Does ISO 42001 make me AI Act compliant? Harmonised standards explained
ISO/IEC 42001:2023 is the best preparation for the EU AI Act, but not a legal free pass. Why the presumption of conformity only comes through harmonised EN standards (EN 18286) and what that means in practice.
In short
ISO/IEC 42001:2023 is the current standard for AI management systems (stage 60.60, there is no 2026 version). It is the strongest preparation for the EU AI Act, but on its own it does not grant a legal presumption of conformity under Article 40. That only comes through harmonised European standards, which CEN-CENELEC is developing, dedicated through EN 18286. ISO 42001 builds the system, the harmonised standard delivers the presumption.
Auf Deutsch lesen: deutsche Fassung
Many hear "ISO 42001" and think they are safe under the EU AI Act. It is not that simple. And to clear up a second misconception right away: there is no ISO 42001:2026, the current and only edition is the 2023 one.
ISO/IEC 42001:2023, and no 2026 version
At ISO the standard sits at stage 60.60, which simply means: published International Standard, currently in force. What you may meet as "EN ISO/IEC 42001" is only the European adoption of the same text into the EN catalogue. The year in that designation is the year of European ratification, not a new, technically changed edition. Anyone promising a fresh version of the standard is mistaken.
What presumption of conformity (Article 40) means
The AI Act works with a presumption of conformity: whoever meets a harmonised standard whose reference is published in the EU Official Journal is presumed to conform with the corresponding requirements of the law. That is a real easing of the burden of proof. But it hangs on exactly that word: harmonised.
Why ISO 42001 alone does not carry it
ISO/IEC 42001 is an international standard outside the EU harmonisation process and does not cover every requirement of the AI Act. The dedicated harmonised standard is developed separately by CEN-CENELEC JTC 21. For AI management systems, EN 18286 is expected to fulfil the full set of regulatory requirements. The first harmonised standards are expected in 2026, after which the Commission assesses publishing the references in the Official Journal.
| ISO/IEC 42001:2023 | Harmonised EN standard (EN 18286) | |
|---|---|---|
| Purpose | Build and run an AI management system | Evidence conformity with AI Act requirements |
| Presumption of conformity (Art. 40) | no | yes, once published in the Official Journal |
| Status | published, in force (stage 60.60) | in development, expected 2026 |
What this means in practice
ISO 42001 is still the right step now, not later. The building blocks are the same ones the AI Act demands: know and treat AI risks, set roles and controls, monitor operation. Build that today and you have the substance in place. The later alignment to the harmonised standard is then a delta, not a restart. Those who wait for the finished standard end up building twice and under time pressure. How to start cleanly, we clarify in a free initial call.
Frequently asked questions
Is there an ISO 42001:2026?+
No. The current and only valid edition is ISO/IEC 42001:2023 (stage 60.60, published International Standard). "EN ISO/IEC 42001" is only the European adoption of the same text, not a new technical edition.
Does an ISO 42001 certification make my company AI Act compliant?+
Not automatically. ISO 42001 is the best preparation, but the legal presumption of conformity under Article 40 only comes through harmonised EN standards. For AI management systems, EN 18286 is in development for that.
What is EN 18286?+
The dedicated European harmonised standard for AI management systems that CEN-CENELEC (JTC 21) is developing for the AI Act. It is expected to cover the full set of regulatory requirements and thereby enable presumption of conformity.
Should I wait for the harmonised standard?+
No. Build your AI management system to ISO 42001 now. The substance is the same, and the later alignment to the harmonised standard is a delta, not a fresh start. Waiting means double work under time pressure.
Author & expert review: Lars Zimmermann · ISO/IEC 42001 Senior Lead Auditor & ISO/IEC 27001 Lead Auditor (PECB)
Last updated: 15 June 2026. Researched and reviewed to the best of our knowledge; not a substitute for individual legal advice.
Sources & further reading
Questions about your own case?
In a free 15-minute intro call we assess where you stand on ISO 42001, ISO 27001 and the EU AI Act, honestly and without a sales pitch.