Somewhere in the last year, AI governance turned into a sales pitch. Vendors offer ISO 42001 readiness, certification bodies offer certificates, and the pitch usually goes the same way: the EU AI Act is coming, there is a deadline, and ISO 42001 gets you compliant.
Some of that is real. A lot of it is sold to companies who do not need it, for reasons that fall apart as soon as you look closely. The useful question is whether it is worth having for you, right now, and what you would be buying.
What ISO 42001 actually is
ISO/IEC 42001 was published in December 2023 and is still in its first edition. It is an AI management system standard built on the same frame as ISO 27001, which means the certificate covers the way your organisation works rather than any individual product: context, leadership, planning, support, operation, checking, improving.
On top of that frame it adds AI-specific controls in its Annex A. Some set direction: an AI policy, named roles for AI decisions, and rules for the data you train on. The rest covers the work itself, with checks at each stage of an AI system, from the first design to watching it once it is live, what you tell users, and how you handle AI that comes from third parties.
The new part, if you come from ISO 27001, is the AI impact assessment. The risk assessment you know from ISO 27001 asks what could go wrong for your company. The AI impact assessment asks what your system could do to the people it is used on. For a CV screening tool, that means asking who gets filtered out and whether anyone checks. ISO 42001 keeps a risk assessment of its own as well; the impact assessment sits beside it.
A second standard, ISO/IEC 42006, covers the auditors' side. Published in July 2025, it sets out what a certification body must be able to do before it audits AI management systems. Certifiers are themselves checked against it by a national accreditation body, DAkkS in Germany. Until it existed there was nothing to check them against, so some 42001 certificates on the market were issued before anyone was accredited to issue them. If a certifier approaches you, ask whether their accreditation covers 42001.
What it is not
Most pitches lean on the EU AI Act, so start there. ISO 42001 does not make you EU AI Act compliant, and no honest auditor will tell you otherwise.
The AI Act has a shortcut built into it. If you follow a standard the EU has officially approved for a requirement, a regulator presumes you have met it, and it is on them to show otherwise. Those approved standards are called harmonised standards, and they are listed in the EU's Official Journal. ISO 42001 is an international standard written outside that process, so following it gives you no legal presumption.
Part of the confusion is that the AI Act does want a management system of its own. Article 17 of the AI Act asks providers of high-risk AI for a quality management system and spells out what belongs in it: how you check a system before it goes out, how you watch it once it is live, how you report serious incidents, who is accountable for what, and how you keep the technical documentation. If that sounds like ISO 42001, that is where the sales pitch gets its grain of truth.
The European standard written for that job is EN 18286. It was published in July 2026, and on 14 October 2026 the Commission cited it in the Official Journal, which made it the first harmonised standard under the AI Act. That citation is the step that creates the shortcut. ISO 42001 does not have it and is not in line for it.
The two are not in competition. A 42001 management system gives you the scaffolding, the roles, the documentation habits and the review cycle that an Article 17 system under the AI Act then sits inside.
Who actually needs one
You sell AI features to enterprise or regulated buyers. This is the strongest case, and it has nothing to do with the law. Security questionnaires now have AI sections, and the people filling them in have no standard way to judge you. A certificate shortens that review in the same way ISO 27001 does. If two of your last five deals stalled on AI questions, that is your answer.
You are a provider of a high-risk AI system. December 2027 sounds far away until you count backwards through a 42001 certification cycle. You need a documented quality management system for Article 17 of the AI Act regardless, and EN 18286 is now published and cited, so you can build against the final text instead of waiting. Most of its structure overlaps with 42001. Building the management system now and adding the per-system work later is cheaper than doing both in 2027.
You already hold ISO 27001 and AI is central to your product. The frame, the internal audit, the management review and the corrective action process already exist. You are adding AI-specific controls to a machine that already runs.
Who is being sold one
"We use ChatGPT and Copilot internally." Using AI tools makes you a deployer in the Act's terms, and deployers carry far fewer obligations than providers. What your customers want to know is whether company data ends up in someone's training set. A two-page AI usage policy inside your existing information security management system (ISMS) answers that. A certificate about how you develop AI answers a question nobody asked.
"It makes you AI Act compliant." It does not, for the reasons above. If this is the reason you are being given, ask the seller which article of the AI Act the certificate satisfies, and watch what happens.
"There is a deadline in August." There was. It is now December 2027 for most high-risk uses, with the details below. Buying a certificate in a panic tends to produce the kind of management system that exists in a folder and nowhere else.
"We want the badge." Some companies have no AI in the product at all and buy this for the logo. It is an expensive logo, and it is not a one-off purchase either: an auditor comes back every year to keep the certificate alive.
Where the deadlines stand now
A lot of the urgency in your inbox is out of date.
The Digital Omnibus on AI, Regulation (EU) 2026/1744, was adopted on 8 July 2026 and came into force on 27 July 2026. It changed the AI Act timetable:
- High-risk systems on the Annex III list, which covers uses such as recruitment, credit scoring and education, now apply from 2 December 2027.
- High-risk AI built into regulated products, such as machinery or medical devices, applies from 2 August 2028.
One change is about scope rather than dates. The quality management system in Article 17 of the AI Act was already meant to be proportionate to the size of the provider. The omnibus now names SMEs, start-ups and small mid-caps expressly, and opens the simplified route to all SMEs.
What did not move: the transparency rules in Article 50 of the AI Act still apply from 2 August 2026. If people interact with your AI, they have to be told, and AI-generated content has to be marked. The one exception is that generative systems already on the market before August 2026 have until 2 December 2026 to add the marking. The rules for general-purpose AI models, meaning the large models that get built into many different products, such as the ones behind chat assistants, have applied since August 2025.
Where to start
- Write down where AI sits in your business: in your own product, inside a vendor's product you resell, and in internal tools your team uses. One table is enough.
- For each entry, decide whether you are the provider or the deployer. The obligations are completely different, and most companies are a deployer in more places than they think.
- Ask your three largest customers whether they will require AI certification in the next year. Their answer tells you whether certification would help you win deals, or whether it is purely a governance decision.
- If you already hold ISO 27001, compare what you do against Annex A of 42001 before committing to anything. A gap analysis usually shows the work is smaller than the readiness vendors suggest.
- Give AI governance an owner. The most common finding in this area is that nobody is responsible for the decisions.
What's next?
ISO 42001 runs on the same machinery as every other management system, so if you have never built one, the first steps in setting up your ISMS is the place to start. And because the new part of 42001 is the impact assessment, planning and executing your risk management shows the risk assessment it sits next to.