevant needs or requirements.
Article 17 requires a documented quality management system for each high-risk provider's regulatory procedures and controls. ISO/IEC 42001 covers the organisation's broader AI management system. EN 18286 addresses the provider requirements within its citation's coverage.
Keep the standard edition and legal dates in your requirement map. Regulation (EU) 2026/1744 was published on 24 July and entered into force on 27 July 2026. It kept general application on 2 August 2026. Chapter III Sections 1-3, except Article 6(5), apply on 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Article 6(1) product-linked systems.
Do not label an AI system compliant with the AI Act merely because an organisation has ISO/IEC 42001 controls.
Use ISO/IEC 42001 to structure AI policy, risk criteria, lifecycle controls, supplier controls, audits, management review, nonconformity, and continual improvement.
Keep AI Act evidence tied to the exact legal duty: role, risk tier, article, annex, conformity route, registration item, disclosure, incident report, or GPAI obligation.
Label shared records with the AI Act duty and the ISO clause or control they support.
Commission FAQ distinguishing ISO management-system assurance from AI Act provider duties and explaining harmonised-standard presumption of conformity; the later decision controls EN 18286 citation status.
Commission implementation page confirming that the final AI Omnibus enters into force in July 2026 and reporting the revised high-risk application dates.
Binding amendment supporting the 27 July 2026 entry into force and the revised Chapter III application dates.
2
Section 2
Reuse the management work and check the legal gaps
Use ISO/IEC 42001 to set policy, assign responsibilities, assess AI risks and impacts, manage operations and suppliers, maintain records, audit and improve. Its management-system scope determines what the implementation or certificate covers.
High-risk providers still need the applicable AI Act technical documentation, Article 17 quality management, conformity assessment, declaration, CE marking, registration, monitoring and incident handling. Check each requirement's scope, including amended Article 2(2) treatment of Annex I Section B products.
GPAI providers separately need model documentation, integration information, a copyright policy and public training summary. Models with systemic risk add assessment, mitigation, incident, testing and cybersecurity records. Check the limited Article 53(2) open-source documentation exception where relevant.
Review any certificate's entities, locations, scope and exclusions. The statement of applicability records selected controls and the reasons for inclusions or exclusions. An excluded ISO control cannot remove a legal duty; a selected control needs evidence showing how it worked for the relevant system.
Use ISO/IEC 42001 to run governance and maintain evidence. Check legal applicability and compliance against the AI Act.
Use the AI Act to decide whether a model or system can be placed on the EU market, put into service, deployed, registered, labelled, or kept in operation.
Treat an AI Act harmonised standard separately from ISO/IEC 42001. A presumption of conformity depends on the relevant harmonised standard being referenced in the Official Journal and applies only to the legal requirements its reference covers.
For vendor assurance, ask both questions: what is inside the supplier's ISO/IEC 42001 scope, and what AI Act role and risk obligations apply to the supplied AI system or GPAI model?
Official ISO source identifying the current edition as ISO/IEC 42001:2023 and the management-system standard containing the scope, control-selection, and statement-of-applicability requirements discussed here.
Commission FAQ distinguishing ISO/IEC 42001:2023 from the quality management system required by Article 17 and explaining the Official Journal condition for presumption of conformity.
3
Section 3
How the cited quality-management standard fits
EN 18286:2026 is a provider quality-management standard cited in the Official Journal on 14 October 2026 by Decision (EU) 2026/2274. Conformity with relevant clauses supports a presumption of conformity, a legal assumption limited to the requirements those clauses cover.
Annex ZA maps Article 17(1) and the first sentence of Article 11(1), with conditions: document Article 17(1)(a)-(m), include every Annex IV technical-documentation element and use Article 9-compliant risk management. Article 17(2)-(4) is outside the coverage.
Reuse ISO/IEC 42001 procedures after checking each requirement. EN 18286 Annex C gives an informative correspondence with EN ISO/IEC 42001:2026; it does not establish equivalence. An certificate alone proves neither EN 18286 conformity nor whole-Act compliance.
For shared records, identify the system version, ISO clause, EN 18286 clause, Annex ZA condition, legal requirement, owner and remaining gap. Keep the Article 43 assessment-route decision and system-level high-risk evidence separate from management-system certification. The standards citation leaves application dates unchanged.
Official publication announcement for the provider QMS standard; the later decision controls citation status.
4
Section 4
Build one inventory with separate conclusions
One inventory can hold intended use, legal role, supplier, users, geography, data, lifecycle stage, controls, notices, logs and owner. Keep separate fields for the AI Act conclusion and ISO/IEC 42001 conclusion.
An ISO audit checks the management system within its scope. For a specific system or model, separately verify the assessment route, any Annex III exception, GPAI information supplied and Article 50 notices shown to people.
For every legal duty, name the supporting ISO clause or Annex A control, shared record, missing legal fields, legal owner, management-system owner and review trigger. Inspect the procedure and evidence before marking it complete.
Operational example: reuse an internal-audit schedule, then attach the high-risk system version, Article 17 process, findings, corrective-action owner and closure evidence. The schedule alone leaves those legal evidence questions unanswered.
AI Act evidence fields: operator role, risk tier, prohibited-practice result, high-risk basis or exception, applicable obligations, technical documentation, conformity route, registration, declaration, CE marking, transparency notice, post-market monitoring, and incident handling.
ISO/IEC 42001 evidence fields: management-system scope, AI policy, interested-party requirements, role assignments, AI objectives, risk criteria, risk assessment, risk treatment, AI system impact assessment, operational controls, monitoring, internal audit, management review, corrective action, and continual improvement.
Shared evidence fields: AI inventory, intended use, lifecycle owner, supplier record, user instructions, logs, test results, human oversight controls, change history, security controls, data-quality controls, and management approvals.
Boundary field: the legal or assurance question each evidence item answers, so later reviewers do not infer one framework's conclusion from the other's paperwork.
Primary legal text for high-risk AI documentation, conformity, registration, declaration, post-market, GPAI, transparency, and penalty evidence boundaries.
Official ISO catalogue source for ISO/IEC 42001 as the AI management-system comparator.
Official ISO catalogue source for the ISO/IEC 42001 AI management-system standard.
Official ISO source identifying the current edition as ISO/IEC 42001:2023 and the management-system standard containing the scope, control-selection, and statement-of-applicability requirements discussed here.
Show 13 more
Official ISO catalogue source for the AI management-system standard used to organise governance and assurance records.
Official ISO source for treating ISO/IEC 42001 as an organisational AI management-system scope, not a product-law scope.
Official ISO catalogue source for the organisational management-system comparator.
Official ISO catalogue source identifying ISO/IEC 42001 as an artificial intelligence management-system standard.
Official ISO source for management-system controls that can support high-risk governance evidence.
Official ISO source for the edition, organisational scope, and management-system purpose of ISO/IEC 42001:2023.
Official ISO source for ISO/IEC 42001 management-system evidence concepts.
Official ISO source for ISO/IEC 42001 as the AI management-system framework used for organisational risk processes.
Official ISO source for management-system assurance context.
Official ISO source for using ISO/IEC 42001 to operate AI governance and continual improvement.
Official ISO source for the management-system side of the decision rule.
Official ISO source supporting the separate management-system evidence boundary.
Official ISO source for the management-system comparator and its governance role.
Primary legal source for EU AI Act scope, operator roles, risk-based obligations, high-risk conformity, GPAI, transparency, enforcement, and penalties.
Legal source for AI Act operator roles, risk-based obligations, high-risk conformity evidence, GPAI duties, transparency duties, and penalties.
Primary legal text for high-risk AI documentation, conformity, registration, declaration, post-market, GPAI, transparency, and penalty evidence boundaries.
Show 12 more
Legal source for AI Act territorial, market, use, and output-scope analysis.
Supports keeping AI Act operator and product/model facts separate from management-system scope.
Primary source for AI Act operator roles and role-specific obligations.
Primary legal source showing the AI Act is the binding regulation being compared.
Primary legal source for high-risk AI requirements, quality management, conformity assessment, registration, and post-market evidence.
Article 17 is the binding source for the required elements of a high-risk AI system provider's quality management system.
Primary legal source for AI Act technical documentation, registration, conformity, post-market, incident, and GPAI evidence requirements.
Primary legal source for high-risk classification, including Article 6 and annex-based analysis.
Primary legal source for AI Act enforcement and penalties.
Primary legal source for AI Act governance-heavy obligations such as risk management, quality management, documentation, and post-market monitoring.
Primary legal source supporting the need to keep AI Act legal evidence distinct.
Primary legal source for the AI Act obligations that must remain distinct from management-system assurance.
Commission explainer source for the AI Act risk tiers, high-risk provider process, Article 50-style transparency examples, GPAI rules, and implementation context.
Commission implementation page confirming that the final AI Omnibus enters into force in July 2026 and reporting the revised high-risk application dates.
Commission source for the AI Act risk tiers, high-risk provider steps, transparency duties, GPAI rules, and market-surveillance context.
Show 5 more
Commission source explaining that the Act sets risk-based rules for developers and deployers.
Commission source for high-risk provider evidence steps such as documentation, conformity assessment, database registration, declaration, CE marking, and post-market monitoring.
Commission source for the AI Act risk-based structure and practical high-risk examples.
Commission source for market-surveillance and post-market context after AI systems are on the market.
Commission source for the practical AI Act questions around risk tiers, high-risk steps, transparency, and GPAI.
"risk-based rules for AI developers and deployers"
More quoted passages
"AI developers and deployers"
"detailed documentation"
"4 levels of risk"
"authorities are in charge of market surveillance"
Source for the boundary between AI Act harmonised standards and broader international AI standards: legal presumption of conformity depends on publication in the Official Journal.
Explains that legal presumption of conformity is tied to European harmonised standards published in the Official Journal, not to any management-system standard by default.
Source for the boundary that AI Act standards must address health, safety, and fundamental-rights risks, not only organisational objectives.
Show 2 more
Source for treating AI Act standards and international AI standards as related but not interchangeable.
Source for the distinction between broader standards work and AI Act harmonised standards that can create legal presumption of conformity.
Commission FAQ distinguishing ISO management-system assurance from AI Act provider duties and explaining harmonised-standard presumption of conformity; the later decision controls EN 18286 citation status.
Commission FAQ distinguishing ISO/IEC 42001:2023 from the quality management system required by Article 17 and explaining the Official Journal condition for presumption of conformity.
Supports a separate Article 17 gap assessment rather than treating ISO/IEC 42001 assurance as AI Act conformity.
Commission source for GPAI provider scope guidance, AI Office submission context, and the distinction between legal obligations and voluntary support tools.