ISO/IEC 42001 ISO/IEC 42001 vs EU AI Act

EN 18286:2026 was cited in the Official Journal on 14 October 2026 by Implementing Decision (EU) 2026/2274. Conformity with its relevant normative clauses supports a presumption of conformity only for the requirements they cover. Annex ZA maps Article 17(1) and the first sentence of Article 11(1), subject to conditions: document Article 17(1)(a)-(m), include all Annex IV elements in technical documentation, and use an Article 9-compliant risk-management system. Article 17(2)-(4) remain outside its coverage.

Existing ISO/IEC 42001 processes can supply shared procedures and records after a requirement-by-requirement check. EN 18286 Annex C gives informative clause correspondence with EN ISO/IEC 42001:2026; it does not establish equivalence of requirements or concepts. An ISO/IEC 42001:2023 certificate alone proves neither EN 18286 conformity nor whole-Act compliance.

For each shared record, identify the system version, ISO clause, EN 18286 clause, Annex ZA condition, legal requirement, evidence owner and remaining gap. Keep the Article 43 route decision and system-level Section 2 evidence separate from management-system certification. The citation does not change application dates. Use the harmonised standards and quality-management guide for the procedure-to-evidence map.

Start with the EU AI Act. Determine territorial scope, the organisation's operator role, and whether the regulated object is an AI system or a general-purpose AI model. Then test prohibited practices, transparency duties, general-purpose AI model duties, and high-risk status. High-risk examples can include systems used for recruitment, education access, creditworthiness, essential public benefits, certain biometric uses, critical infrastructure, law enforcement, migration, and justice, but Article 6, Annex I or III, and any exclusion or qualification control the result for the specific system.

Run the ISO/IEC 42001 analysis separately. Define the AIMS boundary, the organisation's roles in relation to AI systems, relevant interested-party requirements, risk criteria, risk assessment and treatment, impact assessment, controls, monitoring, internal audit, management review, and improvement.

Use both when the organisation wants an auditable management system and also falls within the Act. A shared inventory and shared evidence repository can reduce duplicate work, but every reused record must still satisfy the specific legal provision and the specific AIMS requirement.

For ISO/IEC 42001, retain the documented AIMS scope, AI policy, role assignments, risk criteria, risk assessments, treatment plans, statement of applicability, impact assessments, operating controls, monitoring results, internal-audit records, management-review outputs, and corrective actions.

For the AI Act, the required evidence depends on the role and provision. A high-risk-system provider may need a risk-management system, data-governance records, technical documentation, logs, instructions for use, human-oversight design, accuracy and cybersecurity evidence, a quality-management system, conformity documentation, registration, post-market monitoring, and serious-incident records. Deployers, importers, distributors, product manufacturers, authorised representatives, and general-purpose AI model providers have different records.

A record can serve both sets only when its scope, system version, actor, acceptance criteria, approval, retention period, and review trigger fit both requirements. Certification evidence alone does not prove that a legal duty has been met.

Give every AI system and general-purpose AI model a stable identifier. Use it to link the legal applicability record, the AIMS inventory entry, risk and impact assessments, controls, tests, supplier evidence, incidents, and review decisions without merging their conclusions.

Reopen the analysis when the intended purpose, operator role, model or system version, deployment geography, supplier, data, affected population, or legal classification changes. A scheduled AIMS audit is not a substitute for a legal change trigger or statutory deadline.

Do not claim that ISO/IEC 42001 certification equals AI Act compliance, that it is currently the Act's harmonised quality-management-system standard, or that it creates a presumption of conformity. Under Article 40, that presumption depends on compliance with harmonised standards whose references are published in the Official Journal, and only to the extent that those standards cover the relevant requirements.

Do not import an AIMS role into the Act, use an organisational risk rating as the Act's legal classification, or treat an internal audit as the required conformity assessment. Also avoid describing every AI system as high-risk: the result depends on Article 6, Annex I or III, and any applicable exclusion or qualification.

The Act entered into force on 1 August 2024 and applies in stages. Chapters I and II applied from 2 February 2025, except the newly added Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b), which apply from 2 December 2026. The provisions listed in Article 113(3)(b), including Chapter V on general-purpose AI models and most penalty provisions, applied from 2 August 2025. Regulation (EU) 2026/1744 entered into force on 27 July 2026. Amended Article 113 delays Chapter III Sections 1-3, except Article 6(5), to 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems. Keep the exact scope of that postponement separate from other provisions.

Article 111 contains additional transition rules for existing systems and models, including a 2 August 2027 compliance deadline for providers of general-purpose AI models placed on the market before 2 August 2025. The amended Article 111(4) gives providers of systems generating synthetic audio, image, video, or text placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2). Record the exact provision, system or model placement date, and transition rule used for each conclusion.