Law versus management standard
The AI Act, in force since August 2024 with obligations phasing in through 2026 and 2027, regulates by risk tier: prohibited practices, high-risk systems with extensive requirements (risk management, data governance, documentation, human oversight, accuracy and robustness, post-market monitoring), transparency duties for certain systems, and rules for general-purpose AI models. It binds anyone placing AI on the EU market or affecting people in the EU, with enforcement and fines. ISO 42001 is none of that: no legal force, no risk tiers, no penalties. It is the organizational operating system: how you govern AI across its lifecycle, auditable by a certification body.
Where they reinforce each other
Read the AI Act's high-risk requirements next to ISO 42001 and the family resemblance is deliberate: both demand risk management, data governance, documentation, human oversight, monitoring, and incident handling. An operating ISO 42001 AIMS gives you the structures the Act assumes you have: an inventory of AI systems and their roles, impact and risk assessments, lifecycle records, and accountable owners. European standardization bodies are developing harmonized standards to support AI Act conformity, and ISO 42001 is widely used as the management backbone while those mature.
Which one you need
- Operating in or selling into the EU with in-scope AI: the Act applies to you as law; the only question is how you organize compliance. An AIMS is the strongest available answer.
- Outside EU scope but selling AI to enterprises: ISO 42001 is becoming the procurement question regardless of jurisdiction, because buyers need one verifiable signal across all their vendors' geographies.
- Both, sequenced: map your AI systems and their Act classifications first (it determines urgency and scope), then build the management system once to serve the Act, ISO 42001, and customer due diligence together. Parallel compliance programs for overlapping requirements is the classic way to pay twice.
The auditor's framing for your board
The AI Act is the exam; ISO 42001 is the study system. You can pass an exam without a study system, once, under stress, with luck. Organizations facing repeated exams (regulators, customers, incidents, new AI deployments every quarter) build the system, because it converts each new obligation from a project into an update.