Skip to Content
ISO 42001ISO 42001 vs EU AI Act

ISO 42001 vs EU AI Act: what is the difference?

ISO 42001  and the EU AI Act  are often mentioned in the same breath, but they are fundamentally different. The AI Act is a law. ISO 42001 is a voluntary standard. The Dutch government (Rijksoverheid)  enforces the law. A certification body assesses against the standard. On this page, we explain the difference and show how the two work together.

Law versus standard: the core difference

The EU AI Act is binding legislation. If you do not comply, you risk fines of up to €35 million or 7% of your global turnover. ISO 42001 is an international standard that you choose to adopt voluntarily. It is not mandatory, but it provides a framework for handling AI responsibly.

The main differences are listed below.

AspectEU AI ActISO 42001
TypeLaw (regulation)International standard
Mandatory?Yes, for those it applies toNo, voluntary
ScopeAI systems on the EU marketYour whole AI management system
ApproachRisk-based, per AI systemManagement system for the organisation
Who checks?National supervisory authoritiesIndependent certification body
Consequence of failureFines and enforcementNo certificate
EvidenceDeclaration of conformity, CE markingISO certificate

Does ISO 42001 help with AI Act compliance?

Yes, but it is not a guarantee. This is the most important misunderstanding. ISO 42001 covers much of what the law requires: risk management, governance, documentation, impact assessment, monitoring and AI literacy. You build the same structures with it that the AI Act also requires.

ISO 42001 is not a harmonised standard under the AI Act. A certificate does not create a “presumption of conformity” with the law. It provides a solid foundation, but you still have to demonstrate that you meet the legal requirements yourself.

What ISO 42001 does not replace are the formal legal steps. Think of the conformity assessment for high-risk AI, the CE marking, registration in the EU database and the EU declaration of conformity. You carry these out separately from your certification.

Supervisor versus certifier

The difference also lies in who assesses you. A certification body such as DNV or BSI audits your AI management system and issues a certificate. That is a voluntary choice on your part.

A supervisory authority enforces the law. In the Netherlands, the supervisory structure for the AI Act is still being set up. Several supervisory authorities are expected to have a role per sector. Check the current position with the Dutch government (Rijksoverheid) .

When do you need both?

For most organisations with serious AI, the answer is: both, but for different reasons.

SituationWhat you need
You have high-risk AI on the EU marketAI Act compliance is mandatory. ISO 42001 helps you get there faster
You want to give customers confidenceISO 42001 certificate as evidence of responsible AI
You only use minimal-risk AIThe AI Act sets few requirements. ISO 42001 remains useful for governance
You want to demonstrate that you are in controlISO 42001 as the framework, AI Act steps as the legal addition

Start with ISO 42001 if you do not yet have AI governance. You build the structures you also need for the AI Act, and you have a certificate to show customers. You add the legal steps afterwards, in a targeted way.

The practical order

Starting from scratch? Begin with your AI management system according to ISO 42001. Take stock of your AI, assess the risks and set up your governance. That covers most of the AI Act requirements.

Do you have high-risk AI? Then also do a gap analysis against the law. Which formal steps are still missing? Often these are procedural matters: conformity assessment, CE marking and registration. No full rebuild is needed.

See the full step-by-step plan to see how to approach this in phases.

Further reading

Sources

High-risk AI classificationAI literacy