EU AI Act and ISO 42001

The European AI Act is the first comprehensive AI legislation in the world. ISO 42001 can help you comply with it, but it does not guarantee full compliance. The Dutch government (Rijksoverheid) provides current information on the Dutch implementation. On this page we explain how the two relate to each other.

What is the EU AI Act?

The AI Act is a European regulation that sets requirements for AI systems. Its aim: make AI trustworthy and safe, protect fundamental rights, and keep room for innovation. The European AI Office coordinates the implementation.

The law entered into force on 1 August 2024. Its different parts apply in stages. Not everything applies at once. Organisations get time to prepare.

The AI Act uses a risk-based approach. The higher the risk of an AI system, the stricter the requirements.

The risk categories of the EU AI Act

Prohibited AI

Some AI applications are simply banned. These are applications that pose unacceptable risks to fundamental rights.

Prohibited since 2 February 2025:

Social scoring by governments (rating and classifying people based on social behaviour)
Manipulative AI that misleads or exploits people
Biometric categorisation systems based on sensitive characteristics
Real-time biometric identification in public spaces by law enforcement (with exceptions)
Emotion recognition in the workplace and in education
Facial recognition databases built by scraping

High-risk AI

AI systems with a significant risk to health, safety or fundamental rights. These face the strictest requirements.

Examples of high-risk AI:

AI in medical devices
AI for access to education and vocational training
AI for recruitment and selection
AI for credit assessment
AI in critical infrastructure
AI for law enforcement
AI in migration management

What providers of high-risk AI must do:

Set up a risk management system
Ensure data governance and data quality
Keep technical documentation
Build in logging and traceability
Be transparent towards users
Enable human oversight
Ensure robustness, accuracy and cybersecurity
Carry out a conformity assessment
Affix the CE marking
Register in the EU database

AI with limited risk

AI systems with specific transparency obligations. Users must know that they are dealing with AI.

Examples:

Chatbots (must disclose that they are AI)
Emotion recognition (inform users)
Deepfakes (label as artificial)
AI-generated content (make it recognisable)

AI with minimal risk

All other AI. No specific obligations, but voluntary codes of conduct are encouraged.

Is my AI high-risk? (quick self-check)

The weight of your obligations depends on the risk category of your AI. Below is a decision table to quickly work out where your system falls. Start at the top: the first row that fits determines your category.

Does this apply to your AI?	Category	What it means
Social scoring, manipulation, facial recognition via scraping, emotion recognition at work or in education	Prohibited	Stop using it. This has not been allowed since 2 February 2025
Helps decide on recruitment, credit, education, healthcare, critical infrastructure or law enforcement	High-risk	Strictest requirements, conformity assessment required
Chatbot, deepfake or AI content that people interact with directly	Limited risk	Transparency obligation: make clear that it is AI
None of the above, no direct impact on people	Minimal risk	No specific requirements, codes of conduct advised

Not sure whether it is limited or high-risk? Check Annex III of the AI Act for the exact list of high-risk applications. An AI impact assessment helps you get a clear view of the impact on people.

The timeline of the EU AI Act

The AI Act applies in stages. The deadlines for high-risk AI are expected to be postponed through the Digital Omnibus package . The political agreement of 7 May 2026 still needs formal approval from the Council and Parliament.

Date	What applies	Status
2 February 2025	Prohibited AI applications, AI literacy requirement	In force
2 August 2025	Requirements for general-purpose AI (GPAI) models	In force
2 August 2026	Enforcement by national supervisory authorities begins	In force
2 December 2027	Requirements for high-risk AI (Annex III)	Planned postponement
2 August 2028	Requirements for high-risk AI in regulated products	Planned postponement

The AI literacy requirement has applied since 2 February 2025 and has not been postponed. National supervisory authorities get formal enforcement powers from August 2026. Read more about the AI literacy requirement.

The original deadline for high-risk AI was August 2026. The postponement to December 2027 is a planned change and is not yet final. Do not plan around the postponement. Build your AI governance now.

How does ISO 42001 help?

ISO 42001 and the AI Act overlap significantly. The standard provides a framework for many of the requirements in the law.

What ISO 42001 does cover

Risk management system. The AI Act requires a risk management system for high-risk AI. ISO 42001 describes exactly how to set one up: identify, assess and treat risks.

Governance and responsibilities. The law requires clear accountability. ISO 42001 asks for defined roles, powers and responsibilities.

Documentation. Both ask for documented processes, risk analyses and control measures.

Impact assessment. The AI impact assessment in ISO 42001 fits the requirement to assess the impact on fundamental rights.

Data governance. ISO 42001 Annex A contains measures for data quality and data management.

Lifecycle management. The standard pays attention to the entire lifecycle, just like the AI Act.

Monitoring and logging. Both ask for logging and monitoring of AI systems.

Training and awareness. The AI literacy requirement aligns with the competence and awareness requirements in ISO 42001.

What ISO 42001 does not cover

Conformity assessment. The AI Act requires a formal conformity assessment for high-risk AI. ISO 42001 certification is not the same thing. You must follow a separate AI Act conformity procedure.

CE marking. If your AI is part of a product, you must affix the CE marking. This is a separate process.

EU database registration. High-risk AI must be registered in a European database. This is separate from ISO 42001.

EU Declaration of Conformity. You must be able to provide a signed EU declaration of conformity.

Specific technical requirements. The AI Act contains detailed technical requirements that are more specific than ISO 42001. Examples include requirements for datasets, bias detection and human oversight.

Cooperation with authorities. The AI Act contains specific requirements for cooperation with supervisors, incident reporting and market surveillance.

ISO 42001 is not a harmonised standard under the AI Act. Certification does not give a “presumption of conformity” with the law. It does, however, provide a strong basis for compliance.

The practical approach

If you have nothing in place yet

Start with ISO 42001. It gives you a systematic approach to AI governance. You build the structures you also need for the AI Act. Risk management, documentation, governance, monitoring.

At the same time, follow the developments around the AI Act. Which of your AI systems are high-risk? When do the requirements apply?

If you have ISO 42001 or are working towards it

You have a head start. Use your AI management system (AIMS) as the basis for AI Act compliance.

Gap analysis. Compare your system with the AI Act requirements. What is still missing? Typically: the formal conformity procedure, CE marking and database registration.

Extend where needed. Add the missing elements. These are often procedural matters, not a complete rebuild.

If you have ISO 27001

The combination of ISO 27001 and ISO 42001 is powerful. ISO 27001 covers the information security side, ISO 42001 the AI governance side. Together they form a solid basis for AI Act compliance.

EU AI Act sanctions and fines

The AI Act has teeth. The fines are substantial:

Infringement	Maximum fine
Prohibited AI practices	€35 million or 7% of worldwide turnover
Failure to meet high-risk requirements	€15 million or 3% of worldwide turnover
Providing incorrect information	€7.5 million or 1% of worldwide turnover

For SMEs and start-ups, lower maximums apply (the lower of the two amounts).

The EU AI Act in the Netherlands

In the Netherlands, the AI Act is enforced by several supervisory authorities, depending on the sector. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) plays a role where AI and privacy meet. Sector-specific supervisors (DNB, the Dutch Central Bank , for finance, and IGJ, the Health and Youth Care Inspectorate , for healthcare) oversee their own domains. You can find more information on the Dutch implementation at the Dutch government (Rijksoverheid) .

A coordinating mechanism is being set up to prevent fragmentation.

For organisations, this means: know who your supervisor is. Prepare for supervision and possible enforcement.

What should businesses that use AI do now?

It is tempting to wait until everything is final. But the basic steps already apply, regardless of the postponement for high-risk AI. Below, per phase, what you do and by which deadline.

When	What you do	Deadline
Now	Inventory your AI systems and classify them by risk	Ongoing
Now	Stop prohibited applications	Already in force (Feb 2025)
Now	Arrange AI literacy for your staff	Already in force (Feb 2025)
Now	Start with ISO 42001 as the basis for your governance	Voluntary, but advised
2026 to 2027	Build your AIMS, carry out risk and impact assessments	Before the high-risk requirements
Before Dec 2027	Conformity assessment and EU database registration for high-risk AI	Expected 2 December 2027

Enforcement by national supervisory authorities begins in August 2026. Even if the high-risk requirements move to December 2027, build the right structures with ISO 42001 now. The core principles will not change.