Does ISO 42001 certification make you EU AI Act compliant?

No. ISO/IEC 42001 certification shows that an AI management system exists and was audited against the standard. The EU AI Act is law with specific duties by role and risk tier. A certificate can support your evidence, but it does not by itself establish compliance with the Act.

Myth: a certificate equals legal compliance

Fact: certification is a voluntary assessment of a management system. The Act sets obligations such as prohibited practice limits, AI literacy, high-risk requirements, transparency duties and general-purpose model rules. Whether you meet them depends on your systems, roles and uses, which a management system certificate does not decide.

Myth: the standard and the Act are unrelated

Fact: they overlap in useful ways. Both expect risk management across the lifecycle, documentation, data governance and monitoring. The Act's Article 17 quality management system and Article 9 risk management ask for the kind of documented process a management system provides. Building one helps with the other.

We have not confirmed whether ISO/IEC 42001 is cited as a harmonised standard under the Act, or what presumption of conformity, if any, that would give. Check the Commission and standards body announcements before making claims.

What the Act adds beyond a management system

• Classification of each system by use, including Annex III.
• Role specific duties for providers, deployers, importers and distributors.
• Transparency duties under Article 50.
• Fundamental rights impact assessment for certain deployers.
• Serious incident reporting.
• Registration, conformity assessment and authority cooperation for high-risk systems.
• Rules for general-purpose model providers.

What the standard adds beyond the Act

• A certifiable process view across all AI, not only high-risk.
• Controls for areas such as third party relationships and system lifecycle.
• Management review and continual improvement.

A sensible way to combine them

1. Build the AI inventory once.
2. Classify each system against the Act, and note the role.
3. Use the management system to run policy, risk, audit and review.
4. Map Act duties to controls, so one piece of evidence serves both.
5. Keep a gap list for law specific items such as registration and incident reporting.

Safeguard's compliance and evidence automation can hold control mappings and evidence. It does not certify you against ISO or decide legal compliance.

What to say to customers

Say what is true: "We operate an AI management system aligned to ISO/IEC 42001" if that is the case, and "we are in scope of the EU AI Act for these systems, in these roles". Say you hold the certificate only if you do. Avoid saying "AI Act compliant" as a blanket claim.

Whatever route you choose, keep the evidence in one place and the claims plain. Customers read marketing pages and questionnaires side by side, and any mismatch becomes the question they ask first.

Quick check

Sources

• Cloud Security Alliance, ISO 42001 requirements explained
• AI Act Article 17
• AI Act Article 9
• European Commission, AI Act regulatory framework

Last reviewed: 19 October 2026.