Compare
Comply · EU AI Act Readiness · ISO 42001 · AI Governance
As of September 2026 · after the Digital Omnibus
What do you
actually need?
EU law. Binding, with fines of up to 7 % of worldwide turnover for the worst breaches.
A voluntary international standard. You can be certified against it.
01 · Side by side
One asks about
the system. One about you.
Both want overlapping evidence. They ask different questions, are checked by different people, and end in different outcomes.
| Dimension | EU AI Act | ISO/IEC 42001 |
|---|---|---|
| Nature | EU law: binding, with fines for non-compliance | Voluntary international standard you can be certified against |
| Applies to | Providers and deployers of AI on the EU market | Any organisation that develops, provides or uses AI |
| The question | System level: is this AI system allowed, and under which obligations? | Organisation level: do you manage AI responsibly, repeatably? |
| Starting point | Risk classification: prohibited, high-risk, limited, minimal | Scope definition and gap analysis |
| Evidence | Technical documentation, risk management, logging, human oversight | Policies, roles, objectives, internal audits, management reviews |
| Checked by | Market surveillance authorities; notified bodies for some high-risk systems | Accredited certification bodies |
| Outcome | Lawful operation. There is no certificate for being compliant. | A certificate you can show in tenders and questionnaires |
| Time | Weeks for classification; months for high-risk obligations | Six to nine months from gap analysis to audit |
02 · Overlap
Build the
evidence once.
Where the Act and the standard ask for the same kind of work, one piece of evidence can serve both. Our reading, with the articles and clauses behind it.
- An inventory of your AI systemsAI ActThe basis for classification, Art. 6 and Annex IIIISO 42001Scope of the management system, clause 4.3strong
- Risk assessment and treatmentAI ActRisk management system for high-risk AI, Art. 9ISO 42001AI risk assessment and treatment, 6.1.2 and 6.1.3strong
- Impact on peopleAI ActFundamental rights impact assessment for certain deployers, Art. 27ISO 42001AI system impact assessment, 6.1.4 and Annex A.5strong
- Policies, roles, responsibilitiesAI ActQuality management system for high-risk providers, Art. 17ISO 42001AI policy and roles, 5.2 and 5.3strong
- Data governanceAI ActData and data governance for high-risk AI, Art. 10ISO 42001Data for AI systems, Annex A.7partial
- DocumentationAI ActTechnical documentation, Art. 11 and Annex IVISO 42001Documented information, 7.5partial
- Logging and oversightAI ActRecord-keeping and human oversight, Art. 12 and 14ISO 42001Life cycle and use of AI systems, Annex A.6 and A.9partial
- Information for usersAI ActTransparency duties, Art. 13 and Art. 50ISO 42001Information for interested parties, Annex A.8partial
- SkillsAI ActMeasures to support AI literacy, Art. 4ISO 42001Competence and awareness, 7.2 and 7.3partial
- Checking that it worksAI ActConformity assessment and post-market monitoring, Art. 43 and 72ISO 42001Internal audit and management review, 9.2 and 9.3partial
Strong: the same work product usually serves both. Partial: related, but the Act asks for system-specific detail the standard doesn’t. High-risk articles apply only to high-risk systems.
03 · Dates
What applies
when.
The Digital Omnibus moved the high-risk dates in July 2026. Everything else kept its date. Drawn to scale.
- ISO/IEC 42001 published
The first certifiable AI management system standard.
applies - AI Act enters into force
The clock starts. Obligations follow in stages.
applies - Prohibitions and AI literacy
Banned practices apply. Staff working with AI need AI literacy measures.
applies - General-purpose models, governance, penalties
Duties for model providers apply, and so do the governance structure and the penalty rules.
applies - Digital Omnibus in force
High-risk dates move. AI literacy becomes an obligation to take measures.
applies - Transparency, Art. 50
Art. 50 transparency duties apply. Commission fines for general-purpose model providers start.
applies - Two new bans, marking grace ends
AI that generates non-consensual intimate images or child sexual abuse material is banned. Generative systems already on the market must now mark their output.
ahead - High-risk, Annex III
Stand-alone high-risk systems: employment, credit, education, public services and more.
ahead - High-risk, Annex I
AI in products under EU product safety law, such as machinery or medical devices.
ahead
04 · Which one first
It depends on
who is asking.
Three situations we see most. Pick the one that sounds like yours.
Classify first.
Risk classification under the Act is mandatory and quick. It sets the foundation for everything else: which systems are prohibited, which are high-risk, which only carry transparency duties.
- First step
- Inventory and classification
- Time
- Weeks
- Service
- EU AI Act Readiness
05 · Questions
Asked by
every auditor.
Does ISO 42001 certification make us compliant with the EU AI Act?
No. The management system helps you produce the evidence the Act asks for, but compliance is assessed per system, against the law, not against a certificate.
We have no high-risk systems. Do we have obligations at all?
Yes. The prohibitions, the transparency duties and the AI literacy measures apply regardless. Classification tells you which of them apply to which system.
What changed with the Digital Omnibus?
Dates more than direction. High-risk rules now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI in regulated products. AI literacy became an obligation to take measures rather than to guarantee a level. The original prohibitions, the duties for general-purpose models and the transparency duties kept their dates. New: two added bans on AI that generates non-consensual intimate images or child sexual abuse material, applying from 2 December 2026, and a grace period until the same date for marking the output of generative systems already on the market.
In which order should we do this?
If the Act applies to you, classify first: it is a legal requirement and takes weeks. Start ISO 42001 when customers, tenders or insurers ask for a certificate, or when you want the evidence to stay current without a project every year.
Does ISO 27001 help?
A lot. ISO 42001 follows the same management system structure, so the gap analysis usually shows more already in place than expected. The AI system impact assessment is the part with no equivalent in ISO 27001.
Is ISO 42001 a harmonised standard under the Act?
No. A certificate doesn’t give you a presumption of conformity with the AI Act. The harmonised standards for the Act are developed separately in Europe.
Which one will your auditor ask about first?
Classify
first.
Most teams need both in the end. Classification takes weeks and tells you what the Act asks of each system.
A snapshot to orient, as of September 2026. Not legal advice: we turn rules into architecture, your counsel signs off.