EU AI Act vs ISO/IEC 42001
These two are often mentioned in the same breath but they are different instruments. One is binding law with dates attached; the other is a voluntary management-system standard you can be certified against.
EU AI Act
Binding EU regulation. Obligations depend on your role (provider or deployer) and the risk category of the system. AI literacy obligations have applied since 2 February 2025. Firms using AI should be able to show what measures they have taken to help relevant staff use it responsibly.
- Already applicable: AI literacy obligations have applied since 2 February 2025. Firms using AI should be able to show what measures they have taken to help relevant staff use it responsibly.
- Applicable now: From 2 August 2026, specific AI interactions and certain AI-generated or manipulated content must be disclosed or marked. Whether that applies depends on how the system is used. National authorities also begin exercising relevant enforcement powers from this date.
- Preparation window: The main requirements for standalone high-risk systems are scheduled to apply from 2 December 2027. Systems used to analyse, filter or evaluate people in an employment context fall within the high-risk employment category, subject to the relevant legal conditions.
ISO/IEC 42001
A voluntary international standard for an AI management system: policy, roles, risk process, controls, internal audit and continual improvement. It is certifiable by an accredited body, which the AI Act itself is not.
Where they overlap
- Documented AI policy and operating rules
- Named roles and accountability
- An inventory of AI systems in use
- Competence and awareness of staff
- Risk identification and treatment
- Supplier and third-party oversight
Which to start with
For most smaller firms, start with the evidence both ask for: inventory, AI literacy records, policy, ownership. That work is not wasted under either instrument, and it is what a client questionnaire asks about first.
Beyond the two
The AI Act is an EU-wide framework, but national authorities enforce it alongside existing national rules on employment, equality, data protection and consumer protection. If you operate across several countries, you may need to account for more than the AI Act alone.