"If we get ISO 42001 certified, are we covered under the AI Act?" It is the question we hear most often from people running an SME. The short answer is no: ISO/IEC 42001 gives no presumption of conformity under Regulation (EU) 2024/1689. The long answer is more useful: it is today the most mature tool for organising AI governance, and for an SME it is often worth more as a method than as a certificate.
What ISO/IEC 42001 is (and what it is not)
Published in December 2023, ISO/IEC 42001 is the first certifiable international standard for an AI management system (AIMS). It uses the same harmonised structure as ISO 9001 and ISO/IEC 27001: clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, improvement) and an Annex A with 38 controls grouped into nine objectives, A.2 to A.10: AI policies, internal organisation, resources, impact assessment, life cycle, data, information for interested parties, use of AI systems, third-party and customer relationships. Annex B explains how to implement the controls, Annex C lists the risk sources typical of AI, Annex D guides integration with other management systems. As in 27001, choices are documented in a Statement of Applicability (clause 6.1.3).
It applies to any organisation, of any size, that provides or uses AI systems. In Italy it was adopted as UNI CEI ISO/IEC 42001:2024, available in Italian since January 2025, and replaced on 30 July 2026 by UNI CEI EN ISO/IEC 42001:2026 following its European adoption by CEN-CENELEC.
What it is not: it is not a harmonised standard under the AI Act, and it is not the quality management system that Article 17 requires from providers of high-risk systems.
The point that matters: no presumption of conformity
Article 40(1) of the Regulation is clear: the presumption of conformity applies only to harmonised standards whose references are published in the Official Journal of the EU. ISO/IEC 42001 sits outside that mechanism, and the EN label acquired in 2026 changes nothing: what counts is citation in the Official Journal following a Commission standardisation request, not European adoption as such.
The standard designed for Article 17 is a different one: EN 18286:2026 "Artificial intelligence – Quality management system for EU AI Act regulatory purposes", published by CEN-CENELEC in July 2026, the first of the JTC 21 standards to cross the finish line. At the time of writing it has not yet been cited in the Official Journal. Until it is, no standard grants a presumption of conformity and the burden of demonstrating compliance with the Regulation rests entirely on the operator, certified or not.
There is a bridge, though: EN 18286 includes an annex mapping its requirements to the ISO/IEC 42001 Annex A controls (and another to ISO 9001). Anyone with a structured AIMS does not start from scratch.
Where ISO 42001 genuinely helps an SME
The strength of the standard is that it forces you to answer, in writing, the same questions the AI Act asks. A practical mapping:
| AI Act obligation | Where ISO/IEC 42001 covers it |
|---|---|
| AI literacy for staff (Article 4, since 2 February 2025) | Competence and resources: clause 7.2 and objective A.4 |
| Risk management system (Article 9) | Risk assessment and treatment (clause 6.1) and the risk sources in Annex C |
| Deployer obligations: use per the instructions, competent human oversight, monitoring, logs kept for at least six months (Article 26) | Use of AI systems (A.9) and life cycle (A.6) |
| Fundamental rights impact assessment (Article 27, where due) and DPIA | Impact assessment (A.5), with the ISO/IEC 42005:2025 guidance |
| Transparency towards users and individuals (Article 50) | Information for interested parties (A.8) |
| Suppliers and third-party components | Third-party and customer relationships (A.10) |
For a deployer — the vast majority of SMEs, which buy software with AI inside — this is the part that matters: the standard gives structure to the inventory, the risk classification and the chain of responsibility towards suppliers. For a provider of high-risk systems it is a solid organisational base, but the Article 17 quality system has to be built on EN 18286.
To certify or not: three questions
- Are you the provider of a high-risk system? Obligations for Annex III systems apply from 2 December 2027 and for Annex I systems from 2 August 2028 (Regulation (EU) 2026/1744). The same Digital Omnibus extended to all SMEs, including start-ups, the option to implement certain elements of the quality system in a simplified manner (Article 63), provided they have no partner or linked enterprises, and introduced simplified technical documentation for SMEs and small mid-caps. ISO 42001 is a good starting point, not the finish line.
- Are you a deployer using third-party AI? The certificate is rarely needed. The method is: a gap analysis against Annex A, a Statement of Applicability, a few living procedures. You certify if customers, tenders or the group ask for it.
- Do you need to reassure customers, banks or tender specifications? Then certification is worth it, but only if accredited. In Italy, Accredia launched the accreditation of certification bodies with circular DC 08/2026, based on ISO/IEC 17021-1 supplemented by ISO/IEC 42006:2025, which sets auditor competence requirements. A non-accredited certificate carries little weight.
Three mistakes to avoid: mistaking the certificate for compliance; a Statement of Applicability copied rather than reasoned over the systems actually in use, including those employees adopt without authorisation; keeping the AIMS separate from 27001 and the GDPR instead of integrating them.
Where to start
Before deciding whether to certify, it pays to know where you stand: which AI systems are in use, in which role (provider or deployer), with which obligations and from when. An independent gap assessment, run with Annex A as the grid and the AI Act as the yardstick, returns a plan with priorities, owners and dates. Certification, if needed, comes afterwards.