What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the first international standard for an AI Management System (AIMS). It describes how organisations can develop, provide or use AI responsibly, transparently and with evidence.
For institutions with an existing ISO 27001 or ISO 9001 management system, this is helpful because ISO/IEC 42001 follows the familiar management-system logic: context, leadership, planning, support, operation, performance evaluation and improvement.
What does ISO/IEC 42001 contribute to the EU AI Act?
The standard supports governance, risk and quality management, competence, documentation, supplier control and continuous improvement. It is therefore a strong framework for anchoring EU AI Act compliance organisationally.
- Risk management and documented assessment processes
- Data governance and quality requirements
- Human oversight and responsibilities
- Competence, awareness and training
- Supplier and lifecycle management
Where does ISO/IEC 42001 reach its limits?
Five topics need separate checks: role allocation, CE marking and EU database, FRIA, incident response and labour law.
| Area | EU AI Act requires | Additionally required |
|---|---|---|
| Role allocation | Distinction between provider, deployer, importer and distributor | Legal and process assessment for each system and use case |
| CE / EU database | Provider duties for high-risk AI | Conformity assessment, technical documentation and registration where a provider role exists |
| FRIA | Fundamental Rights Impact Assessment for certain high-risk uses | Specific impact assessment for credit and life/health insurance and possibly other constellations |
| Incident response | Reporting obligations under the EU AI Act, GDPR and DORA | Coordinated three-regime process with clear deadlines and escalation paths |
| Labour law | Information and possibly co-determination for HR AI | Involvement of employee representatives and review of Austrian labour constitution requirements |
Which AI Act duties does ISO/IEC 42001 not fully cover?
Five formal duties: conformity assessment (Art. 43), CE marking (Art. 48), EU database registration (Art. 49), post-market monitoring (Art. 72) and incident response (Art. 73). ISO/IEC 42001 is a strong management-system framework, but certification does not automatically replace these duties. The gaps should be documented explicitly.
| Gap | EU AI Act | Additional clarification |
|---|---|---|
| Conformity assessment | Art. 43 | Formal procedure for each provider role and high-risk system. |
| CE marking | Art. 48 | Relevant where provider duties apply; process and evidence must be handled separately. |
| EU database registration | Art. 49 | Registration duties for certain high-risk systems must be assessed separately. |
| Post-market monitoring | Art. 72 | AI-Act-specific monitoring and feedback with provider information must be defined. |
| Incident response | Art. 73, GDPR, DORA, NISG 2026 | Reporting cascade with different authority routes and timelines must be mapped. |
Which harmonised EU standards exist for the AI Act?
CEN/CENELEC are developing harmonised standards for the EU AI Act. The first standard for AI Act purposes, EN 18286:2026 (quality management system for AI Act purposes, in particular Art. 17 for providers of high-risk AI), was announced as published by CEN/CENELEC on 31 July 2026. Publication of the standard and citation of its reference in the Official Journal of the EU are two separate steps: only the Official Journal citation triggers a presumption of conformity. For EN 18286 it was published by Implementing Decision (EU) 2026/2274 on 14 October 2026; the presumption covers the Art. 17 requirements addressed by the standard. ISO/IEC 42001 is a strong foundation, but it does not automatically replace this assessment.
CSRD / ESRS: Can ISO 42001 serve as an evidence framework?
Yes, as an organisational framework. If AI bias or discriminatory AI decisions are classified as material sustainability impacts or governance risks, CSRD / ESRS reporting needs robust evidence. ISO/IEC 42001 can provide the organisational framework: policies, roles, risk assessments, controls, monitoring, internal audits and management reviews. It does not replace the ESRS reporting obligation, but it makes evidence much easier to structure. This presupposes that the institution is subject to reporting at all: Directive (EU) 2026/470 has limited the CSRD scope to EU companies with more than 1,000 employees and more than EUR 450 million net turnover; national transposition, transition years and group-level assessment must also be checked. The impact or risk must also be material – not every bias incident leads to an ESRS disclosure.
Implementation is not a pure IT project. It affects the board, compliance, legal, IT, HR, procurement and business units. Core elements are scope, AI inventory, risk and control model, roles, evidence and regular management reviews.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).