ISO 42001 vs EU AI Act: Understanding the Difference and Why Your Organisation Needs Both

The Foundational Distinction

ISO 42001 is a management system standard — it tells you how to govern AI. The EU AI Act is binding European law — it tells you what specific obligations apply to specific AI systems. These are different regulatory instruments with different legal status, different conformity assessment mechanisms, and different consequences for non-compliance. Understanding this distinction is the prerequisite for building a governance programme that satisfies both.

An ISO 42001 certificate demonstrates that your organisation has established a systematic approach to managing AI risks and opportunities — that you have an AI policy, conduct AI risk assessments, maintain AI documentation, monitor performance, and review your AI governance at management level. It says nothing specific about whether any particular AI system in your portfolio is legally compliant with EU AI Act obligations.

An EU AI Act conformity assessment demonstrates that a specific AI system — one that falls within the Act's scope and risk classification — meets the prescriptive technical requirements that the Act mandates for that system type. It says nothing about whether your organisation has a systematic governance approach to AI management broadly.

Access the complete guide

All 15 pages — practical implementation guidance, checklists and templates. Free, instant access.

No spam. No sales calls. AjaCertX will email you a copy for reference.

Guide unlocked ✓

A copy has been sent to your email for reference.

The Six-Step Integrated Programme

Step 01

Conduct an AI portfolio inventory

List every AI system your organisation develops, deploys or uses. Include AI embedded in third-party software platforms. Classify each by EU AI Act risk tier: prohibited, high-risk (Annex III), limited risk, or minimal risk. Flag those requiring GPAI model assessment. This inventory is the foundation of both your ISO 42001 scope definition and your EU AI Act compliance programme.

Step 02

Implement ISO 42001 as your governance architecture

Establish the management system: AI policy, AI risk assessment process, defined roles and responsibilities (including an AI Officer or equivalent function), documentation requirements, monitoring and measurement programme, internal audit plan, and management review schedule. This architecture creates the organisational discipline within which EU AI Act-specific compliance work is performed and maintained.

Step 03

Apply EU AI Act prescriptive requirements to high-risk systems

For each Annex III high-risk AI system: implement the Article 9 risk management system (which is more prescriptive than ISO 42001 risk assessment requirements), document Article 10 data governance, produce the Annex IV technical file, implement Article 14 human oversight measures, assess accuracy and robustness against Article 15 requirements, and determine the appropriate conformity assessment route.

Step 04

Address EU AI Act obligations with no ISO 42001 equivalent

Register high-risk AI systems in the EU AI Act database before deployment. Apply CE marking to high-risk AI embedded in regulated products. Implement the GPAI model transparency and documentation requirements if you develop or provide general-purpose AI models. These are EU AI Act-specific obligations that must be addressed as standalone workstreams.

Step 05

Build a combined documentation framework

Design your documentation architecture so that a single validation and governance exercise produces evidence for both frameworks. Your AI system documentation should simultaneously satisfy ISO 42001 documentation requirements and EU AI Act Annex IV technical file requirements. Your risk assessment documentation should simultaneously satisfy ISO 42001 Clause 6.1 and EU AI Act Article 9. This integration eliminates significant duplicate documentation effort.

Step 06

Pursue ISO 42001 certification as your governance signal

ISO 42001 certification provides a credible, third-party validated signal of AI management system maturity to customers, investors, and regulators. It is not a substitute for EU AI Act compliance, but it is a meaningful governance credential that increasingly influences enterprise procurement decisions and regulatory engagement posture. Target certification within 12 months of beginning programme implementation.

ISO 42001 and EU AI Act Programme Readiness

AI portfolio inventory completed — all AI systems identified, classified by EU AI Act risk tier

ISO 42001 management system implemented — AI policy, risk assessment, roles, documentation, monitoring, management review

EU AI Act Annex III classification completed by someone with specific regulatory knowledge

EU AI Act Annex IV technical documentation produced and maintained for each high-risk system

High-risk AI systems registered in EU AI Act database before deployment

ISO 42001 certification programme in progress with target date established

Customer-facing AI governance documentation package available for enterprise due diligence requests

Building your ISO 42001 and EU AI Act programme?

AI Governance specialists. Integrated programme proposal within 48 hours.

Get a Proposal →WhatsApp

About AjaCertX

AjaCertX is a specialist compliance, certification and assurance partner serving technology organisations globally. Our AI Governance practice delivers ISO 42001 implementation, EU AI Act compliance programmes, and integrated AI governance frameworks.