ISO 42001 vs EU AI Act: Do You Need Both?
Practitioner guidance, not legal advice.
One is a law, the other is a management standard, and the confusion between them is profitable for certification mills. The short answer to the title: the EU AI Act is mandatory if you are in scope and ISO 42001 is voluntary, but the work behind them overlaps enough that doing one properly carries you a long way toward the other.
What ISO 42001 Is
ISO/IEC 42001, published at the end of 2023, is the management system standard for AI, structurally the sibling of ISO 27001 for security. It does not tell you whether your AI is lawful; it tells you how to run AI responsibly as an organisation: leadership accountability, risk assessment processes, an inventory of AI systems, lifecycle controls, supplier management, monitoring and continual improvement. Like other ISO management standards, you can implement it quietly or have an accredited body certify you against it.
What the EU AI Act Requires
The Act is product and use regulation with legal force: risk classification of systems, prohibitions, transparency duties, and for high-risk systems a conformity regime with technical documentation, logging, human oversight and registration, on the timeline we map in our EU AI Act guidance for 2026. It binds you whether or not any auditor ever visits, and non-compliance is priced in percent of global turnover.
Where They Overlap
The overlap is substantial, and it is exactly the unglamorous middle: both want an inventory of your AI systems, documented risk assessment, defined roles and accountability, data governance, incident handling, monitoring over the lifecycle, and supplier due diligence. An organisation that has genuinely implemented ISO 42001 has, in the process, built most of the operational machinery the Act's obligations assume: the register, the risk process, the documentation habits, the review cadence.
That is why the sequencing argument usually lands in ISO 42001's favour for companies with many AI systems: the standard gives you the management frame once, instead of improvising it per system under deadline.
Where They Differ, and the Trap
Three differences matter. Scope: ISO 42001 governs your organisation; the Act regulates specific systems and uses, down to prohibited practices no management system can launder. Force: the Act is binding law with fines; ISO is voluntary with commercial value. And conformity: this is the trap, because an ISO 42001 certificate does not constitute presumption of conformity with the EU AI Act. The presumption mechanism in the Act runs through harmonised European standards developed for it by CEN and CENELEC, and certification bodies that imply an ISO certificate "makes you AI Act compliant" are overselling. Treat the certificate as strong evidence of process maturity, not as a legal conclusion.
So Do You Need Both?
If you deploy or provide AI in the EU, the Act is not optional, so the real question is whether to add ISO 42001. It earns its cost when customers or procurement ask for demonstrable AI governance (it is becoming an RFP checkbox in regulated industries), when you run enough AI systems that per-system improvisation stops scaling, or when you already run ISO 27001 and can extend the machinery cheaply. It is premature when you have one or two systems and no buyer pressure: do the Act's work directly and revisit certification when someone pays for it.
A Sensible Certification Path
For companies that decide to pursue it: inventory and risk process first, since both regimes need them anyway; write the management system around what you actually do rather than template prose; run an internal audit against both the standard and the Act's obligations in one pass; then bring in the certification body. Done in that order, certification is a formalisation of working practice rather than a documentation theatre project.
Mapping your current state against both regimes in one assessment is the usual starting point, and that is what our AI governance consulting service does: one gap analysis, two compliance tracks, no duplicated work.