What ISO 42001 Certification Tells the Board About AI Act Readiness

ISO 42001, published in December 2023, sets requirements for establishing, implementing, maintaining and continually improving an AI management system. It follows the same high-level structure as ISO 27001 and covers AI policy, roles and responsibilities, risk and impact assessment, resources and management review.

A certified management system can organise evidence the AI Act requires, including risk management, documentation and the oversight of AI systems. Certification provides independent assurance over the AI management system within its defined scope. However, whether a specific AI system meets the Act's requirements is assessed system by system. Leadership should establish the certificate's scope and verify the certification body's accreditation.

Under the AI Act, conformity with harmonised standards whose references are published in the EU's Official Journal gives a presumption of compliance with the requirements those standards cover. ISO 42001 certification does not provide that presumption; the supporting European standards are still being developed. Providers should therefore plan how to demonstrate compliance with the applicable requirements, while tracking the standards' development.

The AI Act assigns different obligations to providers, who develop an AI system or have one developed and place it on the market or put it into service under their own name or trademark, and to deployers, who use a system under their authority. For high-risk systems, the provider carries out conformity assessment before placing the system on the market or putting it into service, and registers certain systems in the EU database. The deployer uses the system in line with the provider's instructions, assigns competent human oversight, monitors its operation and keeps the logs under its control.

A deployer can become a provider, for example by putting its own name or trademark on a high-risk system, substantially modifying it, or changing its intended purpose so that it becomes high-risk.

High-risk classification depends on the system's intended purpose and the Act's specific criteria. Management should document the classification for each system against those criteria.

A certified management system may already include the processes behind these obligations, and each needs evidence for the specific system.

Conformity assessment

Providers of high-risk systems must complete conformity assessment before the system reaches the market or is put into service. Management should identify which assessment route applies to each system and what technical documentation it requires.

Information for deployers

Providers must design high-risk systems so that deployers can interpret their outputs and use them appropriately, and must supply instructions for use. Deployers should confirm they have received that information and built it into their oversight.

Fundamental rights impact assessment

Specified deployers must complete one before deploying certain high-risk systems, including bodies governed by public law, private entities providing public services, and deployers of systems used for creditworthiness assessment or life and health insurance pricing. Management should establish whether the organisation qualifies for each system. An impact assessment carried out under the management system can support it, provided it meets the Act's content requirements.

The AI Act entered into force in August 2024. The prohibitions on certain AI practices and the AI literacy duty have applied since February 2025, and the obligations for general-purpose AI models since August 2025, with a transition period for models already on the market. Under the enacted timetable, the Act generally applies from 2 August 2026, including the requirements for high-risk systems in the listed use areas. Requirements for high-risk AI linked to regulated products apply from 2 August 2027. Management should establish whether transitional provisions apply to systems or models already on the market.

In November 2025, the Commission proposed amendments that would link the start of the high-risk requirements to the availability of standards and support tools, with latest dates of December 2027 for the listed use areas and August 2028 for regulated products. These are proposals and may change during the legislative process. Plans should rest on the enacted dates while tracking the proposal.

A system-level assessment should answer four questions before leadership approves AI investment or use.

Role and classification

What do we provide or deploy, and which obligations apply to each system?

Certification coverage

Which activities and systems fall within the certified management system?

Readiness

What evidence is missing, who owns it, and which launch or deployment decisions depend on it?

Timing

Which legal deadlines apply, and which proposed changes remain uncertain?