ISO/IEC 42001 vs the EU AI Act: what certification proves and what it does not
Certification is not conformity. An obligation-by-clause crosswalk that shows where ISO/IEC 42001 helps with the EU AI Act, where it stops, and how CISOs should use both.
Different kinds of instrument
The EU AI Act is binding law with obligations that attach to specific AI systems by risk category. ISO/IEC 42001 is a voluntary, certifiable management-system standard describing how an organisation governs AI across its portfolio. Certification demonstrates a functioning management system; it is not a presumption of conformity with the AI Act, and it does not replace conformity assessment or registration for high-risk systems.
Where they overlap
Both expect leadership accountability, a risk process, impact assessment, competence and awareness, documented information, operational controls over data and development, monitoring, incident handling and continual improvement. An organisation running ISO/IEC 42001 will already produce much of the evidence the AI Act's quality-management, risk-management and post-market monitoring articles require.
Where the law goes further
The AI Act prescribes system-level outputs: Annex IV technical documentation, logging capability, instructions for use, specific human-oversight design features, conformity assessment, CE marking, EU database registration, serious-incident time limits and, for general-purpose models, training-content summaries and copyright policies. Treat these as controls inside the management system rather than assuming the standard covers them.
How to use the crosswalk below
Each mapping is an original editorial judgement with a confidence level; it references clause numbers only and reproduces no standard text. Use it to organise evidence, then validate against the standard and legal advice.
Crosswalk from recorded obligations
Original editorial mappings with confidence levels; clause references only, no standard text.
| Obligation | Instrument | Framework reference | Confidence |
|---|---|---|---|
| Do not deploy or provide AI for prohibited practices | EU AI Act | Clause 6.1.2 and Annex A control on AI system impact assessment Original editorial mapping: the AI-impact-assessment process is a natural place to screen for prohibited uses. | medium |
| Ensure AI literacy of staff operating AI systems | EU AI Act | Clause 7.2 Competence and 7.3 Awareness Original editorial mapping. | high |
| Establish a risk management system for high-risk AI | EU AI Act | Clauses 6.1.2, 6.1.3, 8.2, 8.3 and Annex A controls on AI risk Original editorial mapping. | high |
| Apply data governance and quality criteria to training, validation and testing data | EU AI Act | Annex A controls on data for AI systems Original editorial mapping. | medium |
| Draw up technical documentation before placing a high-risk system on the market | EU AI Act | Clause 7.5 Documented information; Annex A control on system documentation Original editorial mapping. | high |
| Design high-risk systems to log events automatically | EU AI Act | Annex A control on event logging Original editorial mapping. | medium |
| Provide deployers with clear instructions for use | EU AI Act | Annex A controls on information for interested parties Original editorial mapping. | medium |
| Enable and assign effective human oversight | EU AI Act | Annex A control on human oversight Original editorial mapping. | medium |
| Achieve appropriate accuracy, robustness and cybersecurity | EU AI Act | Annex A controls on AI system verification and validation Original editorial mapping. | medium |
| Operate a quality management system | EU AI Act | Whole management system (Clauses 4–10) ISO/IEC 42001 is a certifiable AI management system standard; certification is not a legal presumption of conformity under the AI Act. | high |
| Complete conformity assessment, CE marking and EU database registration | EU AI Act | Clause 9 Performance evaluation; internal audit Original editorial mapping; not a substitute for legal conformity assessment. | low |
| Use high-risk AI as instructed, monitor it and inform affected people | EU AI Act | Annex A controls on responsible use of AI systems Original editorial mapping. | medium |
| Carry out a fundamental rights impact assessment before deployment | EU AI Act | Clause 6.1.4 AI system impact assessment; Annex A control on impact assessment Original editorial mapping. | high |
| Disclose AI interaction and label synthetic content | EU AI Act | Annex A control on communication with interested parties Original editorial mapping. | medium |
| Meet general-purpose AI model provider obligations | EU AI Act | Annex A controls on data provenance and documentation Original editorial mapping. | medium |
| Operate a post-market monitoring system | EU AI Act | Clause 9.1 Monitoring, measurement, analysis and evaluation Original editorial mapping. | high |
| Report serious incidents to market surveillance authorities | EU AI Act | Clause 10 Improvement; Annex A control on incident handling Original editorial mapping. | medium |
| Verify conformity before importing or distributing high-risk AI | EU AI Act | Annex A controls on third parties and suppliers Original editorial mapping. | medium |
| Providers must meet the full set of provider duties for high-risk AI | EU AI Act | Clause 5.3; Annex A.3.2 Original editorial mapping to roles, responsibilities and authorities. | medium |
| Providers must keep high-risk AI documentation for ten years | EU AI Act | Clause 7.5.3; Annex A.6.2.7 Control of documented information and technical documentation. | high |
| Providers must retain automatically generated logs under their control | EU AI Act | Annex A.6.2.8 AI system recording of event logs. | high |
| Providers must take corrective action and inform the supply chain about non-conforming high-risk AI | EU AI Act | Clause 10.2; Annex A.8.4 Nonconformity and corrective action; communication of incidents. | high |
| Providers must supply conformity evidence and log access to authorities on request | EU AI Act | Clause 7.5; Annex A.8.3 Documented information available for external reporting. | medium |
| Non-EU providers must appoint an EU authorised representative for high-risk AI | EU AI Act | Clause 5.3; Annex A.10.2 Allocation of responsibilities to an external party. | medium |
| Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI | EU AI Act | Clause 4.1; Annex A.10.2 Determining the organisation's role and allocating responsibilities along the chain. | medium |
| Providers of high-risk AI must have written agreements with suppliers of components, tools and services | EU AI Act | Annex A.10.3 Supplier relationships aligned with the organisation's AI responsibilities. | high |
| Providers must document and register a conclusion that an Annex III system is not high-risk | EU AI Act | Clause 6.1.2; Annex A.6.2.7 Risk-based classification recorded in the technical documentation. | medium |
| Deployers must ensure input data they control is relevant and representative | EU AI Act | Annex A.7.4, A.7.6 Data quality and data preparation. | medium |
| Deployers must monitor high-risk AI, suspend use on risk and report serious incidents | EU AI Act | Clause 9.1; Annex A.6.2.6, A.8.4 Operation and monitoring; communication of incidents. | high |
| Employers must inform workers and their representatives before using high-risk AI at work | EU AI Act | Annex A.8.5 Information for interested parties. | medium |
| Public authorities must register their use of high-risk AI and must not use unregistered systems | EU AI Act | Annex A.8.2, A.8.5 System documentation and information for interested parties. | medium |
| Deployers must use the provider's transparency information in their data protection impact assessment | EU AI Act | Clause 6.1.4; Annex A.5.2 AI system impact assessment process. | medium |
| Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually | EU AI Act | Annex A.9.2, A.9.4 Processes for responsible use and intended use. | low |
| Deployers must tell natural persons that a high-risk AI system is used in decisions about them | EU AI Act | Annex A.8.5 Information for interested parties. | medium |
| Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way | EU AI Act | Annex A.8.2, A.6.2.4 System documentation; verification and validation of the marking. | low |
| Deployers of emotion recognition or biometric categorisation must inform exposed persons | EU AI Act | Annex A.8.5 Information for interested parties. | medium |
| Deployers must disclose deepfakes and AI-generated text published on matters of public interest | EU AI Act | Annex A.9.2, A.8.5 Responsible-use processes and information to interested parties. | low |
| Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold | EU AI Act | Clause 4.2; Annex A.8.3 Interested-party requirements and external reporting. | low |
| Providers of GPAI models must maintain technical documentation and inform downstream providers | EU AI Act | Annex A.6.2.7, A.8.2, A.10.4 Technical documentation, system documentation and information for customers. | high |
| Non-EU providers of GPAI models must appoint an EU authorised representative | EU AI Act | Clause 5.3; Annex A.10.2 Responsibilities allocated to an external party. | medium |
| Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office | EU AI Act | Clause 10.2; Annex A.8.4 Corrective action and incident communication. | high |
| Deployers must explain individual decisions taken with high-risk AI on request | EU AI Act | Annex A.8.5, A.9.2 Information for interested parties and responsible-use processes. | medium |
Every ISO/IEC 42001 mapping on the platform, grouped by clause →
Frequently asked questions
Does ISO/IEC 42001 certification mean EU AI Act compliance?
No. Certification shows you operate an AI management system. EU AI Act compliance is assessed obligation by obligation for each AI system, including conformity assessment for high-risk systems.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.