ISO 42001 vs the EU AI Act: mapping controls to obligations

The Strategic Importance of Alignment

The EU AI Act is the world's first comprehensive horizontal legal framework for AI, and it uses a risk-based approach to categorise systems. Most startups find themselves either in the 'Limited Risk' transparency tier or the 'High Risk' tier, which carries the heaviest compliance burden. ISO 42001, as an international management system standard (AIMS), was designed to be the operational vehicle for these requirements. It provides the documented processes that regulators expect to see when you claim your system is safe.

The beauty of ISO 42001 is its alignment with the 'New Legislative Framework' used by the EU. When the European Commission issues standardisation mandates, ISO standards often become the 'Harmonised Standards' that provide a presumption of conformity. While we wait for the final harmonised text, ISO 42001 represents the best available proxy for what a compliant AI management system looks like. Ignoring it now means you will likely have to rebuild your governance framework from scratch when the Act's deadlines hit in late 2025 and 2026.

• Risk management frameworks for high-risk systems.
• Data quality and governance protocols.
• Technical documentation and record-keeping requirements.
• Transparency and human oversight mechanisms.

Mapping Controls to Obligations

To avoid redundant work, you must map specific ISO 42001 controls directly to the Articles of the EU AI Act. For example, Article 9 of the Act requires a continuous risk management system throughout the lifecycle of a high-risk AI system. This maps almost perfectly to ISO 42001 Clause 6.1.2 and Annex A.4, which mandate a systematic approach to identifying, treating, and monitoring AI-specific risks like bias, hallucinations, and security vulnerabilities.

Data governance is another critical area where the two overlap. Article 10 of the EU AI Act demands that training, validation, and testing data sets be subject to appropriate governance. ISO 42001 Annex A.5 provides the practical controls for this, requiring organisations to document data sources, acquisition methods, and quality checks. By implementing these controls, you aren't just following a standard; you are building the evidence folder (the Technical Documentation) required for an EU 'Conformity Assessment'.

• Clause 6.1.2: AI Risk Assessment.
• Annex A.5: Data for AI Systems.
• Annex A.7: Transparency for AI Systems.
• Annex A.8: Human Oversight.

Risk Assessment: Beyond Traditional InfoSec

Traditional ISO 27001 risk assessments are often too narrow for AI, focusing primarily on confidentiality, integrity, and availability. ISO 42001 expands this scope to include societal impacts, ethical considerations, and the inherent 'black box' nature of neural networks. The EU AI Act is particularly concerned with fundamental rights, and ISO 42001 provides the framework to document how you've considered these impacts during the design phase.

In practice, this means your risk register must now include line items for things like 'algorithmic bias' and 'model drift'. You need to define what 'acceptable performance' looks like for your specific use case. If you are using AI for recruitment, a 5% error rate might be catastrophic and legally indefensible; for a marketing chatbot, it might be perfectly acceptable. ISO 42001 forces you to define these thresholds upfront and monitor against them, which is exactly what Article 15 of the EU AI Act requires regarding accuracy and robustness.

• Bias and fairness metrics (Annex A.5.3).
• Robustness and accuracy targets (Annex A.9.2).
• Explainability and interpretability requirements.
• Societal impact monitoring.

The Technical Documentation Challenge

The most significant hurdle in both ISO 42001 and the EU AI Act is the sheer volume of documentation required. For a High-Risk AI system, you must maintain a 'Technical Documentation' file that stays current throughout the system's life. ISO 42001's Clause 7.5 (Documented Information) and Annex A.7 (Transparency) provide the structure for this. You need to be able to show an auditor or a regulator exactly how a model was trained, what data was used, and who is responsible for the final decision-making.

Logging is not just a technical requirement; it's a legal one. Article 12 of the Act requires automatic recording of events ('logs') to ensure traceability. ISO 42001 Annex A.9 (Monitoring and Measurement) reinforces this by requiring organisations to monitor the AI system's performance. By integrating these logs into your GRC platform, you create a real-time audit trail. This transforms compliance from a periodic 'fire drill' into a continuous, defensible business process.

• A detailed AI Policy (Clause 5.2).
• An AI System Impact Assessment (A.4.2).
• Data quality reports and lineage logs.
• Human oversight protocols and logs.

Practical Implementation Steps

Don't wait for the EU AI Act to be fully enforceable before you start. The phased roll-out means certain prohibitions (like social scoring or certain types of biometric identification) kick in as early as early 2025. By implementing ISO 42001 now, you are building the 'scaffolding' that will hold up your legal compliance. The management system approach allows you to iterate; you don't need a perfect AI model on day one, but you do need a perfect process for managing it.

Start by conducting a discovery exercise across the business. Many firms have 'Shadow AI' where teams are using LLMs for code generation or customer support without oversight. Bringing these into an ISO 42001-aligned framework ensures you aren't blindsided by regulatory action. Focus on the 'high-water mark'—if you comply with the EU AI Act's requirements for transparency and data quality via ISO 42001 controls, you will likely exceed the requirements of almost any other global AI regulation, from the US Executive Order to the UK's 'pro-innovation' approach.

• Identify if you are a Provider, Deployer, or Importer.
• Perform a Gap Analysis against ISO 42001 Annex A controls.
• Establish an AI Ethics or Governance Committee.
• Integrate AI risks into your existing ISO 27001 ISMS.

Frequently asked questions