ISO 42001 vs EU AI Act: a voluntary standard and a law

ISO/IEC 42001:2023 is published by ISO and the International Electrotechnical Commission (IEC). It sets requirements for establishing, implementing, maintaining and continually improving an AI management system. It is meant for organisations that develop, provide or use AI-based products or services.

Clauses 4 to 10 cover the management system itself. Clause 5.2 asks for an AI policy, and clause 6.1.4 asks for an AI system impact assessment. The Annex A controls A.2 to A.10 are optional requirements. You decide which ones apply to you and record that in a Statement of Applicability.

ISO 42001 is voluntary. If you want a certificate, a certification body audits your AI management system and issues it.

The EU AI Act is Regulation (EU) 2024/1689. It applies to providers that place AI systems or general-purpose AI models on the EU market, wherever they are established, and to deployers of AI systems in the EU. It also applies to providers and deployers outside the EU when the output of their AI system is used in the EU, and to importers and distributors.

The Regulation defines the roles:

• A provider develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark.
• A deployer uses an AI system under its authority, except for personal, non-professional use.

What you must do depends on that role and on the kind of AI system. The Regulation has rules on AI literacy (Art. 4), prohibited AI practices (Art. 5), high-risk AI systems, with obligations for providers (Art. 16) and deployers (Art. 26), transparency for certain AI systems (Art. 50) and providers of general-purpose AI models (Art. 53 and Art. 55).

Providers of high-risk AI systems go through a conformity assessment before they place a system on the market (Art. 43). For some high-risk AI systems a notified body takes part. For others the provider does it through internal control.

The AI Act applies in stages, so different rules start on different dates.

• ISO 42001 is a voluntary standard. The AI Act is law for everyone in its scope.
• ISO 42001 asks for a management system for all your AI work. The AI Act sets obligations per role and per kind of AI system.
• ISO 42001 can end in a certificate from a certification body. Under the AI Act, providers of high-risk AI systems go through a conformity assessment, sometimes with a notified body.
• ISO 42001 is an international standard. The AI Act covers AI placed on the EU market or used in the EU, including by organisations outside the EU.

An ISO 42001 certificate shows that a certification body audited your AI management system against ISO 42001. It does not show that you meet the AI Act.

Start with the AI Act, because it is law where it applies to you. List the AI systems you build and use, work out your role for each one and check which rules apply. That is a legal question, so take your own legal advice.

• If you build AI systems or general-purpose AI models for the EU market, start with your obligations as a provider.
• If you use AI systems in your work in the EU, start with your obligations as a deployer.
• If you want a certificate that shows how you govern AI, add ISO 42001. It is voluntary, so the choice is yours.
• If you already run ISO 27001, ISO 42001 has management system clauses 4 to 10 too, so it builds on the system you have.

ISO 42001 can also be the place where you organise the AI Act work, with policies, risks, impact assessments and evidence in one management system. That doesn't replace any AI Act obligation.

If you do both, the AI Act obligations for your role stay yours, whatever you certify. ISO 42001 gets its own audit by a certification body.

Some of the work is useful for both. A transparency procedure, human oversight measures or a competence plan can be evidence for requirements in both. Your ISO 42001 auditor decides what to accept for ISO 42001. For the AI Act, the Regulation sets what your role needs, and where a notified body takes part, it makes its own assessment.

Compliance by mvdmio has catalogs for ISO 42001:2023 and the EU AI Act. The EU AI Act catalog holds requirements for Art. 4, Art. 5, Art. 6(1), Art. 16, Art. 26, Art. 50, Art. 53 and Art. 55. It marks Art. 4 and Art. 5 as mandatory and the others as optional. On the Applicability page you mark which requirements apply to your organisation. Compliance does not decide whether your AI system is high-risk. You make that call, with your own legal advice.

Crosswalk mappings link related requirements across the frameworks you adopt, and the crosswalk marks each link as Equivalent, Partial or Related.

• Transparency. The crosswalk marks ISO 42001 control A.8.2 as Equivalent to AI Act Art. 50.
• Human oversight. It marks ISO 42001 controls A.9.2, A.9.3 and A.9.4 as Related to AI Act Art. 26.
• Lifecycle. It marks ISO 42001 clauses 8.1, 8.2, 8.3 and 8.4 as Related to AI Act Art. 16.
• AI literacy. It marks AI Act Art. 4 as Related to ISO 42001 clause 7.2 on competence.

AI Act requirements outside these topics have no crosswalk link to ISO 42001. Where there is a link, evidence, findings and register records can meet requirements in both frameworks. Each framework shows what is satisfied and what is still open.

Compliance does not certify you against ISO 42001, and it does not make you compliant with the AI Act. It is where you track the requirements you marked as applicable and keep the records, evidence and findings your auditor asks to see.

Compliance doesn't connect to your cloud, identity or HR systems to collect evidence. You attach evidence to tasks yourself, or build your own sync through the REST API, the MCP server or the CLI.

More detail on each framework: ISO 42001 in Compliance and EU AI Act in Compliance.

ISO 42001 is €749 per framework per year, excl. VAT. The EU AI Act is €199 per framework per year, excl. VAT. You pay for each framework you adopt separately. Users in your organisation are unlimited.

Try Compliance for 30 days without a credit card. The trial gives you full access to every framework. The AI assistant is not part of the trial unless you buy AI credits.

Used at Jewel Software, where Michiel van der Meer is Tech Lead. He built Compliance after taking over an ISMS there and seeing how much hand-work it took.

You can also look around in the public demo first. It uses fictional data.