ISO 42001 Does Not Guarantee EU AI Act Compliance
ISO/IEC 42001 does not guarantee that a company is compliant with the EU AI Act. Certification does not provide an automatic presumption of conformity for specific high-risk systems.
What happened?
Certification under the management standard ISO/IEC 42001 does not automatically signify that a company complies with the EU AI Act. While the standard covers an organisation’s overarching AI management system, it provides no formal presumption of conformity according to Article 40 of the regulation. Specific requirements in Chapter III will enter into force on 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and on 2 August 2028 for systems falling under Article 6(1) and Annex I.
Key facts
| Standard | ISO/IEC 42001 |
|---|---|
| Krav för annex III-system | 2 december 2027 |
| Krav för annex I-system | 2 augusti 2028 |
| Artikel för presumtion | Artikel 40 i EU AI Act |
Why it matters
Many organisations have relied on ISO/IEC 42001 as a shortcut to approval ahead of the EU AI Act. This clarification means that companies cannot rely solely on process-oriented management systems but must carry out separate audits and documentation for each individual AI system. Furthermore, the timelines for 2027 and 2028 demonstrate that the transitional rules only apply to selected high-risk systems, not the legislation in its entirety.
Who is affected?
This news concerns AI developers, compliance officers, and management teams at companies that develop or deploy AI systems within the EU. Particularly affected are those building high-risk systems who have incorrectly assumed that a management certification resolves all legal requirements.
Impact on the EU
The EU AI Act imposes strict requirements on high-risk systems and general-purpose AI models. Relying on general management standards without adhering to the regulation’s specific Chapter III requirements creates compliance risks within the internal market.
What else you should know
Analysts from FinTech Global and Legal247 emphasise that while the ISO/IEC 42001 standard provides a solid foundation, it lacks a formal link to Article 40 of the EU AI Act. Companies must therefore ensure compliance at the individual system level.
Quick answers about this story
Vad har hänt?
När hände det?
Varför spelar det roll?
När börjar kraven för högrisksystem att gälla?
The link opens in a new window and leads to the publisher's own site.
Källan har spårats automatiskt från utgivaren via Aheadlines signalkedja.
AI-verktyg i artikeln
Topics
Get similar news straight to your inbox
The reader's room
Send in a question or an addition. The newsroom reads everything before it's published and replies when relevant. No AI-generated text – just people.
Sign in to submit a comment or question.
Read the article through your role
- Decide whether this affects strategy over 6–12 months or is just noise.
- Discuss with leadership: do we own the right question or does ownership need to move?
- Ask: what risk are we taking by NOT acting on this this quarter?
Generated angle — not editorial analysis of "ISO 42001 Does Not Guarantee EU AI Act Compliance"