ISO/IEC 42001 and the EU AI Act

No. ISO/IEC 42001 is an international standard, not a harmonised European standard. It carries no Annex ZA mapping and therefore confers no automatic "presumption of conformity" under Article 40 of the AI Act. That presumption comes only from following harmonised standards whose references are published in the EU Official Journal (OJEU). That said, ISO 42001 certification shows strong governance maturity, and its controls map closely to the harmonised standards being drafted by CEN-CENELEC, so certified organisations are well-positioned to make the step to full conformity once harmonised standards land.

Article 40 of the AI Act says that an AI system that fully or partly complies with harmonised standards whose references have been published in the Official Journal of the EU is presumed to comply with the corresponding AI Act requirements. This is a legal shortcut: follow the standard, and regulators presume you meet the relevant obligations without further proof. No harmonised AI Act standards have yet been published in the OJEU (as of June 2026), so no presumption of conformity is currently available from any standard.

CEN-CENELEC Joint Technical Committee 21 is developing a family of harmonised AI standards under a European Commission standardisation request issued in May 2023. The work covers approximately 10 areas including risk management, data governance, record-keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management, and conformity assessment. The draft prEN 18286 (AI management system) is the most directly relevant to ISO 42001, as it maps closely to 42001 controls - meaning organisations with an existing ISO 42001 implementation can largely reuse those controls once prEN 18286 is finalised and published in the OJEU.

ISO/IEC 42001 covers AI systems and related governance processes broadly. It addresses the lifecycle of AI from development through deployment and monitoring. For general-purpose AI (GPAI) model providers, the AI Act's Chapter V obligations (technical documentation, copyright policy, training data summary, and - for systemic risk - adversarial testing and incident reporting) go beyond what a management system standard covers. GPAI providers should address those specific obligations directly, with or without ISO 42001 certification.

The two are not mutually exclusive. ISO 42001 certification now gives you a structured governance framework, documented risk management processes, trained staff, and an auditable record that shows regulators you take AI governance seriously. When harmonised standards arrive, your certified controls will give you a significant head start. The risk of waiting is that AI Act obligations are already in force for some categories (AI literacy and prohibited practices from 2 February 2025; GPAI and penalties from 2 August 2025) and a governance framework is useful regardless of which standard it is anchored to.