Updated 16 October 2026. The Digital Omnibus on AI was published as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. The timetable below reflects the amended dates.
If you lead an AI product or its compliance, you have almost certainly been sold ISO 42001 as the answer to the EU AI Act. A vendor, a consultant or a procurement questionnaire has quietly implied that the certificate settles your Act exposure. It does not, and the gap between the two is not a technicality. One is a voluntary management-system standard you can certify against today. The other is binding EU law with a phased timetable. Confusing them is how AI teams end up believing they are covered when they are not. This piece sets out exactly what a 42001 certificate is, what the Act is, why the two can never be interchangeable, and where the Act actually stands as of today.
Two different things people conflate
ISO 42001 and the EU AI Act operate on different planes. ISO 42001 is a standard published by international standards bodies; you adopt it because you choose to, and you can demonstrate conformity through certification. The EU AI Act is a regulation; it applies to you whether or not you have heard of it, and no certificate exempts you from it.
The dangerous shorthand is the phrase "presumption of conformity". Under EU product law, certain standards can, once formally recognised, let you presume you meet a legal requirement. The entire argument of this article is that ISO 42001 cannot do that for the AI Act. Not now, and not in its current form ever. Understanding why protects you from buying a certificate and mistaking it for legal cover.
What ISO 42001 actually is (certifiable, real)
Start with the good news, because 42001 is genuinely useful and the certification market around it is real, not vapour. ISO 42001 is a management-system standard for artificial intelligence, in the same family shape as an information-security management system under ISO 27001. It gives you a structured way to govern how AI is developed, deployed and monitored across your organisation: policies, roles, risk processes, controls and evidence.
Accredited certification against it exists today. In the US, ANAB accredits certification bodies for it; in the UK, UKAS granted its first accreditation, to BSI, on 15 January 2026. The criteria standard that certification bodies are assessed against, ISO/IEC 42006:2025, was published on 7 July 2025. So when a certification body offers you an accredited 42001 certificate, that is a substantive thing backed by an accreditation infrastructure, not a self-issued badge.
What that certificate demonstrates is that you run a credible AI management system. It is strong evidence of governance maturity, and it is the right place to start if you want a defensible internal foundation. If you are weighing up that step, our ISO 42001 / AI governance work is the natural next move. But note carefully what the certificate is: proof that you manage AI well, assessed against an international standard. It is not, and cannot be, proof that you comply with a specific EU regulation.
What the AI Act actually is (law, phased dates)
The EU AI Act is a regulation with direct legal force, and it does not arrive all at once. Its obligations switch on in stages, and getting the stages right matters because the wrong date leads to the wrong plan.
The Act entered into force on 1 August 2024. Prohibited practices have applied since 2 February 2025. Obligations for general-purpose AI models, and the penalties under Article 99, have applied since 2 August 2025 - not 2026 - so the sanctioning framework is already live even where the substantive obligations it backs are still phasing in. General application, including the Article 50 transparency obligations, started on 2 August 2026. The high-risk obligations come later, on the dates set by the Digital Omnibus: 2 December 2027 for Annex III systems and 2 August 2028 for AI embedded in products covered by Annex I.
The point for a compliance lead is that the Act imposes obligations directly, on a calendar. A 42001 certificate does not reset that calendar, pause any of these dates, or discharge any of these obligations. They are legal duties that sit on you independently of any standard you have adopted.
Why ISO 42001 can never be a harmonised standard
This is the structural reason 42001 can never hand you a presumption of conformity, and it is worth understanding precisely because it is not a matter of opinion.
Under EU law, a presumption of conformity flows only from a harmonised standard. A harmonised standard, by definition under Regulation 1025/2012, must be a European standard, produced by CEN, CENELEC or ETSI, on the basis of a request from the European Commission. That is the whole mechanism. ISO and IEC are international standards bodies. They are not European standards organisations. ISO 42001 is therefore an international standard, which means it structurally cannot be cited as a harmonised standard under the AI Act. The reasoning is airtight: a certificate against an international standard sits outside the legal category that grants the presumption.
There is a second, blunter point on top of that. Even setting the international-versus-European question aside, no AI Act harmonised standard has been cited in the Official Journal at all yet. A presumption of conformity under the Act is therefore available to nobody at this moment, from any standard. So there are two independent reasons 42001 does not buy you a presumption of conformity: it is the wrong kind of standard, and in any case the mechanism has not produced a single citable standard so far.
The Commission said this out loud
You do not have to take a consultant's word for the distinction, because the European Commission has stated it directly. Its standardisation FAQ, dated 10 March 2026, names ISO 42001 specifically:
although ISO/IEC 42001:2023 helps to set up an AI management system, its goals and definitions are not aligned with the quality management system that is required under the AI Act. This is why the Commission has requested the development of a new standard...
Read that carefully. The Commission acknowledges that 42001 helps you set up an AI management system, which is exactly the useful thing described above. And in the same breath it says the goals and definitions of 42001 are not aligned with what the AI Act requires, which is why a separate, new standard is being developed. That is the official position, in the Commission's own words. Anyone telling you a 42001 certificate maps onto AI Act conformity is contradicting the regulator directly.
So what does a 42001 certificate buy you?
Given all of that, it would be easy to swing to the opposite error and dismiss 42001. That would also be wrong. A certificate is worth having for what it genuinely delivers.
It gives you a real, accredited, third-party assessed AI management system. It is a signal to enterprise buyers and partners that you govern AI deliberately rather than ad hoc. It builds the internal machinery, the risk processes, the documented controls and the evidence trail, that you will need anyway when AI Act obligations bite and when whatever European standard emerges eventually arrives. In practical terms, a mature 42001 system is a head start on Act readiness, because much of the underlying governance work overlaps even though the certificate itself confers no legal presumption.
What it does not buy you is a defence to the AI Act. It does not grant a presumption of conformity. It does not exempt you from Article 50, Article 99 or Article 101. It does not move a single one of the dates above - only an amending regulation can, as the Digital Omnibus did. Treat it as foundation, not as finish line. If a buyer's questionnaire or your own board treats the certificate as AI Act compliance, correct the record rather than let the assumption harden into a false sense of safety.
Where the AI Act stands right now
Finally, the part that moved. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026. It moved the high-risk obligations for Annex III systems to 2 December 2027 and for AI embedded in Annex I regulated products to 2 August 2028. It also softened the AI literacy obligation, so it now falls mainly on the Commission and Member States to promote, and extended some simplifications for smaller companies.
What it did not change matters as much. Prohibited practices still apply, the general-purpose AI rules still apply, and general application from 2 August 2026 still happened. The extra time is for the high-risk regime only - and it is time to build governance, not a reason to wait. Check the consolidated text on EUR-Lex for the provisions that apply to your role.
One last caution, because it comes up constantly. We are not aware of any AI Act enforcement decision imposing a fine. The viral claims circulating online about a multi-million-euro Belgian fine, or a "first fines" figure, are fabrications produced by content farms. There is no AI Act fine on record. If a vendor or article is using a fine figure to sell you urgency, that is a reason to distrust the source, not to act on the number.
The honest summary is simple. Get 42001 if you want a credible AI management system and a genuine head start; it is real and worth it. Just do not let anyone tell you it is the AI Act. The law stands on its own timetable, the Commission has said the two are not aligned, and the presumption of conformity that would bridge them does not exist for anyone yet.
Governing AI with ISO 42001?
AI management system gap analysis, implementation, impact assessments and independent internal audits.