Does ISO/IEC 42001 help with the AI Act?
Partly. 42001 gives you the processes behind many duties. It gives no presumption of conformity and does not cover the legal steps.
AI Act as amended by Regulation (EU) 2026/1744.
Where 42001 work pays off
- AI literacy: 42001 competence and awareness cover the core of Art. 4.
- Supplier agreements: 42001 supplier controls cover the written agreement for third-party models.
- Impact assessment: the 42001 AI impact assessment is close to the fundamental rights impact assessment.
- Operations: monitoring, incidents, corrective action and records.
Where it does not
- Product duties: built-in logs, accuracy levels, marking of generated content.
- Legal acts: conformity assessment, EU declaration, CE marking, registration, representatives.
- Copyright: the policy and training data summary of model providers.
Duty by duty
Pick a role. Filter by how much 42001 covers.
From 2027-12-02 (Annex III) or 2028-08-02 (Annex I).
20 duties. 2 large overlap 14 some 4 none
| Duty | Article | Overlap | What 42001 work gives you |
|---|---|---|---|
| Support AI literacy of your staff | Art. 4 | Large | A 42001 management system already sets competence and awareness needs for people who work on AI, and keeps records of training. |
| Agree in writing what suppliers must give you | Art. 25(4) | Large | 42001 controls on suppliers and third parties cover this kind of agreement. |
| Check that no use is a prohibited practice | Art. 5 | Some | The AI impact assessment of a 42001 system can catch these uses. The ban itself is a legal test that you must do against Art. 5. |
| Document why an Annex III system is not high-risk | Art. 6(3)-(4), Art. 49(2) | Some | 42001 asks you to define the scope and intended use of each AI system, which feeds this assessment. The legal test and the registration are extra. |
| Run a risk management system for the whole life cycle | Art. 9 | Some | 42001 gives you an AI risk assessment and risk treatment process. The AI Act also asks for testing against metrics and a focus on fundamental rights. |
| Govern training, validation and test data | Art. 10, Art. 4a | Some | 42001 controls on data quality, provenance and preparation cover much of this. The bias checks and their legal conditions go further. |
| Write the technical documentation | Art. 11, Annex IV | Some | 42001 system documentation and records give you part of the content. Annex IV lists specific items that a management system does not ask for. |
| Build in automatic event logs | Art. 12 | Some | 42001 controls ask you to decide what to log. The AI Act sets minimum content for some systems. |
| Give deployers clear instructions for use | Art. 13 | Some | 42001 asks you to give users the information they need. The AI Act lists the exact content. |
| Design for human oversight | Art. 14 | Some | 42001 controls cover human oversight roles. The AI Act asks for oversight features in the product itself. |
| Reach declared accuracy, robustness and cybersecurity | Art. 15 | Some | 42001 verification and validation help. Cybersecurity needs its own controls; an ISO/IEC 27001 system covers more of it. |
| Run a quality management system | Art. 17 | Some | The Commission says 42001 goals and definitions do not match the AI Act QMS. EN 18286 maps to 42001, so a 42001 system is a start, not the full answer. |
| Keep documents for 10 years and logs for at least 6 months | Art. 18, Art. 19 | Some | 42001 controls documented information. The retention periods come from the law. |
| Monitor the system after release | Art. 72 | Some | 42001 monitoring, measurement and improvement give you the cycle. The AI Act asks for a formal plan inside the technical documentation. |
| Report serious incidents | Art. 73 | Some | 42001 incident and nonconformity handling gives you the internal process. The reporting duty and deadlines come from the law. |
| Correct, withdraw or recall a non-conforming system | Art. 20, Art. 21 | Some | 42001 corrective action covers the internal part. Informing the chain and the authorities is extra. |
| Pass the conformity assessment | Art. 43 | No | A 42001 certificate is not a conformity assessment under the AI Act. Notified bodies under the AI Act are a separate scheme. |
| Sign the EU declaration and affix the CE marking | Art. 16, Art. 47, Art. 48 | No | These are legal acts of the provider. A management system does not produce them. |
| Register the system in the EU database | Art. 49(1) | No | A legal step outside the management system. |
| Appoint an authorised representative in the EU | Art. 22 | No | A legal appointment. A management system does not cover it. |
Most companies that buy AI for hiring, credit or customer decisions.
13 duties. 3 large overlap 6 some 4 none
| Duty | Article | Overlap | What 42001 work gives you |
|---|---|---|---|
| Support AI literacy of your staff | Art. 4 | Large | A 42001 management system already sets competence and awareness needs for people who work on AI, and keeps records of training. |
| Use the system as the instructions say | Art. 26(1) | Large | 42001 operational planning and control of AI use covers this. |
| Assign trained people to oversee the system | Art. 26(2) | Large | 42001 roles, responsibilities and competence cover this. |
| Check that no use is a prohibited practice | Art. 5 | Some | The AI impact assessment of a 42001 system can catch these uses. The ban itself is a legal test that you must do against Art. 5. |
| Check input data under your control | Art. 26(4) | Some | 42001 data controls help. The test is against the provider's intended purpose. |
| Monitor use and report risks and incidents | Art. 26(5) | Some | 42001 monitoring and incident handling help. The duty to inform and to stop comes from the law. |
| Keep the logs for at least 6 months | Art. 26(6) | Some | 42001 controls on records help. The minimum period is legal. |
| Use the provider's information in your DPIA | Art. 26(9) | Some | The 42001 AI impact assessment can share inputs with the DPIA. The DPIA itself is a GDPR duty. |
| Do a fundamental rights impact assessment | Art. 27 | Some | The 42001 AI impact assessment covers similar ground. The AI Act fixes its content and asks you to notify the result. |
| Inform workers before you use it at work | Art. 26(7) | No | A legal information duty, often tied to national labour law. |
| Register your use in the EU database | Art. 26(8), Art. 49(3) | No | A legal step outside the management system. |
| Tell people that AI helps decide about them | Art. 26(11), Art. 86 | No | A legal information duty to the people affected. |
| Check whether you become the provider | Art. 25 | No | A legal test of your role. 42001 scope work helps you see it, but does not decide it. |
Since 2025-08-02. Older models have until 2027-08-02.
12 duties. 1 large overlap 6 some 5 none
| Duty | Article | Overlap | What 42001 work gives you |
|---|---|---|---|
| Support AI literacy of your staff | Art. 4 | Large | A 42001 management system already sets competence and awareness needs for people who work on AI, and keeps records of training. |
| Check that no use is a prohibited practice | Art. 5 | Some | The AI impact assessment of a 42001 system can catch these uses. The ban itself is a legal test that you must do against Art. 5. |
| Block intimate deep fakes and child abuse material | Art. 5(1)(ba), (bb) | Some | 42001 risk treatment and monitoring support the safeguards. The test of what is banned comes from the law. |
| Document the model for the AI Office and downstream providers | Art. 53(1)(a)-(b) | Some | 42001 documentation and information for interested parties help. Annexes XI and XII list the exact content. |
| Evaluate the model and reduce systemic risks | Art. 55(1)(a)-(b) | Some | 42001 risk assessment and treatment give you the process. The state-of-the-art testing goes further. |
| Track and report serious incidents | Art. 55(1)(c) | Some | 42001 incident handling gives the internal process. Reporting is legal. |
| Protect the model and its infrastructure | Art. 55(1)(d) | Some | 42001 helps. An ISO/IEC 27001 system covers more of the security work. |
| Mark generated content as AI-generated | Art. 50(2), Art. 111(4) | No | A technical product duty. A management system does not produce the marking. |
| Set a policy to respect EU copyright law | Art. 53(1)(c) | No | A legal policy outside the scope of 42001. |
| Publish a summary of the training content | Art. 53(1)(d) | No | A publication duty outside the management system. |
| Appoint an authorised representative in the EU | Art. 54 | No | A legal appointment. |
| Notify the Commission when the model has systemic risk | Art. 51, Art. 52 | No | A legal notification. |
What the law says
- The AI Act does not mention ISO/IEC 42001. A 42001 certificate is not a conformity assessment under the Act.
- The Commission says 42001 helps to set up an AI management system, but its goals and definitions do not match the Act's quality management system (FAQ, 2026-03-10).
- The harmonised standard for that system is EN 18286:2026. Its annexes map it to 42001. EN 18286 and 42001 compared.
- For a high-risk provider, 4 of 20 duties are legal steps 42001 does not touch.