“We have ISO 42001, so are we AI Act compliant?” – Why ISO/IEC 42001 and EN 18286 do not replace each other

In our previous article we introduced EN 18286:2026, the first European standard written specifically to support the implementation of the AI Act. Since its publication, the most frequent question we get from clients goes like this: “we already hold an ISO/IEC 42001 certificate – so are we covered?” The short answer is no. The longer answer is far more interesting, because it shows how the two are best layered on top of each other.

Two standards, answering two different questions

The confusion arises because from the outside the two documents look very similar: both are management system standards, both are built on the ISO frame of clauses 4–10, and both contain risk management, documentation and management review. The question they answer, however, is fundamentally different:

In one sentence: ISO/IEC 42001 provides a certifiable framework for the organisation's AI management system; in parallel, the AI Act attaches system-level requirements and provider obligations to high-risk AI systems. An ISO/IEC 42001 certificate therefore does not on its own demonstrate, for example, that a recruitment AI system complies with Articles 9–15.

What exactly is ISO/IEC 42001?

Published in December 2023, ISO/IEC 42001 is the world's first AI management system (AIMS) standard. Its structure is familiar to anyone who has worked with ISO 27001: clauses 4–10 on establishing, operating and improving the system, plus an “Annex A” with 38 controls from which the organisation selects the applicable ones based on its own risks (Statement of Applicability). The controls cover areas such as AI policy, internal roles, AI impact assessment, lifecycle management, data handling, informing interested parties, and relationships with third parties.

On 18 March 2026, the European standardisation organisations also adopted it as a European standard under the designation EN ISO/IEC 42001:2026. This is an important development, but European adoption on its own does not attach a presumption of conformity under Article 40 of the AI Act. That requires it to be cited in the Official Journal of the European Union as a harmonised standard or as part of one; and the presumption exists only for the requirements set out in Article 40 and to the extent covered by the standard.

The connection is deliberate – but it is not equivalence

Annex D of EN 18286 explicitly contains a mapping to ISO/IEC 42001 (just as Annex C does to ISO 9001). The drafters therefore consciously built a bridge between the two worlds, so that an organisation already operating an AIMS does not have to start from scratch.

Two things are worth knowing about this bridge, however:

• Annexes C and D, as well as Annex ZA, are informative. Annex ZA is particularly important because it shows which AI Act requirements the standard aims to cover; the legal effect of a presumption of conformity, however, follows not from the “normative” character of an annex but from Article 40 of the AI Act and any OJEU citation.
• Because of the shared 4–10 structure, significant methodological and documentation reuse is possible, but the requirements of the two standards are not identical. The mapping in Annex D is a navigational aid, not a declaration of equivalence: the extent to which an existing ISO/IEC 42001 control or piece of evidence can be used under EN 18286 has to be assessed control by control.

In short: a working ISO/IEC 42001 system can be a serious starting point, but it does not mean automatic transfer of evidence towards EN 18286 or the AI Act.

Five areas to check separately even with an ISO/IEC 42001 certificate

The points below are not all “product requirements”, and not all of them apply to every actor in the same way. The key message is that having an AIMS under ISO/IEC 42001 does not replace the assessment of the AI Act's specific, role- and system-dependent requirements.

• System-specific compliance evidence. Article 17 of the AI Act requires documented QMS policies, procedures and instructions; evidence relating to high-risk systems has to be fitted to these and to the other applicable requirements. Having ISO/IEC 42001 does not make this automatic.
• Change management for continuously learning systems. The AI Act treats pre-determined changes taken into account at conformity assessment separately; this has to be tracked in the technical documentation and in change management as well.
• Incident reporting deadlines. Article 73 of the AI Act prescribes statutory reporting deadlines; a general incident management process under ISO/IEC 42001 does not replace these.
• AI-specific supply chain. When handling suppliers, models, data and components, the information, documentation and control needs arising from the AI Act and EN 18286 have to be mapped separately.
• Fundamental rights impact assessment – where applicable. The FRIA under Article 27 primarily falls on certain deployers of specified high-risk systems, so it is not a general provider QMS requirement. An ISO/IEC 42001 certificate still does not substitute for the FRIA for those to whom it genuinely applies.

The legal difference matters, but not in the sense that “the burden of proof is reversed”. Conformity with a harmonised standard cited in the OJEU can establish a presumption of conformity under Article 40 of the AI Act, limited to the requirements covered. The provider's documentation, cooperation and demonstration obligations towards authorities do not cease because of it.

So can we throw out 42001? Absolutely not

Quite the opposite. ISO/IEC 42001 can deliver several standalone benefits that remain useful alongside EN 18286:

• A certifiable management system. Third-party ISO/IEC 42001 certification can provide external assurance about the operation of the AIMS, but it is not equivalent to certifying AI Act compliance.
• International usability. As an international ISO/IEC standard, ISO/IEC 42001 can provide a shared governance language across several markets and supplier relationships; this does not mean it substitutes for the regulatory requirements of every jurisdiction.
• An organisational foundation. Top management accountability, roles, competences, AI policy and a risk management culture provide organisational capabilities on which AI Act compliance processes can also build.

The correct picture is therefore not “either/or” but layering: ISO/IEC 42001 provides the organisational AIMS framework, while EN 18286 supports the practical implementation of the AI Act's regulatory QMS requirements. Alongside these, the technical and procedural requirements applying to individual high-risk AI systems still have to be handled separately.

Which one do you need? – a quick decision aid

The application deadline of 2 December 2027 applies to systems qualifying as high-risk under Article 6(2) and Annex III. An ISO/IEC 42001 certificate can provide a good starting position, but on its own it does not carry the organisation across the AI Act compliance finish line.

Let's look together at where you actually stand

The Harveys team works through exactly this question day after day: what can be reused from your existing system, and what has to be built from scratch.

The practical steps are covered in the next part of the series: EN 18286 readiness in 5 steps. And if you would rather start with the standard itself, here is the first part: EN 18286:2026.

Let's start preparing – together

The Harveys team specialises in AI Act compliance readiness, advisory services and ongoing professional support.

Let's look together at what can be reused from your existing system. A short assessment can identify what can be carried over from your existing ISO/IEC 42001, ISO 9001, ISO 27001 and GDPR processes, and where new, AI-specific controls or evidence are needed.

AI Act gap analysis →

This article is for information purposes only and does not constitute legal advice. Determining specific compliance obligations requires an individual assessment of the system and the organisation, and where appropriate the involvement of legal counsel.