ISO/IEC 42001 vs EU AI Act

The EU AI Act, Regulation (EU) 2024/1689, is EU law. It applies to the operators in the scope of its Article 2(1). Their duties change with their role and with the category of the AI system or general-purpose AI model. ISO/IEC 42001:2023 is a voluntary standard with requirements for an AI management system. All organizations that supply or use products or services that use AI systems can apply it (Clause 1). Each organization sets the scope of its AI management system (4.3).

Where to start

An organization with duties in the EU AI Act, or with plans for an AI management system, can start with these points:

• Your role in the EU AI Act: the EU AI Act applies only in the scope of Article 2. Its duties change with the operator role of Article 3(8): provider, deployer, importer, distributor, product manufacturer, or authorized representative. One organization can have more than one role for one AI system. See Article 2 and Article 3.
• A provider of a high-risk AI system: the provider has the duties of Chapter III, Sections 2 and 3, of the EU AI Act. Examples are Articles 9, 16, and 17. These Sections apply from 2 December 2027 for high-risk AI systems of Article 6(2) and Annex III. They apply from 2 August 2028 for high-risk AI systems of Article 6(1) and Annex I (Article 113, third paragraph, point (c)). For high-risk AI systems related to products of Annex I, Section B, Article 2(2) limits the provisions that apply. EN 18286 is one voluntary means to conform to Article 17(1) (Annex ZA). ISO/IEC 42001 is optional for the provider.
• A deployer of a high-risk AI system: the deployer has the duties of Article 26. Some deployers must also do a fundamental rights impact assessment (Article 27). Article 26 applies from 2 December 2027 or 2 August 2028, by the type of high-risk AI system (Article 113, third paragraph, point (c)). Article 26 does not apply to high-risk AI systems of Article 6(1) related to products covered by the legislation in Annex I, Section B (Article 2(2)). Article 27 applies from 2 December 2027. See Article 26.
• An AI management system: an organization that wants an AI management system can use ISO/IEC 42001, with or without certification. The EU AI Act applies to the organization in its own scope, with or without ISO/IEC 42001.
• No duty in the EU AI Act: the Act does not apply to an organization that is not in the scope of Article 2. ISO/IEC 42001 stays available as a voluntary standard.

Summary

ISO/IEC 42001 and the EU AI Act have these primary differences:

• Type and actors: the EU AI Act gives duties to operators by role and by the category of the system or model. ISO/IEC 42001 gives requirements for one AI management system, which an organization decides to use. The AI roles of ISO/IEC 42001 (4.1) are not the operator roles of the Act.
• Risk management: the Act tells providers to make sure that each high-risk AI system has a risk management system (Articles 9 and 16(a)). ISO/IEC 42001 has requirements for AI risk assessment, AI risk treatment, and AI system impact assessment in the AI management system (6.1.2 to 6.1.4). See Risk management in the two instruments.
• Quality management: Article 17 tells providers of high-risk AI systems to have a quality management system. An AI management system of ISO/IEC 42001 is not this quality management system. See The quality management system and the AI management system.
• Conformity: in Article 40(1), a harmonized standard with a reference in the Official Journal gives a presumption of conformity. The Official Journal cites EN 18286:2026 for the quality management system, and it does not cite ISO/IEC 42001. See Certificates and the presumption of conformity.

The two instruments side by side

The table compares the EU AI Act and ISO/IEC 42001 item by item.

Item	EU AI Act	ISO/IEC 42001:2023
Publisher and status	Regulation (EU) 2024/1689 of the European Parliament and of the Council. It is EU law and "directly applicable in all Member States". The consolidated version of 27 July 2026 includes the changes of Regulation (EU) 2026/1744.	ISO and IEC (ISO/IEC JTC 1/SC 42), first edition, 2023-12. It is a voluntary standard.
Who it applies to	The operators in Article 2(1), points (a) to (f), and the affected persons located in the Union in point (g), subject to the Article 2 exclusions. Point (a) applies to providers wherever they are established.	All organizations that supply or use products or services that use AI systems (Clause 1). The organization sets the scope of its AI management system (4.3).
Roles	Operator roles of Article 3(8): provider (Article 3(3)), deployer (Article 3(4)), importer, distributor, product manufacturer, and authorized representative	The organization determines its roles for its AI systems (4.1). These roles are not the operator roles of the Act.
Structure	Prohibited AI practices (Article 5), high-risk AI systems (Article 6 with Annexes I and III), transparency obligations (Article 50), and general-purpose AI models (Chapter V), with duties for each operator role	Clauses 4 to 10 in the harmonized structure. Annex A (normative) with reference control objectives and controls. Annex B (normative) with implementation guidance. Annexes C and D (informative).
Risk management	A risk management system for each high-risk AI system (Article 9). The provider makes sure that the system complies with Article 9 (Article 16(a)).	AI risk assessment (6.1.2, 8.2) and AI risk treatment with a statement of applicability (6.1.3, 8.3) in the AI management system
Impact assessment	A fundamental rights impact assessment by some deployers of high-risk AI systems (Article 27)	An AI system impact assessment with documented results (6.1.4, 8.4)
Management system	A quality management system of providers of high-risk AI systems (Article 17)	An AI management system (4.4), with the AI policy (5.2), internal audit (9.2), management review (9.3), and continual improvement (10.1)
Conformity and certificates	The conformity assessment of Article 43, before placing on the market or putting into service (Article 16(f)). Notified bodies issue certificates in the procedure of Annex VII (Article 44(1)).	The standard sets no certification procedure. Certification of the AI management system by a certification body is optional.
Presumption of conformity	Article 40(1), for harmonized standards with a reference in the Official Journal. The Official Journal cites EN 18286:2026 (Implementing Decision (EU) 2026/2274).	None. The Official Journal does not cite ISO/IEC 42001.
Dates	The Act applies from 2 August 2026, with other dates for some provisions in Article 113. Chapter III, Sections 1 to 3, with the exception of Article 6(5), apply from 2 December 2027 or 2 August 2028. See Dates.	First edition of December 2023. The standard sets no dates from which it applies.
Authorities and penalties	Market surveillance authorities and other authorities supervise the Act. Article 99 sets maximum fines for specified infringements. See Penalties and enforcement.	None. The standard has no authority and no penalties.
Frameworks in Modulos	OFF-1 (Organization level) and MFF-1 (AI System level)	OFF-10 (Organization level) and MFF-10 (AI System level)

Risk management in the two instruments

The EU AI Act and ISO/IEC 42001 each have rules for risk work. The objects and the actors are different.

EU AI Act, Article 9. Providers make sure that high-risk AI systems have an Article 9 risk management system (Article 16(a)). Article 9(8) requires testing during development "as appropriate", and in all cases before placing on the market or putting into service.

EU AI Act, Article 27. Specified deployers do a fundamental rights impact assessment before deploying some Article 6(2) systems, subject to Article 27’s scope, notification rules, and exceptions.

The two duties have future dates in Article 113, third paragraph, point (c).

ISO/IEC 42001. The organization defines an AI risk assessment process (6.1.2) and an AI risk treatment process (6.1.3). In risk treatment, the organization compares the necessary controls with Annex A and makes a statement of applicability (6.1.3 b) and f)). It also defines a process for an AI system impact assessment, with documented results (6.1.4).

The organization performs the AI risk assessment (8.2) and the AI system impact assessment (8.4) at planned intervals or when it proposes "significant" changes. Clause 8.2 also covers "significant" changes that occur.

For AI risk treatment, ISO/IEC 42001 clause 8.3 sets requirements for implementation, effectiveness checks, and updates (Clause 8). The organization keeps the results of all three processes as documented information (8.2 to 8.4). These requirements apply to each AI system that the AI management system includes, not only to high-risk AI systems.

Where the two are different. Clause 6.1.4 of ISO/IEC 42001 does not give the conditions of Article 27 or the items (a) to (f) of Article 27(1). It also has no notification to an authority. The ISO/IEC 42001 results can be inputs to some duties of the Act, but they replace no duty. For each clause next to its related EU AI Act Article, see ISO/IEC 42001, the EU AI Act, and NIS2.

The quality management system and the AI management system

For providers of high-risk AI systems, Article 17(1) requires a documented quality management system for compliance with the Act, with points (a) to (m).

Those aspects include Article 9 risk management, Article 72 post-market monitoring, and Article 73 incident-reporting procedures (Article 17(1)(g) to (i)).

Article 17(2) and (3) address proportionality and inclusion in sectoral systems. Article 17(4) gives deemed fulfillment through compliance with Union financial-services governance rules for financial-institution providers subject to those rules, with the exception of paragraph 1, points (g), (h), and (i).

Article 17 has different dates in Article 113, third paragraph, point (c).

ISO/IEC 42001 gives requirements for an AI management system. The organization establishes, implements, maintains, continually improves, and documents it (4.4). The standard includes the AI policy (5.2), AI objectives (6.2), internal audit (9.2), management review (9.3), continual improvement (10.1), and nonconformity and corrective action (10.2). The organization selects its controls through AI risk treatment (6.1.3).

The two systems have different objects. The quality management system of Article 17 makes sure that the high-risk AI systems of a provider comply with the Act. The AI management system of ISO/IEC 42001 is for the AI objectives of the organization, in the scope that it sets. An AI management system is not the quality management system of Article 17.

EN 18286 and the presumption of conformity

EN 18286:2026 and ISO/IEC 42001:2023 are different on these points:

• Purpose: EN 18286 is one voluntary means to conform to Article 17(1) and the first sentence of Article 11(1), without ensuring compliance with all of the Act (Annex ZA).
• Quality: EN 18286 connects quality to regulatory compliance, with the EU AI Act and law protecting health, safety, and fundamental rights (3.1.23, 3.1.26).
• Other means: clause 4.4.3.1 permits combinations of cited harmonized standards, adopted common specifications, other standards, and technical specifications for each applicable essential requirement.
• Official Journal: Implementing Decision (EU) 2026/2274 published the EN 18286 reference on 14 October 2026, starting the conditional presumption (Article 1, recital (6)).
• Presumption: compliance with the listed clauses gives a presumption only in the standard’s scope, on Table ZA.1 row conditions, while the Official Journal retains the reference.
• Provisions covered: Table ZA.1 concerns Article 17(1) and the first sentence of Article 11(1), but not Article 17(2) to (4).
• Providers: EN 18286 mainly addresses high-risk AI system providers, also those not in the Union, and notes that providers can extend sectoral quality management systems (Clause 1, 0.1).
• Clause correspondence: Annex C pairs clauses with EN ISO/IEC 42001:2026, without equating requirements or concepts, and EN 18286 has no continual-improvement clause.
• Terms: the standards distinguish regulatory non-compliance from nonconformity with a requirement (EN 18286 3.1.15, ISO/IEC 42001 3.16).
• Regulatory procedures: EN 18286 has a compliance strategy, system identification, and technical documentation for Article 11 and Annex IV (4.4, 8.7, 8.9). It also has procedures for reporting serious incidents and handling non-compliance (9.6, 9.7).
• Legal duties: EU AI Act Articles 20 and 73 apply on their own conditions, also if the provider does not use EN 18286.
• Related ISO content: ISO/IEC 42001 includes documentation, incident communication, and corrective action, but no day-based reporting periods or market surveillance authority (A.6.2.7, A.8.2, A.8.4, A.8.5, 10.2).
• Impact assessment and concerns: EN 18286 has no AI system impact-assessment clause, but 10.1.1.2 adapts EN ISO/IEC 42001:2026 B.3.3 on reporting concerns.
• Risk management: EN 18286 8.2 addresses risk during each AI system’s life cycle, and the Table ZA.1 Article 17(1)(g) row requires Article 9 compliance for its presumption.

Certificates and the presumption of conformity

Article 40(1) of the EU AI Act gives a presumption of conformity through harmonized standards. It presumes conformity for high-risk AI systems or general-purpose AI models "which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union". The presumption applies "to the extent that those standards cover those requirements or obligations". As of October 2026, the Annex of Implementing Decision (EU) 2026/2274 lists one reference: EN 18286:2026. That Decision gives ISO/IEC 42001 no presumption of conformity through Article 40(1).

The conformity assessment of the Act is a different step. The provider of a high-risk AI system makes sure that the system undergoes the conformity assessment of Article 43 before it is placed on the market or put into service (Article 16(f)). For providers of high-risk AI systems, Article 43 sets the applicable conformity assessment procedure and its conditions.

In internal control, the provider verifies that its quality management system complies with Article 17 (Annex VI, point 2). In Annex VII, the notified body assesses the quality management system against Article 17 (Annex VII, point 3.2). Notified bodies issue certificates in the procedure of Annex VII (Article 44(1)). See Article 43.

ISO/IEC 42001 sets no certification procedure. Certification of an AI management system by a certification body is optional (Certification). An ISO/IEC 42001 certificate is not conformity with the Act and is not a certificate of Article 44. A presumption of conformity is not a certificate, and it is not the result of a conformity assessment.

ISO/IEC 42001 and the EU AI Act in Modulos

Modulos gives the EU AI Act, ISO/IEC 42001, and EN 18286 as different Frameworks, each with its own Requirements, at two levels:

Framework in Modulos	Organization level	AI System level
EU AI Act	OFF-1	MFF-1, for each AI system or general-purpose AI model in scope
ISO 42001	OFF-10 (Requirement table)	MFF-10 (Requirement table)
EN 18286	OFF-19: clauses 4 to 7 and 9.6 to 10	MFF-19: clause 8 and clauses 9.1 to 9.5

Use these steps to set up the Frameworks:

1. Make your EU AI Act decisions about scope, role, and classification. See Set up the Organization and AI System.
2. Contact Modulos if your organization does not have an organization AI System.
3. Add OFF-1 and OFF-10 to the organization AI System.
4. For each AI system in scope, add MFF-1 and MFF-10 to its AI System in Modulos.
5. If you are a provider and use EN 18286, also add OFF-19 to the organization AI System.
6. As a provider that uses EN 18286, add MFF-19 to each in-scope AI System in Modulos.
7. Follow the Requirement procedure for each Framework.

For the Requirement tables, see Operationalizing the EU AI Act in Modulos, Operationalizing ISO/IEC 42001 in Modulos, and the EN 18286 Requirement tables and steps.

The three Frameworks share some Controls:

• ISO 42001 and EU AI Act: at the AI System level, MFF-10 and MFF-1 share 9 Controls. This is 31% of the Controls of MFF-10 and 8% of the Controls of MFF-1. At the Organization level, OFF-10 and OFF-1 share no Control.
• EN 18286 and ISO 42001: MFF-19 and MFF-10 share 6 Controls (13% of MFF-19, 21% of MFF-10). OFF-19 and OFF-10 share 13 Controls (35% of OFF-19, 17% of OFF-10).
• EN 18286 and EU AI Act: MFF-19 and MFF-1 share 28 Controls (61% of MFF-19, 25% of MFF-1). OFF-19 and OFF-1 share 8 Controls (22% of OFF-19, 44% of OFF-1).

Thus, at the AI System level, EN 18286 shares more Controls with the EU AI Act than with ISO 42001. At the Organization level, it shares more with ISO 42001. An organization executes a shared Control one time, and its Evidence is then available to each Requirement that maps the Control. No Requirement becomes Fulfilled automatically through a shared Control. Its Requirement Owner does a Review of it first. The page Control overlap gives the figures for each pair of Frameworks.

Where to go next

EU AI Act guide

Scope, roles, dates, obligations, and penalties of Regulation (EU) 2024/1689

ISO/IEC 42001 guide

AI management system, Clauses 4 to 10, Annexes A to D, certification

EN 18286 guide

The harmonized standard for the quality management system, Annex ZA, and the OFF-19 and MFF-19 Frameworks

Harmonized standards

Article 40 and the presumption of conformity for the EU AI Act

ISO/IEC 42001 vs NIST AI RMF

The AI management system next to the four functions of NIST AI RMF 1.0

Control overlap

The number of Controls that two Modulos Frameworks share, at each level

Frameworks compared

Legal status and scope of each framework that Modulos documents, and the pages that compare two of them

Frequently asked questions

Answers to frequent questions that compare AI governance frameworks

Sources of this page

• Regulation (EU) 2024/1689 (EU AI Act), consolidated version of 27 July 2026: Articles 2, 3, 9, 16, 17, 26, 27, 40, 43, 44, 99, and 113, and Annexes VI and VII. EUR-Lex.
• Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, OJ L, 14.10.2026: recital (6), Articles 1 and 2, and the Annex. ELI.
• ISO/IEC 42001:2023 (first edition, 2023-12), Information technology — Artificial intelligence — Management system. ISO catalog page. Clauses: 1, 3.16, 4.1, 4.3, 4.4, 5.2, 6.1.2 to 6.1.4, 6.2, 8.2 to 8.4, 9.2, 9.3, 10.1, and 10.2. Annexes: A (A.6.2.7, A.8.2, A.8.4, A.8.5) and B (B.3.3).
• EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, approved by CEN on 12 July 2026. Clauses: 0.1, 1, 3.1.15, 3.1.23, 3.1.26, 4.4 (with 4.4.3.1), 8.2, 8.7, 8.9, 9.6, 9.7, and 10.1.1.2. Annexes: C (Table C.1) and ZA (Table ZA.1, WARNING 1).

Disclaimer

This page gives general information. It is not legal advice.