Does ISO 42001 make me AI Act compliant? Harmonised standards explained

Update of 15 October 2026. I wrote this text in June, when EN 18286 was still in development. The formal vote took place on 12 July 2026, and since 14 October 2026 the reference is published in the Official Journal: Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, in force on the day of publication. In the process I corrected two statements of the first version. EN 18286 is not a standard for AI management systems; its subject is the quality management system of providers of high-risk AI systems. And it does not cover the full set of AI Act requirements: the Decision lists it as point 9 of a standardisation request that covers several standards. Text, table and questions below give the state of 15 October 2026.

Many hear “ISO 42001” and think they are safe under the EU AI Act. It is not that simple. And to clear up a second misconception right away: there is no ISO 42001:2026, the current and only edition is the 2023 one.

ISO/IEC 42001:2023, and no 2026 version

At ISO the standard sits at stage 60.60, which simply means: published International Standard, currently in force. What you may meet as “EN ISO/IEC 42001” is only the European adoption of the same text into the EN catalogue. The year in that designation is the year of European ratification, not a new, technically changed edition. Anyone promising a fresh version of the standard is mistaken.

What presumption of conformity (Article 40) means

The AI Act works with a presumption of conformity: whoever meets a harmonised standard whose reference is published in the EU Official Journal is presumed to conform with the corresponding requirements of the law. That is a real easing of the burden of proof. But it hangs on exactly that word: harmonised.

Why ISO 42001 alone does not carry it

ISO/IEC 42001 is an international standard outside the EU harmonisation process and does not cover every requirement of the AI Act. Harmonised standards for the AI Act are drafted by CEN and CENELEC in the joint committee JTC 21, on a request from the Commission. The first of them has been listed since 14 October 2026: EN 18286:2026, through Implementing Decision (EU) 2026/2274. To date it is the only one.

What EN 18286 covers, and what it does not

Its subject is the quality management system of providers of high-risk AI systems, including post-market monitoring processes. That is what recital 3 of the Decision says. It is the obligation in Article 17. It is not a standard for AI management systems in the sense of ISO/IEC 42001, and it addresses providers, not deployers.

How far the presumption reaches for Article 17 is an open question of interpretation. For high-risk AI systems, Article 40(1) ties the presumption to the requirements in Chapter III Section 2, which are Articles 8 to 15, from risk management to cybersecurity. Article 17 sits in Section 3. Which articles the standard covers, the Decision does not say. Article 17 only becomes applicable with the high-risk obligations anyway: from 2 December 2027 for systems under Annex III and from 2 August 2028 for systems under Annex I, Article 113, third paragraph, point (c).

What this means in practice

ISO 42001 is still the right step now. The building blocks are the same ones the AI Act demands: know and treat AI risks, set roles and controls, monitor operation. Build that today and you have the substance in place. If you provide high-risk AI systems, you align your system with EN 18286, and that is a delta, not a restart. Those who wait for further harmonised standards end up building twice and under time pressure. How to start cleanly, we clarify in a free initial call.