Skip to Content
ISO 42001Latest: developments in 2026

ISO 42001 in 2026: the current situation

ISO 42001  is still a young standard, published in December 2023. A lot has happened since then: the number of certifications is growing, the EU AI Act is coming into force in stages, and the rules for high-risk AI have been postponed again. On this page we track the most important developments.

Status (July 2026)

The rules for high-risk AI systems have been shifted again through the Digital Omnibus package. A political agreement of 7 May 2026 still needs formal approval. Check the current timetable with the Dutch government (Rijksoverheid) .

How fast is ISO 42001 growing in the Netherlands?

In 2025, DNV  issued the first Dutch ISO 42001 certificate to Metyis, an international data and AI company. Since then the number of certified organisations has grown steadily, but awareness of the standard is still relatively low compared with established standards such as ISO 27001 or ISO 9001.

That is expected to change quickly. Three developments are speeding up adoption:

  1. The EU AI Act is becoming concrete. Organisations that develop or use AI are looking for a demonstrable framework to comply with the law. ISO 42001 is the most obvious answer for that.
  2. Clients and tenders are asking for it. Just as ISO 27001 a few years ago, ISO 42001 is moving from “nice to have” to a requirement in contracts and tenders, especially in public procurement and with enterprise clients.
  3. Certification bodies are expanding their offer. DNV , TÜV , BSI , Kiwa  and LRQA  now all offer ISO 42001 certification. More capacity means shorter waiting times for audits.

What has recently changed around the EU AI Act?

The AI Act timeline is not standing still. The most important recent development is the postponement of the requirements for high-risk AI systems, originally planned for August 2026.

DateWhat happens
February 2025Prohibited AI practices and the AI literacy requirement take effect
August 2025Requirements for general-purpose AI (GPAI) models
7 May 2026Political agreement on postponing the Annex III high-risk requirements through the Digital Omnibus package
December 2027New proposed date for requirements on high-risk AI systems (subject to formal approval)
August 2028Requirements for high-risk AI in regulated products

Read the full background and what this means for your organisation on the page EU AI Act and ISO 42001.

Postponing the legal deadline is no reason to wait before preparing. Organisations that start with ISO 42001 now do not depend on the exact enforcement date, and they have a head start once the requirements apply.

What does this mean for your ISO 42001 project?

Whether you are just starting or already under way: a few practical points for 2026.

If you still need to start: the standard itself does not change because the AI Act is postponed. The step-by-step plan and the requirements of the standard remain unchanged. Starting early means less pressure once clients or legislation do require it.

If you are already certified: keep your AI inventory up to date. New AI systems you put into use must go through the risk and impact assessment process again.

If you are waiting for more clarity: that is a real risk. Certification projects take six to twelve months. Anyone who waits until the AI Act is fully enforced will start too late.

More information

Supplier managementEU AI Act and ISO 42001