Question 1

Does ISO/IEC 42001 certification make an organisation EU AI Act compliant?

Accepted Answer

No. ISO/IEC 42001 is a management-system standard; the EU AI Act is product legislation. Certification provides no presumption of conformity: conformity assessment, CE marking, EU database registration, post-market monitoring and serious-incident reporting all sit outside the standard.

Question 2

Which AI Act obligations does ISO 42001 directly support?

Accepted Answer

Four obligations show high alignment in this crosswalk: risk management (Clause 6.1 → Art. 9), data and data governance (Clause 6.2 + Annex B → Art. 10), transparency and information to deployers (Annex A.8 → Art. 13), and human oversight (Annex A.9 → Art. 14). Each still requires AI Act-specific enhancements.

Question 3

Where is ISO 42001 support only partial?

Accepted Answer

Two places: technical documentation — Clause 7.5 establishes documentation practice but not the specific Annex IV content, retained 10 years after market placement — and record-keeping, where Clause 9.1 requires monitoring while Art. 12 mandates automatic event logging with traceability and retention.

Question 4

Which AI Act obligations have no ISO 42001 equivalent at all?

Accepted Answer

Five: conformity assessment (Art. 43), CE marking (Art. 48), registration in the EU database (Art. 49 and 71), post-market monitoring (Art. 72), and serious-incident reporting (Art. 73).

Question 5

Can any standard give a presumption of conformity with the AI Act?

Accepted Answer

Under Article 40, presumption of conformity attaches to harmonised European standards once they are cited in the Official Journal — standardisation work led by CEN-CENELEC JTC 21 (see prEN 18286). ISO/IEC 42001 itself carries no such presumption.

Question 6

Is this mapping legal advice?

Accepted Answer

No. It reflects published crosswalk analysis and the primary legal text, and must be validated against the current legal text before reliance.

ISO/IEC 42001	EU AI Act	Alignment	What it means in practice
Clause 6.1Actions to address risks and opportunities	Art. 9Risk management system	High	ISO 42001 risk-management processes directly support AI Act Art. 9. Enhancement: risk assessment must explicitly address health, safety and fundamental rights across the full lifecycle.
Clause 6.2 + Annex BAI objectives & data governance guidance	Art. 10Data and data governance	High	Both cover data quality, bias mitigation and provenance. AI Act Art. 10 is more prescriptive (relevance, representativeness, error-free), requiring enhanced documentation.
Clause 7.5Documented information	Art. 11 + Annex IVTechnical documentation	Partial	ISO 42001 establishes documentation practice but not the specific Annex IV format and content. Additional technical documentation is required, retained 10 years after market placement.
Clause 9.1Monitoring, measurement, analysis, evaluation	Art. 12Record-keeping / automatic logging	Partial	ISO 42001 requires monitoring but allows flexibility. Art. 12 mandates automatic event logging with traceability and retention — a technical gap requiring continuous logging infrastructure.
Annex A.8Information for interested parties / transparency	Art. 13Transparency & information to deployers	High	Both emphasise transparency and explainability. AI Act Art. 13 requires specific 'instructions for use' content that may need enhancement.
Annex A.9Use of AI systems / human oversight	Art. 14Human oversight	High	Strong alignment on human oversight, override and intervention. Specific documentation of override mechanisms may need enhancement.

ISO 42001 vs the EU AI Act: what certification covers — and where it stops

Where ISO 42001 supports the AI Act

The five obligations certification does not touch

Frequently asked questions